ISO 27001 readiness assessment
We test your information security management system against ISO/IEC 27001:2022 before your certification body does: the management clauses, the 93 Annex A controls, and the Statement of Applicability that ties them together. You get a register of every gap, who owns it, and what it takes to close.
Who it is for
- Organizations going for first certification that want to know what the Stage 1 and Stage 2 audits will find.
- Certified organizations preparing for a surveillance or recertification audit.
- Teams asked for ISO 27001 in a tender or by a customer, deciding whether to pursue it.
What we assess
- Clauses 4 to 10: scope and context, leadership, risk assessment and treatment, support, operation, performance evaluation (including internal audit and management review) and improvement.
- Annex A: all 93 controls across the four themes, organizational (37), people (8), physical (14) and technological (34), each tested against evidence rather than interviews alone.
- The Statement of Applicability: whether every inclusion and exclusion is justified by your risk assessment.
- The physical controls in A.7, tested on site by the same team. Most cyber-only firms review these on paper. See ISO 27001 Annex A.7.
What you receive
- A clause and Annex A register: rating, evidence reviewed, owner and remediation step for each item.
- A review of your Statement of Applicability.
- A prioritized remediation plan with a price range on every item.
- A readout for leadership, including which gaps sit on the critical path to your audit date.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Typically three to five weeks from kickoff to final report for one ISMS scope and up to two sites.
Common questions
Do you issue the ISO 27001 certificate?
No. Certificates are issued by accredited certification bodies after a Stage 1 and Stage 2 audit, and we are not a certification body. We assess readiness so the certification audit has fewer surprises, and we have no commercial tie to any certification body.
Our ISMS was built on ISO 27001:2013. Does that matter?
Yes. The 2013 edition has been withdrawn and the transition period has ended, so certification audits are now against ISO/IEC 27001:2022. Its Annex A was restructured into 93 controls, including new ones such as threat intelligence, configuration management and data leakage prevention. We map your existing controls onto the 2022 structure so earlier work carries over.
How long until we can be certified?
It depends mostly on how mature your controls are and how your certification body schedules Stage 1 and Stage 2. The assessment shows which gaps are on the critical path, so you can plan the audit date around them instead of guessing.
Can you assess ISO 27001 and SOC 2 together?
Yes. They overlap heavily. We assess once and map each control to both, so evidence collected for one counts for the other. See SOC 2 readiness.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
ISO 27001 readiness
We reply within one business day.
Nothing you send is shared outside Calibre.