ISO 27001 certification has been described as “Quality Management on steroids”.
It’s a much more involved standard to meet and exceed than ISO9001 and requires your organisation to demonstrate compliance with 93 separate information security controls, plus a whole range of risk identification, treatment actions and management involvement.
Retrofitting ISO27001 to your existing information security management system can be challenging. That’s where our experience comes into play. Our consultants can help you align to the standard, identify gaps and fill them without requiring you to start from scratch. We will be your guide through uncharted waters.
Please call us on 1300 667 871 or fill in the form below and we’ll be in touch quickly.
ISO 27001 is an internationally recognised standard outlining best practices for establishing, managing, and continually improving an Information Security Management System (ISMS).
Certification demonstrates your commitment to protecting sensitive information, enhances customer trust, ensures compliance with legal obligations, and can provide a competitive advantage.
Typically, organisations take between 3 to 12 months, depending on their size, complexity, existing documentation, and resource availability.
The process generally includes gap analysis, risk assessment, ISMS design and implementation, internal audits, management reviews, and the formal certification audit.
While it is possible to handle internally, most businesses engage specialist consultants to streamline the process, leverage expert knowledge, and reduce complexity. Comparing the ISO 27001 requirements with your current security practices can be overwhelming – you may think you need to over – but a consultant from Computer One can clearly map how your processes align with the standard and help you identify fewer gaps than you might anticipate.
A certified auditor conducts a two-stage audit: Stage 1 assesses your documentation and preparedness; Stage 2 evaluates practical implementation and effectiveness of your ISMS.
Certification is valid for three years, with mandatory annual surveillance audits to ensure continuous compliance and improvements in your ISMS.
You’ll need policies, procedures, risk assessment documentation, a document known as your “Statement of Applicability”, internal audit records, management review minutes, and incident management plans.
The SoA is a mandatory ISO 27001 document outlining which of the 93 security controls are implemented in your ISMS, why they were chosen or not, and how they are applied.
Costs vary significantly, influenced by company size, complexity, existing security practices, consulting fees, audit costs, and staff training expenses. Computer One can produce a cost expectation after a brief conversation.
