ISO 27001 readiness, without the theatre.
ISO/IEC 27001:2022 certification requires an information security management system (ISMS) with a documented risk assessment, a risk treatment plan and a Statement of Applicability covering the 93 controls in Annex A. Cognivus runs the gap assessment and risk work, and implements the missing controls, so you are ready for an accredited certification body’s audit.
What readiness involves
- Scope: which products, locations and teams the ISMS covers
- Gap assessment: clauses 4–10 and the Annex A controls, against what you do today
- Risk assessment and treatment (clauses 6.1.2 and 6.1.3), using a documented method
- Statement of Applicability: each Annex A control, whether it applies, and why
- Close the gaps: policies, access control, logging, supplier management, backups, training
- Internal audit and management review before the certification audit
Annex A in 2022
The 2022 revision groups 93 controls into four themes: organisational (37), people (8), physical (14) and technological (34). New controls include threat intelligence, cloud services security, data masking, data leakage prevention and secure coding.
Who certifies you
Only an accredited certification body can certify you. We prepare you for that audit; we do not issue certificates, and we are independent of the certification bodies.
Typical duration: 8–16 weeks, depending on scope and how much is already in place.
Frequently asked questions
Can you certify us?
No. Certification is issued by an accredited certification body after its own audit. We prepare you for that audit.
Do we need ISO 27001 or SOC 2?
It depends on your customers. ISO/IEC 27001 is widely requested internationally; SOC 2 is common with US buyers. The risk assessment and most controls overlap, so work on one carries over to the other.
We are a small team. Is ISO 27001 realistic?
Yes, if the scope is set sensibly. The standard scales with the organisation; a small SaaS team usually needs fewer, simpler controls, documented well.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.