ISMS scope and current-state assessment
Scope, evidence and responsibilities agreed before work starts.
ISO/IEC 27001 · INFORMATION SECURITY
Make information security a managed business priority.
Bring your scope, risks, controls and evidence into a workable information security management system. Move beyond scattered policies and towards responsibilities your organisation can maintain.
Illustrative artwork · not client premises or a completed engagement
MAKE THE SYSTEM USEFUL
Connect the risks,
controls and evidence.
Customers ask for assurance, teams rely on cloud services and evidence is spread across people and tools. The work starts by defining what needs protecting and how the existing arrangements are managed.
WHAT WE CAN AGREE TO DELIVER
01
ISMS scope and current-state assessment
02
Risk assessment and treatment support
03
Control and Statement of Applicability organisation
04
Internal-audit, review and corrective-action support
START WITH THREE QUESTIONS
01 What information, services and locations are in scope?
02 What customer or contractual assurance is being requested?
03 Which technical providers and control owners need to participate?
No confidential documents needed at first contact.
HOW THIS ENGAGEMENT TAKES SHAPE
A management system, not a document exercise.
01
Understand the scope
ISMS scope and current-state assessment
02
Review what exists
Risk assessment and treatment support
03
Build the next actions
Control and Statement of Applicability organisation
THE OUTPUT, NOT JUST THE CONVERSATION
A clearer picture of the support.
A useful engagement should leave you with agreed outputs and a practical next step. These are example deliverables, not client results.
Risk assessment and treatment support
Scope, evidence and responsibilities agreed before work starts.
Control and Statement of Applicability organisation
Scope, evidence and responsibilities agreed before work starts.
Clear boundaries from the start.
We confirm suitable technical expertise, sector requirements, independence and evidence access before accepting work. Consultancy supports your management arrangements; it does not grant certification, regulatory approval or a guaranteed result.
Not unless separately agreed with appropriate technical expertise. Management-system consultancy, a technical security test and an independent certification audit are different engagements.
The standard, organisational scope, locations, current arrangements, evidence availability and work packages. We clarify these before providing a written proposal.
Where appropriate, yes. Shared processes and review arrangements can be coordinated while keeping each standard’s requirements clear.
THE STANDARD / NOT A FOW CREDENTIAL
ISO/IEC 27001 — Information security
ISO/IEC 27001 concerns information security. The official publication reference below identifies the edition and scope; the engagement confirms what applies to your organisation.
Publication checked 25 September 2026. Applicable amendments and any certification transition arrangements must be confirmed for the engagement; no deadline is inferred here.
START A CONVERSATION
What does your management system need next?
Tell us what you are working towards, what already exists and where you need support. We will use that to clarify the scope—not sell you an off-the-shelf answer.
No sensitive records needed at first contact.