ISO 27001 for Australian and NZ companies, done by someone who’s run it
For mid-sized Australian and New Zealand companies that need ISO/IEC 27001 because a customer, a tender or an insurer is asking. I take you from the first gap assessment to the certification audit, and I use the same work to tidy up your vendors and licences so the certificate pays its way.
Haden McAlpine · CISSP · ISO/IEC 27001 Lead Auditor · 25 years in IT, cyber and infrastructure
Why Australian and NZ companies end up here
It’s rarely a choice. An enterprise or government customer adds certification to the contract. A tender scores you down without it. A supplier questionnaire for an APRA-regulated client asks how you meet their CPS 234 obligations. Or the cyber insurance renewal gets harder every year. ISO 27001 answers all of those with one certificate, instead of a new spreadsheet for every customer.
What you don’t need is a binder of policies nobody reads. You need a certificate that survives the audit and a system your team can keep running after I’ve gone.
What I deliver
I do the work myself. Everything is built against ISO/IEC 27001:2022 and its 93 Annex A controls.
Scope and gap assessment
A scope that matches what your customers care about, and a gap list against every clause and control, ranked by effort and risk.
Risk register and Statement of Applicability
A repeatable risk method, a real risk register, and every Annex A control justified in or out with evidence behind it.
Policies and technical controls
Policies written for how you work, and the controls put in place: access, logging, backups, supplier management, change and incident handling. Where it helps, I map them to the ASD Essential Eight too.
Internal audit and certification support
The internal audit and management review the standard requires, help choosing a JAS-ANZ accredited certification body, and support through stage 1 and stage 2.
How it runs
Fixed-fee 3-week diagnostic
I review your infrastructure, access, suppliers and documentation, then give you a gap list, a dated plan and a fixed price for the rest.
Build the system
Policies, risk work and controls, done with your team so they understand what they’re running.
Run it, then audit it
Certification bodies want to see the system working, with records. We run it, audit it internally, fix what turns up, then book the audit.
A foundation for AI governance
If AI governance is next on the list, ISO 27001 is the right place to start. ISO/IEC 42001 uses the same management system structure, and the government’s AI6 guidance asks for the same disciplines: accountability, risk management, testing and monitoring. Build it once and extend it. See AI governance for Australian and NZ businesses.
Common questions
How long does ISO 27001 certification take?
It depends mostly on what you already have in place. The fixed-fee diagnostic gives you a dated plan before you commit, so you know whether you’ll meet the deadline a customer has given you.
Who issues the certificate?
An accredited certification body does, not me. In Australia and New Zealand that means a body accredited by JAS-ANZ or an equivalent accreditation body. I help you choose one and prepare for both audit stages.
How does ISO 27001 relate to the Essential Eight?
They do different jobs. ISO 27001 is a management system for running security across the business. The Essential Eight is a set of technical mitigation strategies from the Australian Signals Directorate. Many Australian customers ask about both, and the Essential Eight controls fit inside an ISO 27001 system.
Can you help with supplier questionnaires from banks and insurers?
Yes. APRA-regulated entities must manage the information security of their service providers under CPS 234, so their questionnaires are detailed. An ISO 27001 system gives you consistent, evidenced answers.