ISO 27001

ISO 27001 readiness, remediation and evidence

Enterprise customers and certification bodies increasingly demand ISO 27001. Kellwick finds what will block Stage 1 before the certification body does.

The blockers are almost never your technology. They are in the management system - the scope, the risk process, the Statement of Applicability, the internal audit and the evidence that controls actually operate.

Book a readiness call Start with a Gap Review

CQI/IRCA ISO/IEC 27001:2022 Lead Auditor trained · IRCA Associate Auditor - ISMS · CQI Practitioner Member - PCQI

Why now

ISO 27001 has quietly become a condition of the deal.

Enterprise buyers and their procurement teams increasingly make ISO 27001 a requirement, not a nice-to-have. Security questionnaires ask for the certificate by name, deals stall in vendor review without it, and certification bodies expect a real management system when you finally book the audit.

The risk is not that your infrastructure is insecure. Most teams that fail Stage 1 fail on the management system - a scope that does not hold together, a risk process that never ran, a Statement of Applicability that contradicts the risk register, an internal audit and management review that were never done. That is the ground a certification body checks first, and it is exactly where we look.

What ISO 27001 requires

What the standard actually asks of you, in plain language.

You do not need to memorise the clauses. In practice a certification body wants to see these seven things working together - and evidence that they are more than documents.

A scoped ISMS

A defined information security management system with a scope that matches your actual product, teams and infrastructure - not a copied template.

A working risk process

A repeatable way to identify, assess and treat information security risks, with a risk register that reflects real decisions rather than a one-off exercise.

Statement of Applicability

A justified statement of which controls apply, which do not and why - the document that ties your risk decisions to the controls you actually run.

Annex A controls

The relevant controls implemented and operating in practice: access, suppliers, change, incidents, secure development and the rest of your applicable set.

Internal audit

An internal audit programme that genuinely tests the management system, with findings and corrective actions - not a checkbox completed the week before Stage 1.

Management review

Leadership reviewing the ISMS on a cadence, with recorded decisions - the evidence a certification body checks first to see the system is actually governed.

Evidence that controls operate

Proof that the controls run continuously - access reviews, tested restores, incident records - not just policies that describe how they are supposed to work.

What actually blocks Stage 1

The gaps a certification body finds first.

None of these are about your engineering. Each one can stop a Stage 1 audit on its own - better if we find them before the auditor does.

The blocker	What it means for Stage 1
No Statement of Applicability	Stage 1 stops here. Every time.
Internal audit never performed	You cannot proceed to Stage 2.
No management review record	Same. No exceptions.
Risk register that does not map to the SoA	The auditor sees the disconnect in ten minutes.
Access reviews that never happened	An evidence hole nothing can patch on audit day.
Backup exists, restore never tested	“We have backups” is not evidence of recovery.

The engagements

Where you enter depends on how close you are.

Start with a snapshot, find the blockers, close them and organise the proof. Each engagement stands alone or sequences into the next.

1-2 days

Mini Gap Review

Your certification body will find these gaps. Better if we find them first.

Start with a Gap Review

5-10 days

ISO 27001 Readiness Assessment

We tell you what will block ISO 27001 certification before the certification body does.

Explore this engagement

5-15 days

ISO 27001 Remediation Sprint

Readiness finds the blockers. The Remediation Sprint helps remove them.

Explore this engagement

3-7 days

ISO 27001 Evidence Pack

We organise your ISO 27001 evidence so your team can show the right proof, in the right order.

Explore this engagement

Book a readiness call

Fit

Who this is for - and who it is not.

This is for you if

You are pursuing ISO 27001 certification or a surveillance visit in the next 30 to 120 days
Enterprise customers or certification bodies are asking you to prove ISO 27001
You have an ISMS in progress but are not sure it would survive a real auditor
You use Vanta, Drata or Sprinto but are unsure your scope, risks and evidence hold up

Not the right fit if

You are looking for a certification body to issue the certificate
You only want a policy template pack rather than an honest gap picture
You expect a guaranteed pass instead of an evidence-based readiness view

Regulated in the EU as well? See DORA readiness for what your licence adds on top of the certificate, or GDPR & privacy to extend the same ISMS into a defensible privacy programme.

ISO 27001 questions, answered

The questions teams ask us first.

