ISO 27001

ISO 27001 describes neither a product nor a technology but a management system: demonstrable processes for how an organisation identifies, assesses, treats, and regularly reviews its information risks. What gets certified is not that a system is secure, but that there is a documented way of dealing with security.

The route there starts with a gap analysis against the requirements: what already exists, what happens in practice but undocumented, and what is missing entirely? In our experience the second point is the largest - many controls are long since lived, but were never recorded so an auditor could follow them.

Technically the usual building blocks carry the evidence: governed access control with documented roles, logging that answers questions after the fact, a tested backup and recovery concept, and a process for vulnerabilities and incidents. Anyone already running these cleanly has the larger part of the work behind them.

The certificate itself is issued by an accredited body, not by a service provider. Our role is that you walk into that audit with evidence that holds up and controls that work - rather than with documentation describing what ought to happen.