--- title: "ISO Security | ISO 27001 Consultancy & Virtual CISO Services UK" description: "UK ISO 27001 consultancy led by Alan Hutson: achieve ISO/IEC 27001:2022 certification and stay audit-ready. Experience spans listed groups (Inmarsat), Lloyd's insurers (Chaucer) and smaller UK firms." canonical: https://www.isosecurity.co.uk/ updated: 2026-11-10 --- # Achieve ISO 27001 certification, and keep it working ISO Security helps UK organisations implement a practical Information Security Management System, prepare for independent ISO/IEC 27001:2022 certification and remain audit-ready through ongoing CISO support. - ISO/IEC 27001:2022 specialists, established 1995 - Certified ISO 27001 Lead Implementer, Lead Auditor and CISSP - Implementations from listed groups (Inmarsat) and Lloyd's insurers (Chaucer) to smaller firms UK-wide - Based in Ipswich, working across the UK ## Why do organisations start an ISO 27001 project? Most organisations begin an ISO 27001 project because a customer, tender, investor, regulator or board has asked for stronger evidence that information is being managed properly. The existing answer no longer stands up to scrutiny, so certification follows. That makes it a business decision with commercial consequences, involving leadership, operations, HR, suppliers and technology together. - **A major customer requires certification.** A key account or framework supplier has made ISO/IEC 27001:2022 a condition of continuing to work with you, and an informal answer is no longer accepted. - **A tender deadline is approaching.** A bid or procurement exercise asks for certification, or credible evidence that you are working towards it, within a defined timeframe. - **Your existing ISMS is falling behind.** Policies are out of date, the risk register has not been reviewed, actions are open and evidence is being assembled in the weeks before each audit. - **Nobody internally owns information security.** Responsibility is spread across IT, operations and management, so decisions stall and nothing is consistently maintained between audits. Whatever the trigger, the requirement is the same: structure, clear ownership and practical implementation. That is what ISO Security brings. ## What ISO 27001 services does ISO Security offer? ### [ISO 27001 Implementation](/iso-27001-implementation) Build an Information Security Management System that reflects how your organisation actually operates. I assess your current position, define the scope, manage risk, develop the necessary policies and processes, implement the required controls and prepare your team for independent certification. ### [Ongoing CISO Services](/virtual-ciso-services) Certification starts the ongoing work. I provide ongoing CISO-level oversight to maintain your ISMS, manage risks, keep policies and evidence current, support management reviews and prepare for surveillance and recertification audits. ## How does ISO 27001 implementation work? Six stages, each with a defined outcome. The exact approach and timeframe depend on your organisation's size, scope, complexity and current level of readiness. 1. **Discovery and scope.** I learn how your business operates, who depends on it and what information matters most, then define an ISMS scope that is honest, defensible and credible to your customers. 2. **Gap analysis.** I assess your current position against ISO/IEC 27001:2022 and produce a prioritised action plan, so you know what genuinely needs to change before an auditor sees it. 3. **Risk assessment and treatment.** We agree a risk methodology your team can repeat, identify information risks with the people who own them and record decisions in a risk treatment plan and Statement of Applicability. 4. **ISMS design and implementation.** I build a proportionate policy and process framework, assign roles and responsibilities, and support the implementation of the controls you have selected. 5. **Internal review and audit preparation.** I prepare and support internal audit and management review, close corrective actions and confirm that evidence exists, is current and can be found quickly. 6. **Independent certification support.** I help you engage an accredited certification body, prepare your team for Stage 1 and Stage 2, attend the audit where useful and manage any findings through to closure. ## How do you keep an ISMS running between audits? ISO/IEC 27001:2022 is built on continual operation and improvement: risks change, suppliers change, people join and leave, and systems are replaced. An auditor looks for evidence that the management system responded to those changes over time. Ongoing CISO support is the logical continuation after implementation, with the same senior adviser keeping the system running between audits: maintaining the ISMS programme, reviewing the risk register, updating policies and procedures, tracking actions and control effectiveness, supporting management reviews, coordinating internal audit activity, maintaining audit evidence, preparing for surveillance audits, supporting recertification, providing senior management reporting, helping answer customer security questionnaires, and advising on material business or technology changes. ## Why choose ISO Security for ISO 27001? Senior expertise without unnecessary complexity: - **Direct senior involvement.** You work directly with Alan Hutson: an experienced Lead Implementer, Lead Auditor and CISSP, from the first conversation to the last audit. - **Built around your business.** The ISMS is built to fit your organisation: scope, risk and controls reflect how you actually work. - **Implementation and continuity.** Support continues after the certification audit, with ISO Security maintaining momentum through the certification cycle. - **Business-focused advice.** Information security decisions are explained in terms of risk, customers, contracts, operations and reputation. ## Who will actually do the work? Alan Hutson is ISO Security's Director. His background spans IT services, project management and business management as well as information security, which shapes how he approaches an ISMS: as something that has to work inside a live organisation with deadlines, budgets and competing priorities. He is a certified ISO 27001 Lead Implementer and Lead Auditor, and a Certified Information Systems Security Professional (CISSP). The combination matters: building a management system and auditing one require different instincts, and knowing what an auditor will look for makes implementation more efficient. You deal with him directly, from the first conversation through to the certification audit and beyond. **Credentials:** Certified ISO 27001 Lead Implementer; Certified ISO 27001 Lead Auditor; CISSP (Certified Information Systems Security Professional, ISC2). Established 1995; specialist information security focus since 2015; organisations across the UK. ## ISO 27001 questions I am asked most ### What is involved in ISO 27001 implementation? Implementation means building a working Information Security Management System: understanding your organisational context and interested parties, agreeing a defensible scope, carrying out a gap analysis against ISO/IEC 27001:2022, identifying information assets, agreeing a risk methodology, completing a risk assessment and treatment plan, and producing a Statement of Applicability. It finishes with proportionate policies and procedures, assigned roles, controls implemented and evidenced, and an internal audit and management review before the independent certification audit. ### How long does ISO 27001 implementation take? It depends on the size of the organisation, the scope of the ISMS, the complexity of your systems and suppliers, how much is already documented and how quickly your team can make decisions and provide evidence. I give you a realistic view of the timeline after the initial discovery and gap analysis, because quoting a fixed period in advance helps nobody. ### Can ISO Security guarantee certification? Certification is the independent, accredited certification body's decision, following its own audit process, so I cannot guarantee it and you should be cautious of anyone who does. What I do is prepare your organisation and its ISMS thoroughly for that assessment: closing gaps, testing the system through internal audit, making sure evidence exists and is accessible, and supporting you through the Stage 1 and Stage 2 audits and any findings that arise. ### Do we need a full-time information security manager? Many organisations manage without one: ISO/IEC 27001:2022 requires clear ownership, competence and management commitment, and responsibilities can be shared internally with support from an experienced external adviser. Where a permanent CISO is hard to justify, ongoing CISO services provide senior oversight and continuity at a level of involvement that matches the size of the organisation. ### What happens after ISO 27001 certification? Certification is granted for a three-year cycle, with surveillance audits during that period and a recertification audit at the end of it. Between audits your ISMS is expected to keep operating (risks reviewed, policies kept current, actions tracked, incidents recorded, internal audits carried out, management reviews held), and organisations that maintain that steady rhythm find audits straightforward. ### What does a virtual CISO do? A virtual CISO provides senior information security leadership on a part-time or retained basis. At ISO Security the focus is governance, risk and compliance: owning the ISMS programme, reviewing the risk register, keeping policies and evidence current, tracking security objectives and corrective actions, coordinating internal audit, preparing management reviews, handling customer security questionnaires and reporting to senior management in business language. ### Can you support an existing ISMS? Yes: a significant part of my work is with organisations that are already certified or part-way through implementation, where the system has drifted or the person who owned it has moved on. I start by reviewing the current ISMS against ISO/IEC 27001:2022 and your own documented commitments, then agree priorities to bring it back to a maintainable state. ### Do you work remotely or on-site? Both: most ISMS work is delivered efficiently through remote workshops and reviews, which keeps costs down and makes shorter, more frequent sessions practical. On-site time is useful for kick-off, scoping walkthroughs, internal audit activity and key management meetings, and I work with organisations across the UK. ## Contact Arrange a readiness discussion with Alan Hutson: [contact ISO Security](/contact) or email info@isosecurity.co.uk.