How long does ISO 27001 readiness take?: It depends on the maturity of your management system. A focused readiness assessment typically runs over one to two weeks, and closing the gaps it finds is a further short project rather than a one-off day. The honest answer comes after a short call to confirm your scope, tooling and audit timeline - the management system, not the size of your engineering team, usually sets the pace.
Do we need a consultant if we have Vanta or Drata?: A compliance platform collects evidence and automates checks, but it cannot decide whether your ISMS scope, risk register and control ownership make sense, and it cannot tell you whether an auditor would accept what it has gathered. Most Stage 1 blockers we see - a missing internal audit, no management review, a Statement of Applicability that does not reconcile with the risk register - sit outside what the platform can judge. The tool is genuinely useful; it is not a substitute for a readiness view.
What blocks Stage 1 most often?: Almost always the management system rather than the technology. The recurring blockers are a missing or incomplete Statement of Applicability, an internal audit that was never performed, no management review record, and a risk register that does not map to the SoA. These stop a Stage 1 audit regardless of how strong your engineering controls are, which is exactly why we look at them first.
Can you guarantee we pass?: No. Kellwick is an independent advisory practice, not a certification body, and certification decisions are made only by accredited certification bodies through their Stage 1 and Stage 2 audits. We prepare you for that process - the gap picture, the remediation, the evidence - and we are candid about where you stand, but no honest advisor can guarantee an audit outcome.
Where do we start?: For most teams the right first step is the Mini Gap Review: a fast, low-risk snapshot of where you stand against the artifacts an auditor checks first, with your top blockers and the single next step that matters most. If you already know you are close to an audit date, a full readiness assessment is the better entry point. Either way we scope it on a short call.

Find what blocks Stage 1 before the certification body does.

A clear, evidence-based view of where your ISMS stands and the one next step that matters most. Scoped on a short call.

Book a readiness call

Certification is issued by accredited certification bodies; DORA supervision is performed by regulators. Kellwick prepares you for these processes; it does not perform them and cannot guarantee their outcome.

ISO 27001 readiness, remediation and evidence

Enterprise customers and certification bodies increasingly demand ISO 27001. Kellwick finds what will block Stage 1 before the certification body does.

CQI/IRCA ISO/IEC 27001:2022 Lead Auditor trained · IRCA Associate Auditor - ISMS · CQI Practitioner Member - PCQI

ISO 27001 has quietly become a condition of the deal.

The blocker

What it means for Stage 1

No Statement of Applicability

Stage 1 stops here. Every time.

Internal audit never performed

You cannot proceed to Stage 2.

No management review record

Same. No exceptions.

Risk register that does not map to the SoA

The auditor sees the disconnect in ten minutes.

Access reviews that never happened

An evidence hole nothing can patch on audit day.

Backup exists, restore never tested

“We have backups” is not evidence of recovery.

The questions teams ask us first.

How long does ISO 27001 readiness take?

It depends on the maturity of your management system. A focused readiness assessment typically runs over one to two weeks, and closing the gaps it finds is a further short project rather than a one-off day. The honest answer comes after a short call to confirm your scope, tooling and audit timeline - the management system, not the size of your engineering team, usually sets the pace.

Do we need a consultant if we have Vanta or Drata?

A compliance platform collects evidence and automates checks, but it cannot decide whether your ISMS scope, risk register and control ownership make sense, and it cannot tell you whether an auditor would accept what it has gathered. Most Stage 1 blockers we see - a missing internal audit, no management review, a Statement of Applicability that does not reconcile with the risk register - sit outside what the platform can judge. The tool is genuinely useful; it is not a substitute for a readiness view.

What blocks Stage 1 most often?

Almost always the management system rather than the technology. The recurring blockers are a missing or incomplete Statement of Applicability, an internal audit that was never performed, no management review record, and a risk register that does not map to the SoA. These stop a Stage 1 audit regardless of how strong your engineering controls are, which is exactly why we look at them first.

Can you guarantee we pass?

No. Kellwick is an independent advisory practice, not a certification body, and certification decisions are made only by accredited certification bodies through their Stage 1 and Stage 2 audits. We prepare you for that process - the gap picture, the remediation, the evidence - and we are candid about where you stand, but no honest advisor can guarantee an audit outcome.

Where do we start?

For most teams the right first step is the Mini Gap Review: a fast, low-risk snapshot of where you stand against the artifacts an auditor checks first, with your top blockers and the single next step that matters most. If you already know you are close to an audit date, a full readiness assessment is the better entry point. Either way we scope it on a short call.