- Home
- Compliance
- ISO 27001 Compliance
Standard compliance
ISO 27001:2022 consulting and certification
ISO 27001 is the most widely recognised information security standard, and often the first thing enterprise customers ask for. Our lead auditors help you build an ISMS that fits how your company actually works, then guide you through certification.
Why teams choose Adiroha
- Led by CISA and ISO 27001 lead auditors
- Clear scope, roadmap and timeline before we start
- Evidence organised in the Cydital platform
- Support through the external audit and beyond
Scope
What we cover
- Gap assessment against ISO/IEC 27001:2022
- ISMS scope, context and risk methodology
- Risk assessment and treatment plan
- Statement of Applicability across Annex A controls
- Policies and procedures sized to your organisation
- Internal audit and management review
- Certification audit support and non-conformity closure
- Transition from ISO 27001:2013
Deliverables
What you receive
- Gap report with prioritised roadmap
- Complete ISMS documentation set
- Internal audit report
- Evidence organised in Cydital for audit day
How we work
Discover. Assess. Remediate. Validate.
Discover
Understand your business, scope, stakeholders and the obligations that actually apply to you.
Assess
Gap assessment against the framework or regulation, turned into a prioritised, costed roadmap.
Remediate
Implement policies, controls and evidence with your teams, tracked in Cydital.
Validate
Internal audit before the external one, audit-day support, and continuous compliance after.
FAQ
Common questions
How long does ISO 27001 certification take?
Most organisations reach certification in 3–6 months, depending on size, scope and how many controls are already in place.
Do you issue the certificate?
No. Certificates are issued by accredited certification bodies. We prepare you, support you during the audit and help close any findings.
What changed in ISO 27001:2022?
Annex A was restructured into 93 controls across four themes, including new controls such as threat intelligence, cloud services security and secure coding.
How much does ISO 27001 certification cost?
Costs depend on your size, scope and existing controls, plus the certification body's audit fees. We provide a fixed consulting proposal after a short scoping call.
What's the difference between Stage 1 and Stage 2 audits?
Stage 1 reviews your ISMS documentation and readiness. Stage 2 tests whether your controls work in practice. Certification follows a successful Stage 2.
How long is the certificate valid?
Three years, with surveillance audits in the first and second years and a recertification audit in the third.
Do all 93 Annex A controls apply to us?
No. You decide which controls apply based on your risk assessment, and justify any exclusions in the Statement of Applicability.
Related
Related services
SOC 2 Compliance
SOC 2 readiness for Type I and Type II reports — scoping, control design, evidence and auditor coordination.
Learn morePCI DSS Compliance
PCI DSS v4.0.1 scoping, gap assessment, segmentation testing and remediation for merchants and service providers.
Learn moreGDPR Compliance
GDPR readiness for companies processing EU personal data — data mapping, DPIAs, transfers and data subject rights.
Learn moreTalk to a specialist about ISO 27001 Compliance.
A free 30-minute consultation to understand your scope and timeline. We follow up with a fixed proposal.