COMPLIANCE · CONSULTING SERVICES
Walk into the audit already knowing the answer
An ISMS built end to end against ISO/IEC 27001:2022, through to certification readiness: the gap assessment, the Annex A control implementation, the policy and procedure suite, the internal audit and management review, and the liaison with the certification body — an internationally recognised stamp of credible governance that regulators, enterprise clients and partners expect.
ENGAGEMENT AT A GLANCE
ScopeCorporate IT and OT/ICS
StandardISO/IEC 27001:2022
OutputISMS + certification readiness
YOU RECEIVE
Gap assessment against Clauses 4–10 and Annex A
Annex A controls implemented with your process owners
Full policy, standard and procedure suite
Internal audit and management review
Certification-body liaison through Stage 1 and Stage 2
WHAT'S COVERED
Scope of the engagement
01
ISMS scope definition
Getting the boundary right is the single decision that most affects cost and effort — and the one auditors test first.
02
Gap assessment
Clauses 4–10 and all 93 Annex A controls assessed as implemented, partial or absent, with the evidence status noted for each.
03
Annex A control implementation
The controls the gap assessment found missing, designed and put in place with the people who will run them — not just written down.
04
Policy & procedure suite
A complete documentation set — policies, standards and procedures — written to be used rather than framed. Suites of 30+ documents have been delivered for banking, insurance and manufacturing clients.
05
Internal audit & management review
A full internal audit against your own evidence and a management review that meets the standard, so Stage 1 holds no surprises.
06
Certification-body liaison
Selecting and scheduling the certification body, and standing beside you through the Stage 1 and Stage 2 audits.
COMMON QUESTIONS
Before you ask
Do you issue the certificate?
No — that must come from an accredited certification body, and no consultancy can do both. We build the management system, prepare you, and support you through their audit.
How long until we can certify?
It depends on where you start. The gap assessment makes the honest answer clear early, and the certification date is agreed at scoping and worked back from rather than promised up front.
Do you write the documentation, or do we?
We write it, with your process owners — documentation written without the people who run the process never survives the first audit. Complete suites of 30+ policies, standards and procedures have been delivered for banking, insurance and manufacturing clients across Egypt and the Gulf.
THE DELIVERABLE
What lands on your desk at the end
Before you sign, ask us exactly what the report contains — it is the fastest way to judge whether the work is worth buying.
REPORT CONTENTS
Gap assessment against every Annex A control, with evidence status
Scope statement and Statement of Applicability
Risk assessment and treatment plan in your own format
Policy, standard and procedure suite, written to be usable rather than framed
Internal audit report and management-review pack
WHAT WE NEED FROM YOU
Executive sponsor with authority to approve policy
Control owners per department, for 2–3 hours each
Access to existing documentation and asset registers
A target certification date to work back from
FRAMEWORKS THIS EVIDENCES
ISO/IEC 27001:2022ISO/IEC 27002 guidanceISO/IEC 27005 risk
Findings are mapped to control references so the report can be handed to an auditor without translation.
Ready to secure your business?
Book a consultation with our engineers. Bring your architecture and your constraints — we'll tell you what we would do first, and why.
WHAT A CONSULTATION LOOKS LIKE
01
A conversation with an engineer
Not a sales call. Bring your architecture and your constraints.
02
A written gap summary
Prioritised, with what we would do first and why.
03
No obligation, no follow-up sequence
If it is not a fit we will say so on the call.
Not ready to talk? See the company facts — entity details, offices and our NTRA certification.
One inbox, answered by an engineer — not a routing queue.