- Home
- Services
- GRC & training
- ISO 27001
ISO 27001 implementation
ISO 27001, from gap assessment to your certification audit.
We build an information security management system (ISMS) that fits how your organisation actually works, prepare your team and evidence, and support you through the audit with an accredited certification body.
What we do
Everything between deciding on ISO 27001 and holding the certificate.
No generic template packs. Open any stage to see what it covers and what you receive.
01 Gap assessmentWhere you stand today, and the route to certification.
We assess your current practices against every clause of ISO/IEC 27001:2022 and the Annex A controls, then turn the gaps into a prioritised, realistic roadmap.
- Review of clauses 4 to 10
- Assessment against the 93 Annex A controls
- Prioritised gap list
- Roadmap with milestones and owners
You receive: a gap assessment report and certification roadmap.
02 Scope & contextDecide what the ISMS covers, and why.
A well-chosen scope keeps the effort proportionate and the certificate meaningful. We define it with you, along with the internal and external issues and interested parties the standard requires.
- ISMS scope and boundaries
- Internal and external issues
- Interested parties and their requirements
- Regulatory and contractual obligations
You receive: a documented scope and context statement.
03 Risk assessment & treatmentThe core of the standard, done practically.
We set up a risk methodology your team can keep using, identify and assess information security risks, and decide how each will be treated.
- Risk methodology aligned to ISO/IEC 27005
- Risk assessment and owners
- Risk treatment plan
- Statement of Applicability
You receive: a risk register, treatment plan and Statement of Applicability.
04 Policies & proceduresDocumentation people can actually follow.
We write the policies and procedures the standard requires around how your organisation already works, kept proportionate and clear rather than copied from templates.
- Information security policy
- Topic-specific policies
- Supporting procedures
- Document control
You receive: a complete ISMS documentation set, ready for audit.
05 Control implementationHands-on help, not just paperwork.
Because we also build security controls, we can help put the technical controls in place, from access management and logging to hardening and backups.
- Access control and MFA
- Logging and monitoring
- System and cloud hardening
- Backup and recovery
You receive: implemented controls with the evidence to show they operate.
06 Training, audit & certificationPrepare your people, check the system, pass the audit.
We train staff, carry out the internal audit and management review, then arrange your audit with an accredited certification body and support you through Stage 1, Stage 2 and any findings.
- Staff awareness training
- Internal audit
- Certification body arrangement
- Support through Stage 1 and Stage 2
You receive: an audit-ready ISMS and support until your certificate is issued.
What you receive
An ISMS your team owns and can keep running.
Knowledge transfer is built in throughout, so your people understand the system rather than depending on us for every audit.
Who issues the certificate? Your certificate is issued by an accredited certification body after its independent audit. Revafort prepares you, arranges the audit with the certification body and supports you throughout, but we do not issue certificates ourselves.
Gap assessment report & roadmap
Findings against each clause and Annex A control, with priorities and a plan to close the gaps.
Risk register & Statement of Applicability
Your risks, chosen treatments and the reasoning behind every included or excluded control.
ISMS documentation
Policies, procedures and records tailored to your organisation and ready for audit.
Internal audit report
An audit of the ISMS before the certification body arrives, with corrective actions tracked to closure.
- WORK ALIGNED TO
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- ISO/IEC 27005
- ISO 22301
- NDPA 2023
- CBN Risk-Based Cybersecurity Framework
- PCI DSS v4.0.1
Questions
ISO 27001 FAQs
What is ISO 27001?
ISO/IEC 27001 is the international standard for information security management systems. It sets out how to identify information security risks, choose controls to manage them and keep improving over time. Certification shows customers, partners and regulators that an independent auditor has checked your ISMS against the standard.
How long does ISO 27001 certification take?
It depends on the size and complexity of your organisation, the scope you choose and how mature your existing security practices are. After the gap assessment, you receive a roadmap with a realistic target date for your certification audit.
What happens during the certification audit?
The audit runs in two stages. Stage 1 reviews your ISMS documentation and readiness. Stage 2 checks that your controls are implemented and operating effectively. If the auditor raises nonconformities, you address them before the certificate is issued.
How long is an ISO 27001 certificate valid?
Three years, with surveillance audits by the certification body during that period, typically once a year. A recertification audit is carried out before the certificate expires.
Do we need to buy special software?
Not necessarily. Many organisations run their ISMS with tools they already use for documents, tickets and spreadsheets. We will recommend what fits your size and budget.
Does ISO 27001 help with NDPA, PCI DSS or CBN requirements?
There is significant overlap. An ISMS gives you the risk management, policies and controls that support data protection and regulatory requirements, and we can map your controls to them. Each framework still has its own specific requirements, which we will identify for you.
Do you also help with ISO 22301 business continuity?
Yes. We implement ISO 22301 business continuity management systems through to certification, and the two standards can be run together with shared processes for risk, documentation and internal audit.
Start your ISO 27001 journey.
Tell us about your organisation and goals, and we'll set up a scoping call. We respond within 1 business day.