ISO/IEC 27001 · Information Security
ISO/IEC 27001 Compliance Services
Design, Implement & Certify Your ISMS
ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS) — providing a systematic, risk-based framework for managing information security across people, processes, and technology. SIRI Law LLP guides organisations from initial gap assessment through certification, with ongoing support for continual improvement and surveillance audits.
What It Is & Why It Matters
ISO/IEC 27001 Compliance Services: The Essentials
ISO/IEC 27001:2022 defines requirements for establishing, implementing, maintaining, and continually improving an ISMS. Certification requires an accredited third-party audit — validating that your information security controls are appropriately designed and operated. It is the world’s most widely recognised information security standard, with over 70,000 organisations certified globally.
The 2022 version introduced significant updates — including 11 new controls covering areas like threat intelligence, cloud security, data masking, and secure coding — and a restructured Annex A with 93 controls across 4 themes (Organisational, People, Physical, Technological).
SIRI Law LLP provides end-to-end ISO 27001 implementation support — from initial gap assessment and risk methodology through documentation, internal audit, management review, and certification audit support. Our legal team ensures the ISMS integrates seamlessly with DPDPA/GDPR obligations and sector-specific regulatory requirements.
Certification demonstrates a mature, systematic approach to information security — providing competitive differentiation, satisfying enterprise procurement requirements, and demonstrating regulatory accountability.
ISO 27001 certification is increasingly required by: enterprise customers before onboarding suppliers; regulated sectors (BFSI, healthcare, government) as a baseline security requirement; government and defence contracts; and cyber insurance underwriters for favourable terms.
Beyond certification, the ISMS provides lasting operational value — a documented risk register, clear security policies, defined incident response procedures, and a continual improvement cycle that keeps your security posture current as threats evolve.
Scope of Services
What Our Engagement Covers
- ISO 27001:2022 gap assessment against all Annex A controls
- ISMS scope definition and context of the organisation
- Risk assessment methodology design (ISO 27005 aligned)
- Asset inventory and information classification
- Risk register development and risk treatment planning
- Statement of Applicability (SoA) — all 93 controls addressed
- Security policy framework — 20+ policy documents
- Control implementation advisory — all 4 Annex A themes
- Supplier and third-party security management programme
- Business continuity and disaster recovery planning
- Internal audit programme design and execution
- Management review preparation and facilitation
- Stage 1 and Stage 2 certification audit support
- Non-conformity response and corrective action management
- Post-certification surveillance audit support
- DPDPA/GDPR integration within the ISMS framework
Our Engagement Process
How We Work — Step by Step
Initial Scoping & Assessment
We conduct a gap assessment against the applicable framework, define the engagement scope, and produce a prioritised remediation roadmap with timeline and effort estimates.
Programme Design
We design the compliance programme — control framework, documentation structure, evidence requirements, and governance processes — tailored to your organisation.
Implementation Advisory
We advise on implementing each required control — working alongside your technical and operational teams to build controls that are practical and auditable.
Internal Audit & Validation
We conduct an internal audit or readiness assessment — identifying any remaining gaps before the formal certification or attestation process begins.
Certification / Attestation Support
We support the formal audit or assessment — managing auditor queries, providing evidence, and resolving findings on the day.
Post-Certification Advisory
After certification, we provide ongoing support — surveillance audit preparation, change management, and regulatory update advisory.
Typical engagement timeline varies by organisation size and existing control maturity.
Certified Engineers
Our Team Holds
CCSPCISMCIPPECEHOSCPCISSPCPENTISO 27001 LAIntegration Advantage
Our compliance engagements are backed by qualified legal counsel — ensuring your programme satisfies both technical certification requirements and legal obligations under DPDPA, IT Act, and sector-specific regulation.
Benefits & Deliverables
What You Get from This Engagement
Gap Assessment
We conduct a comprehensive gap assessment against ISO 27001:2022 Annex A — producing a prioritised remediation roadmap with effort estimates and a realistic certification timeline.
Risk Methodology Design
We design your risk assessment methodology — aligned with ISO 27005 and your organisational context — ensuring it is practical, auditable, and proportionate to your risk appetite.
Documentation Development
We develop the full ISMS documentation set — policies, procedures, records, and the Statement of Applicability — tailored to your organisation, not generic templates.
Control Implementation
We advise on implementing each required control — providing practical, technically sound guidance that satisfies the auditor without creating unnecessary operational burden.
Internal Audit
We conduct a rigorous pre-certification internal audit — identifying any remaining gaps and preparing your team for the Stage 2 certification audit.
Certification Audit Support
We are present during the certification audit — managing auditor queries, providing evidence, and resolving non-conformities on the day.
Post-Certification
After certification, we support ongoing compliance — surveillance audit preparation, continual improvement advisory, and change management as your environment evolves.
Gap Assessment Report
Detailed gap analysis against all 93 Annex A controls — with RAG status, remediation recommendations, effort estimates, and certification timeline.
ISMS Documentation Set
Complete documentation library — ISMS scope, information security policy, risk assessment methodology, risk register, SoA, and all required procedures and records.
Internal Audit Report
Pre-certification internal audit findings with non-conformity management and evidence of corrective action.
Certification Readiness Declaration
Formal confirmation that your ISMS is ready for Stage 2 certification audit — with outstanding items and risk acceptance documented.
Post-Certification Advisory Retainer
Ongoing advisory for surveillance audits, change management, and continual improvement — keeping your certification current.
Frequently Asked Questions
How long does ISO 27001 certification take?
From gap assessment to certification, most organisations take 9–18 months. Smaller organisations with a limited ISMS scope and good existing controls can achieve certification in 6–9 months. Larger, complex organisations may take 18–24 months. We provide a realistic timeline after the gap assessment, based on your specific context.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 is an international standard with mandatory certification by an accredited body — applicable to any organisation globally. SOC 2 is a U.S.-origin attestation framework specifically for service organisations (SaaS, cloud) — attested by a CPA firm against Trust Services Criteria. ISO 27001 is more globally recognised; SOC 2 is the de facto standard for U.S. enterprise SaaS procurement. Many organisations pursue both.
Do we need to certify the entire organisation?
No — ISO 27001 allows you to define a scope that covers specific services, systems, or locations. A focused scope can accelerate certification and reduce cost while still satisfying the requirements of most enterprise customers. We advise on scope definition as part of the gap assessment — balancing commercial value with implementation effort.
What does the annual surveillance audit involve?
After initial certification (which is valid for 3 years), accredited certification bodies conduct annual surveillance audits to verify your ISMS remains compliant and operational. Surveillance audits are less intensive than the initial certification audit — typically focusing on a subset of controls, ISMS objectives, and any identified non-conformities. We support all surveillance audits and the 3-year recertification.
Ready to Start Your ISO/IEC Journey?
All engagements begin with a complimentary scoping call. Let us understand your environment and propose the right approach.
Also see: Cybersecurity GRC · Cybersecurity Services