A major customer requires certification
A key account or framework supplier has made ISO/IEC 27001:2022 a condition of continuing to work with you, and an informal answer is no longer accepted.
Achieve ISO 27001 certification, and keep it working
ISO Security helps UK organisations implement a practical Information Security Management System, prepare for independent ISO/IEC 27001:2022 certification and remain audit-ready through ongoing CISO support.
- Established 1995
- Certified Lead Implementer
- Certified Lead Auditor
- CISSP
- From listed groups (Inmarsat) and Lloyd's insurers (Chaucer) to smaller firms UK-wide
- UK-wide support
Why do organisations start an ISO 27001 project?
Most organisations begin an ISO 27001 project because a customer, tender, investor, regulator or board has asked for stronger evidence that information is being managed properly. The existing answer no longer stands up to scrutiny, so certification follows.
That makes it a business decision with commercial consequences, involving leadership, operations, HR, suppliers and technology together.
A tender deadline is approaching
A bid or procurement exercise asks for certification, or credible evidence that you are working towards it, within a defined timeframe.
Your existing ISMS is falling behind
Policies are out of date, the risk register has not been reviewed, actions are open and evidence is being assembled in the weeks before each audit.
Nobody internally owns information security
Responsibility is spread across IT, operations and management, so decisions stall and nothing is consistently maintained between audits.
Whatever the trigger, the requirement is the same: structure, clear ownership and practical implementation. That is what ISO Security brings.
What ISO 27001 services does ISO Security offer?
ISO 27001 Implementation
Build an Information Security Management System that reflects how your organisation actually operates. I assess your current position, define the scope, manage risk, develop the necessary policies and processes, implement the required controls and prepare your team for independent certification.
Ongoing CISO Services
Certification starts the ongoing work. I provide ongoing CISO-level oversight to maintain your ISMS, manage risks, keep policies and evidence current, support management reviews and prepare for surveillance and recertification audits.
How does ISO 27001 implementation work?
Six stages, each with a defined outcome. The exact approach and timeframe depend on your organisation's size, scope, complexity and current level of readiness.
- 01
Discovery and scope
I learn how your business operates, who depends on it and what information matters most, then define an ISMS scope that is honest, defensible and credible to your customers.
- 02
Gap analysis
I assess your current position against ISO/IEC 27001:2022 and produce a prioritised action plan, so you know what genuinely needs to change before an auditor sees it.
- 03
Risk assessment and treatment
We agree a risk methodology your team can repeat, identify information risks with the people who own them and record decisions in a risk treatment plan and Statement of Applicability.
- 04
ISMS design and implementation
I build a proportionate policy and process framework, assign roles and responsibilities, and support the implementation of the controls you have selected.
- 05
Internal review and audit preparation
I prepare and support internal audit and management review, close corrective actions and confirm that evidence exists, is current and can be found quickly.
- 06
Independent certification support
I help you engage an accredited certification body, prepare your team for Stage 1 and Stage 2, attend the audit where useful and manage any findings through to closure.
How do you keep an ISMS running between audits?
ISO/IEC 27001:2022 is built on continual operation and improvement: risks change, suppliers change, people join and leave, and systems are replaced. An auditor looks for evidence that the management system responded to those changes over time.
Ongoing CISO support is the logical continuation after implementation, with the same senior adviser keeping the system running between audits.
- Maintaining the ISMS programme
- Reviewing the risk register
- Updating policies and procedures
- Tracking actions and control effectiveness
- Supporting management reviews
- Coordinating internal audit activity
- Maintaining audit evidence
- Preparing for surveillance audits
- Supporting recertification
- Providing senior management reporting
- Helping answer customer security questionnaires
- Advising on material business or technology changes
Why choose ISO Security for ISO 27001?
Direct senior involvement
You work directly with Alan Hutson: an experienced Lead Implementer, Lead Auditor and CISSP, from the first conversation to the last audit.
Built around your business
The ISMS is built to fit your organisation: scope, risk and controls reflect how you actually work.
Implementation and continuity
Support continues after the certification audit, with ISO Security maintaining momentum through the certification cycle.
Business-focused advice
Information security decisions are explained in terms of risk, customers, contracts, operations and reputation.
Who will actually do the work?
Alan Hutson is ISO Security’s Company Director and Principal Consultant. His background spans IT services, project management and business management as well as information security, which shapes how he approaches an ISMS: as something that has to work inside a live organisation with deadlines, budgets and competing priorities.
He is a certified ISO 27001 Lead Implementer and Lead Auditor, and a Certified Information Systems Security Professional (CISSP). The combination matters: building a management system and auditing one require different instincts, and knowing what an auditor will look for makes implementation more efficient.
You deal with him directly, from the first conversation through to the certification audit and beyond.
Alan Hutson's credentials
- Certified ISO 27001 Lead Implementer
- Certified ISO 27001 Lead Auditor
- Certified Information Systems Security Professional (CISSP)
- Established
- 1995
- Specialist information security focus
- Since 2015
- Coverage
- Organisations across the UK
ISO 27001 questions I am asked most
Straight answers on scope, timescales, ownership and what happens after certification.
Need to achieve or maintain ISO 27001?
Tell us where you are today, what is driving the requirement and when you need to be ready. Your readiness discussion will give you a clear view of the work and investment required.
Or email info@isosecurity.co.uk