ISO 27001 and GRC consulting
Get certification-ready for ISO 27001 with a practical ISMS your team can actually run.
- Standard
- ISO/IEC 27001:2022
- Also
- 27701 · 22301 · 42001
- Privacy
- DPDP-aware
- Output
- Audit-ready ISMS
Who our ISO 27001 consulting is for
As ISO 27001 consultants, we help organisations build an information security management system that is ready for the certification audit and still in use the year after. The work is led by an ISO/IEC 27001:2022 Lead Auditor and Lead Implementer.
- Companies whose customers now require ISO 27001 certification
- Organisations preparing for a first certification or surveillance audit
- Teams handling personal data that need privacy governance under India's DPDP Act
- Businesses adopting AI that want governance aligned with ISO/IEC 42001
Before
- Policies copied from a template nobody follows
- Risks tracked in someone's head
- Audit evidence gathered in a rush
After
- Policies that match how you really work
- A living risk register with owners
- Evidence collected as part of normal work
ISO 27001 gap analysis and internal audit
A gap analysis compares how you work today with the clauses of ISO/IEC 27001:2022 and the 93 Annex A controls. You get a gap report that rates each requirement, explains what is missing in plain language and turns it into a prioritised plan with owners.
Before the certification body arrives, the standard requires an internal audit and a management review. We run the internal audit independently of the people who built the controls, record nonconformities and observations, and help you close them, so the external Stage 1 and Stage 2 audits hold no surprises.
SOC 2 readiness
US customers often ask for a SOC 2 report instead of, or as well as, ISO 27001. We help with readiness: choosing the Trust Services Criteria in scope, mapping them to the controls you already have, closing gaps, and collecting the evidence an auditor will sample over a Type 2 observation period.
We prepare you for the examination; the SOC 2 audit itself and the report are issued by a licensed CPA firm, which we do not act as. If you already run an ISMS, much of the evidence can be reused.
What you get from ISO 27001 consulting
Named documents and outcomes you keep. Scope is agreed per engagement.
- 01
Gap assessment
Where you stand against ISO/IEC 27001:2022 clauses and Annex A.
- 02
Risk register and treatment plan
Risks with owners, ratings and agreed treatment.
- 03
Statement of Applicability
Every Annex A control: applicable or not, why, status and evidence.
- 04
ISMS policy set
Policies and procedures written for how you actually work.
- 05
Internal audit report
An independent check of the ISMS before the certification audit.
- 06
Management review minutes
Recorded review of ISMS performance by leadership.
How ISO 27001 implementation runs
Open each phase to see what it produces and who does what.
Sample ISO 27001 deliverable
An illustrative sample with placeholder names and data, not a real client document.
| Annex A control | Applicable | Status | Evidence | Owner |
|---|---|---|---|---|
| 5.1 Policies for information security | Yes | Implemented | Policy v1.2, approved | CEO |
| 5.15 Access control | Yes | Implemented | Access policy, quarterly review | IT lead |
| 5.23 Information security for use of cloud services | Yes | In progress | Cloud register draft | IT lead |
| 6.3 Information security awareness, education and training | Yes | Implemented | Training records | HR |
| 8.8 Management of technical vulnerabilities | Yes | In progress | Scan reports | ITCCS |
| 8.13 Information backup | Yes | Implemented | Restore test log | IT lead |
| 8.16 Monitoring activities | Yes | Planned | — | IT lead |
| 8.24 Use of cryptography | Yes | Implemented | Encryption standard | CTO |
ISO 27001 engagement formats
Fixed-scope project
- When it fits
- You have a defined outcome: a migration, a test, a certification or a rollout.
- Included
- Agreed deliverables, a named lead, progress updates and handover.
- How it is priced
- Quoted after a scoping call; the price depends on the number of users, sites, applications or controls in scope.
Ongoing support retainer
- When it fits
- You want someone to run, monitor and improve things month after month.
- Included
- Monitoring, changes, reviews and a monthly report within an agreed scope.
- How it is priced
- A monthly fee quoted after a scoping call, based on users, devices and systems covered.
Advisory hours
- When it fits
- Your team does the work and wants expert review or answers.
- Included
- Calls, document and design reviews, and written recommendations.
- How it is priced
- A block of hours agreed in advance; the rate is quoted after a short call.
ISO 27001 tools we use
- ISO 27001
- ISO 27701
- ISO 22301
- ISO 31000
- ISO 27017
- ISO 42001
- DPDP Act
ITCCS is an independent consultancy. Product names and logos are trademarks of their respective owners, shown only to identify the platforms we work with. No partnership, certification or endorsement is implied.
Standards for ISO 27001
- ISO/IEC 27001Information security, certification-ready ISMSLearn moreRead about ISO/IEC 27001
- ISO/IEC 27701Privacy management, standalone or with 27001Learn moreRead about ISO/IEC 27701
- ISO 22301Business continuity that holds upLearn moreRead about ISO 22301
- ISO/IEC 27017Cloud security controlsLearn moreRead about ISO/IEC 27017
- ISO/IEC 42001Responsible AI managementLearn moreRead about ISO/IEC 42001
- India DPDP Act 2023Personal data protection complianceLearn moreRead about India DPDP Act 2023
We implement and prepare organisations for these standards. Certification is issued by accredited bodies.
Related certifications
- ISO/IEC 27001:2022 Lead AuditorHeld
- ISO/IEC 27001:2022 Lead ImplementerHeld
- ISO 31000 Risk ManagerHeld
Typically four to nine months, depending on scope, the controls already in place and how quickly evidence can be produced. We give you a plan after the gap assessment.
No. Certificates are issued by an accredited certification body. We prepare you for the audit and support you during it, and can help you choose a body.
A required document listing each Annex A control, whether it applies to you, why, and how it is implemented. Auditors review it closely.
Not fully. ISO 27001 covers security; DPDP adds obligations around consent, notices and data principal rights. ISO 27701 helps bridge the gap, and we map both.
Yes. We can act as your independent internal auditor and support surveillance and recertification audits.
The number of sites, people, systems and processes in scope, how mature your current controls are, and whether you want ongoing support after certification.
We use named accounts with the least access needed, prefer your own admin tools over shared passwords, move files only through encrypted channels and remove our access at handover. For ISO 27001 work we mostly need read access to policies and evidence, and we keep risk registers and audit records in your own systems. Our full practices are on our Trust page.
We can support surveillance audits, keep the risk register and evidence current, and run yearly internal audits under a retainer.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal