GRC · Specialist service
ISMS implementation based on ISO/IEC 27001
An effective ISMS connects business requirements with security responsibilities. We help establish processes that structure decisions, document actions and support continual improvement.
Service scope
ISO/IEC 27001 ISMS implementation
We design an information security management system tailored to your organisation’s size, structure and risks. We build on working processes and implement missing elements together with their owners. The project defines scope, risk assessment principles, controls and how their effectiveness will be measured. Documentation is developed alongside practical ways to apply it. Management receives the information needed for decisions, while teams receive clear tasks and criteria for demonstrating that obligations have been met.
Scope, objectives and roles
We define ISMS boundaries, key dependencies and security objectives. We establish responsibilities and management decision-making arrangements.
Risk and controls
We agree a risk assessment method and treatment plan. We support control selection and prepare the Statement of Applicability, including justifications and implementation status.
Processes and documentation
We prepare the required policies, procedures and registers, connecting them to existing workflows, ticket handling and change approval.
Launch and measurement
We support process owner training, evidence collection and performance measurement. We prepare the management review and a plan for further improvement.
Project deliverables
What will your team receive?
- ISMS scope, objectives and responsibility matrix.
- Risk assessment method, register and treatment plan.
- Statement of Applicability and agreed documentation.
- Schedule of measurements, reviews and improvement activities.
Delivery conditions
What do we agree before starting?
- Management involvement and designated process owners.
- Access to information about services, assets and requirements.
- Resources to implement agreed organisational and technical changes.
How we work
From understanding the need to verifying the result.
Design the system
We establish the starting point, scope and responsibilities, and agree an implementation plan with process owners.
Put it into practice
We develop documentation, launch processes and collect evidence of operation. We verify dependencies with technical security controls.
Review and improve
We review progress against objectives and prepare improvement actions. The internal audit plan accounts for separation between implementation and audit responsibilities.
Clear responsibilities
What is already included, and what do we extend?
ISMS implementation is a separate GRC project. The core Enterprise service provides reports, operational evidence and service reviews, but does not include building a management system for the whole organisation.
Reference points: ISO/IEC 27001. Requirements and their applicability are established for the individual organisation.
Before making a decision
Questions about ISO/IEC 27001 ISMS implementation
Does the project end with certification?
Implementation and certification are separate stages. We can support preparation for assessment, but an independent certification body issues the certificate based on its own audit.
Do existing procedures need to be replaced?
Not always. We first assess their usefulness and consistency. We retain effective practices, filling gaps in the scope and evidence required by the ISMS.
Who accepts the residual risk after implementation?
The designated risk owner, within their agreed authority. We help prepare the assessment and decision records; the service provider does not replace the client’s business decision.
Related expertise
Connect activities that complement each other.
The next step
Let us define a scope that makes sense for your organisation.
Let us discuss your environment, priorities and team responsibilities. We will use this to define the work, required access and service conditions.