ISO/IEC 27001 certification. Show how you manage information risk.

What to prepare

An ISMS is more than a set of security policies.

ISO/IEC 27001 is the international standard for information security management systems. A useful assessment connects the stated ISMS scope to information risks, treatment decisions, controls and evidence that those controls work. We would agree the assessment criteria and the competence needed for your scope before starting.

Depending on your activities, the review may examine:

• the boundaries of the ISMS, information assets and relevant interested parties;
• risk assessment and treatment, including why controls are included or excluded in the Statement of Applicability;
• access, supplier, incident and business continuity arrangements relevant to the scope; and
• monitoring, internal audit, corrective action and management review records.

Documents alone are insufficient: interviews, operational records and suitable sampling help test how the system works. See ISO's explanation of ISO/IEC 27001.

Responsible technology

AI may help organise evidence. People assess it.

We are developing a workflow that may use AI to sort approved records, map possible evidence to the agreed criteria and highlight questions for an assessor. It will not decide conformity or issue a certificate.

Information security records can be sensitive. Before any AI processing, we will agree the tools, permitted material, access, retention and any third-party handling with you. We intend to retain source references, check generated summaries against the originals and let you query errors. Read our responsible AI approach.