ISO 27001 Certification Consulting
Achieve ISO 27001 certification with expert guidance at every stage — from initial assessment and planning to the final certification audit.
ISO/IEC 27001:2022 is the international standard for an Information Security Management System. Passeca runs the full engagement — gap analysis, ISMS design, implementation, internal audit, and certification via an accredited body — building evidence in Hyperproof so the same work also satisfies SOC 2, BSI C5 and TISAX.
What is ISO 27001?
ISO/IEC 27001:2022 is the international standard that specifies the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS) — a management system for managing information-security risk. It is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
New to ISO 27001? Read our complete ISO 27001 certification guide
Who needs ISO 27001?
- Enterprise customers demand it. ISO 27001 is the most frequently requested certification in EU enterprise procurement and security questionnaires.
- You are a SaaS or technology vendor. It demonstrates a baseline of information-security management that buyers trust.
- You are an EU essential or important entity. ISO 27001 is the control framework most commonly used to satisfy NIS2 risk-management-measure obligations.
- You process sensitive customer data. Certification provides independent assurance that you manage that data to an internationally recognised standard.
What does ISO 27001 require?
Your ISMS must meet the mandatory management-system clauses (4–10). You then apply the Annex A controls that your risk assessment selects and document them in a Statement of Applicability.
How Passeca gets you certified
Five phases, with a clear split between what you do and what we do.
- 01
Gap analysis
We assess your current information-security arrangements against the 93 controls of ISO/IEC 27001:2022 Annex A and the management-system clauses (4–10). You receive a prioritised gap report and a maturity score.
- 02
ISMS design & roadmap
We design the Information Security Management System — scope, risk methodology, policies, the Statement of Applicability — and sequence the work into a costed roadmap with owners and dates.
- 03
Implementation
We build the missing controls with you: policies, technical configuration, awareness training, supplier management. Evidence is captured in Hyperproof as we go, not reconstructed later. Read the implementation guide
- 04
Internal audit & management review
We run a full internal audit against the same criteria the certification body will use, close the findings, and facilitate the formal management review — both are mandatory before certification. How ISO 27001 audits work
- 05
Certification audit (Stage 1 + Stage 2)
We introduce you to an accredited certification body, accompany you through the Stage 1 documentation review and the Stage 2 on-site audit, and manage the response to any non-conformities.
What you get from the engagement
How long does ISO 27001 certification take?
Most organisations achieve certification within 6–8 months. The exact timeline depends on company size, the number of sites in scope and your current security maturity. Organisations that already run SOC 2 or a mature control set can move faster.
How much does ISO 27001 certification cost?
ISO 27001 certification involves two main costs:
- Consulting and implementation. Passeca helps you prepare for certification by assessing your current security practices, developing the necessary policies and implementing security controls.
- Certification audit. An independent certification body evaluates your Information Security Management System (ISMS) and determines whether it meets ISO 27001 requirements.
These services are priced and billed separately to maintain the independence of the certification process.
The total cost depends on your organisation's size, the number of locations included in the certification, your existing security measures and how much preparation is needed.
Every scope is different. Book a free consultation and we'll give you a tailored estimate.
Doing more than one framework?
ISO 27001 overlaps heavily with SOC 2 — do the work once.
ISO 27001 and SOC 2 share roughly 80% of their controls. Building the evidence once in Hyperproof lets you pursue both — or add BSI C5 and TISAX — without redoing the work. Passeca maps controls across frameworks as a standard part of the engagement.
ISO 27001 certification, answered
Can Passeca issue the ISO 27001 certificate?
How much does ISO 27001 certification cost?
Does ISO 27001 cover SOC 2 as well?
What happens after we are certified?
More questions about ISO 27001? Visit our ISO 27001 knowledge base
Start Your ISO 27001 Certification Journey
Tell us about your organisation, current security practices and certification goals. We'll help you understand the next steps, estimated timelines and the right scope for your organisation.
Related