ISO/IEC 27001:2022
An ISMS your team will actually run.
We build the ISMS around how you already work, test it with an internal audit and prepare you for certification with an accredited body.
Companies selling into Europe and global enterprises that expect a certificate, not a questionnaire.
app.resilientprivacy.com/grc/iso-27001
Simulated environment, real workflow.
Control readiness
All 93 Annex A controls, one status each.
The Statement of Applicability starts as a live list: implemented, in progress or a gap with an owner. You see the share move week by week until stage 1.
- Implemented 70
- In progress 12
- Gap 6
- Not applicable 5
| Status | Count | Share |
|---|---|---|
| Implemented | 70 | 75% |
| In progress | 12 | 13% |
| Gap | 6 | 6% |
| Not applicable | 5 | 5% |
Simulated environment, real workflow.
Where AI lands in ISO 27001.
ISO/IEC 42001 uses the same management-system structure. Our AI governance practice extends this ISMS to an AI management system without a second set of policies.
How readiness works
Five steps from first call to audit-ready.
- 01
Context and scope
Define the ISMS boundary, interested parties and the objectives leadership signs off.
Output: ISMS scope statement
- 02
Risk assessment
Identify risks to information, pick treatments and produce the Statement of Applicability.
Output: Risk treatment plan
- 03
Build the ISMS
Policies, procedures and Annex A controls fitted to your stack, not copied from a template.
Output: Statement of Applicability
- 04
Internal audit and review
An independent internal audit and a management review, both required before certification.
Output: Internal audit report
- 05
Certification support
Stage 1 and Stage 2 audit preparation and response with an accredited certification body.
Output: Certification audit pack
Deliverables
What you keep when we are done.
Documents and systems your team owns and runs, not a binder that goes stale.
- ISMS scope and context document
- Risk register and risk treatment plan
- Statement of Applicability
- Policy set and control procedures
- Internal audit report and management review minutes
- Certification body shortlist and Stage 1 readiness check
Typical timeline
Varies with scopeScope and risk
Weeks 1–4
Context, asset inventory, risk assessment.
Build
Weeks 4–12
Policies, controls, Statement of Applicability.
Operate and audit
Weeks 12–16
Evidence of operation, internal audit, management review.
Certification
Stage 1 and 2
Audits by an accredited certification body.
FAQ
Straight answers.
Do you certify us?
Certification comes from an accredited certification body. We build the ISMS and prepare you for its audits.
What about ISO 42001?
It is the AI management system standard and shares the ISMS clause structure. Our AI governance practice runs it as an extension of this work, so policies, risk method and internal audit are reused.
We already have SOC 2. How much is reusable?
Most technical controls carry over. The new work is mostly the management system itself: risk method, objectives, internal audit and review.
What happens after certification?
Surveillance audits each year and recertification every three years. We can run the internal audits in between.
Find out how close you are to audit-ready.
A 30-minute readiness conversation with a Risk & Compliance lead, scoped to the frameworks you are asked for.