ISO 27001
Gap analysis, risk assessment and Statement of Applicability, ISMS implementation, independent internal audits, certification readiness and ongoing management - for organisations working towards ISO/IEC 27001 and for those already certified.
Our auditors hold ISO/IEC 27001 Lead Auditor certification. We look first where certification bodies look first: the management system, not the technology.
What the standard asks
ISO 27001 certifies a management system. These are what an auditor samples - and expects to find operating, not only documented.
A scope that matches your actual organisation, services, locations and infrastructure - not a copied template.
A repeatable method to identify, assess and treat information security risks, with a register that reflects real decisions.
Which Annex A controls apply, which do not and why - the document that ties risk treatment to the controls you run.
Access, suppliers, change, incidents, continuity, secure development and the rest of your applicable set, working in practice.
Audits at planned intervals, conducted objectively, with findings that lead to corrective action.
Top management reviewing the ISMS with recorded decisions - the first thing a certification body checks for.
Last verified 16 October 2026 against ISO - ISO/IEC 27001.
Who it is for
Boundaries that leave out the systems, teams or suppliers that actually handle the information.
The register, the risk treatment plan and the Statement of Applicability tell three different stories.
Policies exist; access reviews, restore tests and supplier reviews do not.
The two assurance loops a certification body expects to see completed before Stage 2.
Why an external specialist
How it works
Buy one step or the whole path. Each has its own scope and price.
Clauses 4-10 and Annex A against how you operate today, with a gap register ranked by what blocks Stage 1.
A risk method your team can repeat, a register that reflects real decisions, and a Statement of Applicability with defensible justifications.
Policies, procedures, control framework and evidence schedule, built with your control owners so the system runs on your people.
An independent audit of the ISMS, by an auditor who did not build the part being audited.
A pre-audit review of the system, the records and the people the certification body will interview.
Corrective actions after findings, surveillance preparation, and Managed ISMS or vCISO support between audits.
Stage 1
Almost always the management system, not the technology.
| Finding | Why it matters |
|---|---|
| No usable Statement of Applicability | You are not ready for Stage 1. The SoA is a core part of the management system the auditor needs to examine. |
| Internal audit never performed | Your ISMS has not completed a required assurance loop. Expect this to become an audit issue. |
| No management review record | Leadership oversight is not evidenced. That is a management-system gap, not a paperwork detail. |
| Risk register does not map to the SoA | The control story breaks immediately: risks, treatment and selected controls no longer line up. |
| Access reviews that never happened | A policy cannot replace evidence that access was actually reviewed. |
| Backups exist, recovery never tested | “We have backups” is not proof that the business can recover. |
What you receive
What we need from you
Scope and pricing
Every engagement, including the Mini Gap Review, is individually quoted after scoping, with a fixed price in the written proposal. Certification body fees are separate and paid to the certification body.
Delivery
Boundaries
We can implement your ISMS and audit it - but never with the same person. Where we built or operate part of the system, its internal audit is assigned to a competent auditor who had no involvement, or that part is excluded and recorded as such. We are not a certification body and do not issue certificates.
Last verified 16 October 2026 against ISO - ISO/IEC 27001.
Related services
What it costs
Each step is priced on its own. The Mini Gap Review fee is credited in full toward a readiness assessment commissioned within 30 days.
Scoped on a call
The low-risk entry point: your top Stage 1 blockers, fast. The easiest way to find out whether a full assessment is even needed.
The Mini Gap Review fee is credited in full toward a readiness assessment commissioned within 30 days.
Scoped on a call
The full picture before Stage 1: clauses 4-10 and Annex A, with a scored readiness result and a gap register ranked by audit impact.
What changes the price: Employee count · ISMS scope · Number of entities · Audit date · Current evidence quality
Scope, number of entities and sites, regulatory context and evidence maturity set the fee; the fixed price is in the proposal.
Scoped on a call
Hands-on closure of the gaps between the assessment and the audit - scoped from real findings, never open-ended.
What changes the price: Number of open gaps · Policies and processes to fix · Quality of the existing SoA and risk register · Number of teams and control owners · Time to the audit
Scoped from the Readiness Assessment findings. We do not offer unlimited remediation on a flat fee.
Scoped on a call
The whole journey to your certification audit as one scoped engagement, with one fixed price agreed after scoping: readiness assessment, remediation and audit support - instead of buying three separate engagements.
What changes the price: Employee count and number of entities · How much needs building versus fixing · Time to the audit · Current evidence quality
One price for the whole path to the audit. The certification body's Stage 1 and Stage 2 fee is separate and quoted by them. Best for teams that want an outcome, not a stack of line items.
Scoped on a call
Your clause 9.2 internal audit, run by an auditor with no stake in the system being audited - with the report your management review actually needs.
What changes the price: Number of controls in your Statement of Applicability · Number of legal entities and sites in scope · How many control owners have to be interviewed · Whether the last audit left open nonconformities to verify
Auditors remain independent of the activities they audit. Where Kellwick supported implementation or ongoing management, the audit follows an independence and conflict-of-interest review and is assigned to an auditor who took no part in that work; where objectivity cannot be assured, we decline that scope or recommend external assurance.
Scoped on a call
For already-certified teams: confirm you will pass surveillance before the auditor arrives - find the drift first.
What changes the price: Scope · Time since certification
Scoped on a call
A control-by-control evidence map and audit-ready index - the artifact most audits actually turn on.
What changes the price: Scope size · Current evidence quality
Every engagement is fixed-scope and fixed-price before it starts. Prices exclude taxes, certification-body fees, travel and third-party services, and are set on a short scoping call. All pricing.
Questions
ISO/IEC 27001:2022, including Amendment 1:2024 on climate change. The transition from the 2013 edition ended on 31 October 2025, so all accredited certification is now against the 2022 edition.
A gap analysis takes one to two weeks. Reaching certification readiness usually takes several months, because controls must operate - and produce evidence - for long enough for an auditor to sample them. The management system, not headcount, usually sets the pace.
A platform collects evidence and automates checks. It cannot decide whether your scope, risk register and control ownership make sense, or whether an auditor would accept what it gathered. Missing internal audits, management reviews and an SoA that does not reconcile with the risk register sit outside what a tool can judge.
Yes, with different people. The internal audit is assigned to an auditor with no involvement in the work being audited, named in the audit plan. If that cannot be arranged for a scope, we say so.
No. Certification decisions are made only by accredited certification bodies through their Stage 1 and Stage 2 audits. We prepare you for that process and tell you plainly where you stand.
Usually with the Mini Gap Review: a fixed-scope snapshot of your top blockers and the next step that matters. If an audit date is already close, a full gap analysis or internal audit is the better entry point.
Not started, in progress, certified or drifting - and your next audit date. We reply within one business day with what we would do first.
Kellwick is an independent consulting and internal audit practice. We are not a certification body and do not issue ISO certificates. Certification decisions are made only by accredited certification bodies.