Throughline.
    ← All services
    02 / 07

    ISO 27001

    International certification without the international amount of paperwork.

    Sydney headquartered CPA firm serving Australian and US companies

    Short of it

    Information security management system certification.

    What it is

    ISO 27001 certifies your Information Security Management System (ISMS): a living set of policies, risk decisions, controls and review cadences, governed by the 93 Annex A controls in ISO 27002. Certification is issued by a certification body after a two-stage audit, and is maintained through annual surveillance audits with a full recertification every three years.

    When you need it

    When you're selling into Europe, into regulated industries, or into customers who explicitly ask for it. Often alongside SOC 2 rather than instead of it: SOC 2 answers the North American market, ISO 27001 answers most of the rest of the world.

    Our approach

    Right-sized ISO 27001

    One-size-fits-all ISMSes collapse under their own weight. We assess yours against your actual risk register, your actual asset inventory, and the cadence your team can sustain, then give you direct feedback on where it stands.

    FAQ

    Questions we're often asked.

    Why are we being asked for ISO 27001?
    When you collect, process, store or have potential access to sensitive data, your customers need to know you run a formal, well-governed information security management system. This is particularly important in Europe and regulated industries. ISO 27001 evidences that the controls protecting their data are chosen against real risk, operated consistently, and improved over time.
    How is ISO 27001 different from SOC 2?
    SOC 2 is an attestation report on how a set of controls operates against defined criteria. ISO 27001 is a certification of your management system: the way you decide which controls apply, how you run them, and how you improve them over time. Most scaling companies eventually hold both.
    Do we need all 93 Annex A controls?
    No. Annex A is a reference set. Your Statement of Applicability documents which controls apply to you, based on your risk assessment, and justifies any exclusions. Adopting every control 'to be safe' usually produces an ISMS you can't maintain.
    How long does certification take?
    From a standing start, typically 4 to 9 months to reach the Stage 1 audit, depending on the maturity of your ISMS. Stage 2 usually follows a few weeks later. After certification, surveillance audits are annual and recertification is every three years.
    Who issues the certificate?
    We do. As your certification body, we conduct the Stage 1 and Stage 2 audits and issue the certificate on a successful outcome. If your customers require an accredited certificate specifically, we can discuss that up front so you choose the right path.
    Typical process

    How an engagement actually runs.

    1. 01. Context & scope
      What's in, what's out, and why.
    2. 02. Risk review
      We assess your risk register and treatment plans against your real environment.
    3. 03. ISMS readiness
      Policies, procedures, Statement of Applicability reviewed for fit.
    4. 04. Internal audit
      We dry-run the audit before the formal stages begin.
    5. 05. Stage 1 & 2 audit
      We conduct the audits, share findings, and move to the certification decision and outcome.

    Ready when you are

    Let's discuss your ISO 27001 needs.

    A named senior practitioner will lead the conversation and stay accountable from scoping through report issuance.

    Start the conversation
    Next service
    ISO 42001