ISO 27001 implementation, run end to end by one person who’s done it
For mid-sized UK and European companies that need ISO/IEC 27001 certification because a customer, a tender or an insurer is asking for it. I take you from the first gap assessment to the stage 2 audit, and I rebuild your vendor and licensing footprint along the way so the certification pays for itself instead of just costing you.
Haden McAlpine · CISSP · ISO/IEC 27001 Lead Auditor · 25 years in IT, cyber and infrastructure
Why most companies end up doing ISO 27001
Very few businesses wake up wanting an information security management system. They get pushed into it. An enterprise customer adds a certification requirement at renewal. A tender scores you zero without one. Your insurer starts asking harder questions. Or the security questionnaires have become so frequent that answering “we’re certified” is cheaper than answering 300 questions every month.
All of those are good reasons, and they all have a deadline attached. What they don’t need is a twelve-month consulting programme that produces a binder of policies nobody reads. They need a certificate that survives the audit and a system your team can actually keep running once I’ve gone.
What I deliver
I do the work myself, rather than selling you a template pack or handing you to a junior. Everything is built against ISO/IEC 27001:2022 and its 93 Annex A controls.
Scope and gap assessment
A clear ISMS scope that matches what your customers actually care about, and a gap list against every clause and control, ranked by effort and risk.
Risk register and treatment plan
A risk assessment method you can repeat each year, a real risk register, and a treatment plan that leadership signs off.
Statement of Applicability
Every Annex A control marked in or out with a justification an auditor will accept, linked to the evidence behind it.
Policies and controls
Policies written for how your business works, and the technical controls put in place: access, logging, backups, supplier management, change and incident handling.
Internal audit and management review
The internal audit and management review the standard requires, run properly so the certification body sees a system that’s already working.
Certification audit support
Help choosing an accredited certification body, then preparation and representation through the stage 1 and stage 2 audits.
How it runs
Fixed-fee 3-week diagnostic
I go through your infrastructure, access, suppliers and existing documentation, then give you a gap list, a dated plan and a fixed price for the rest.
Build the ISMS
Policies, risk work and controls, done alongside your team so they understand what they’re running. Vendor and licence clean-up happens here too.
Run it, then audit it
Certification bodies want to see the system operating, with records, before stage 2. We run it, audit it internally, fix what turns up, then book the audit.
How long it takes depends almost entirely on how much you already have in place. The diagnostic replaces a guess with a dated plan, so you know before committing whether you’ll make the deadline a customer has given you.
Making the certificate pay for itself
ISO 27001 forces you to list every supplier, system and licence you depend on and decide whether each one is managed. That’s exactly the information you need to cut IT spend, and most companies only use it for the auditor. I use it for both at the same time, because the certification work and the vendor clean-up end up touching the same contracts anyway.
I led a full ISO/IEC 27001 programme end to end, from the first gap assessment through the stage 2 audit, including GDPR-aligned data protection controls. Rather than stacking compliance spend on top of what was already there, I rebuilt the software licensing and vendor footprint in parallel with the audit.
> Licensing and vendor footprint rebuilt in parallel with the audit, so the certification paid for itself
ISO 27001 as a foundation for NIS2 and the AI Act
If you’re also facing NIS2 or GDPR obligations, an ISO 27001 management system covers a large share of the risk-management measures those rules expect, and gives you the evidence to show it. It doesn’t cover everything: NIS2’s incident reporting deadlines and management accountability need their own work. I scope both together so you aren’t paying twice for the same controls. The same goes for AI governance, which slots into an existing ISMS far more easily than it stands up on its own.
Common questions
How long does ISO 27001 certification take?
It depends on your starting point. A company with decent IT hygiene and some existing policies moves much faster than one starting from nothing. Certification bodies also expect the system to have been running, with records, before the stage 2 audit. The 3-week diagnostic gives you a dated plan for your situation rather than a generic estimate.
What does it cost?
Every engagement is fixed fee. The diagnostic has its own fixed price, and at the end of it you get a fixed quote for the implementation, so there’s no surprise invoice. The certification body’s audit fees are separate and paid to them directly.
Can you certify us?
No, and nobody who implements your ISMS should. Certification is issued by an independent, accredited certification body. As an ISO/IEC 27001 Lead Auditor I know exactly what they’ll look for, and I prepare you for it and represent you during the audit.
We were certified to ISO 27001:2013. Is that still valid?
No. The transition period to ISO/IEC 27001:2022 ended on 31 October 2025, so 2013 certificates are no longer valid. If you let a 2013 certificate lapse, I can take you through the gap to 2022 and back to certification.
Do you work with companies in the UK and Europe from Sydney?
Yes, that’s the practice. Most of the work runs remotely in UK and Central European business hours, with on-site days booked as a block when being in the room matters, such as workshops and the audit itself.