ISO/IEC 27001Certifiable
Information security management
Establish and run an ISMS to manage information security risks.
Governance, Risk & Compliance
Your ISO specialist, from first workshop to certificate.
Cybergen helps you achieve and maintain ISO standards, led by ISO/IEC 27001. We assess where you are, build a management system that fits how you work, audit it independently and prepare you for certification.
Illustrative example only, not live data
ISO CONSULTANCYISO/IEC 27001ISO 22301ISO/IEC 27701ISO/IEC 42001Internal auditsRTS audits
What is ISO 27001?
The international standard for information security
ISO/IEC 27001 sets out the requirements for an Information Security Management System (ISMS): the policies, processes, responsibilities and controls an organisation uses to manage information security risks across technology, people and physical security.
It gives you a structured way to identify risks, protect information and continually improve. The current edition is ISO/IEC 27001:2022, with a 2024 amendment.
An organisation working towards ISO 27001 might:
- Assess the risks to customer data and systems
- Define who is responsible for information security
- Introduce controls such as MFA, access restrictions and secure backups
- Train employees to recognise and report security incidents
- Assess the security of suppliers
- Test incident response arrangements
- Carry out internal audits and review whether controls are effective
Can a company become certified?
Yes. We prepare you. An independent body certifies you.
Cybergen gets you ready for certification. An independent, accredited certification body carries out the audit and issues the certificate.
Cybergen prepares and supportsAccredited certification body audits
Gap analysisCybergen
Build the ISMSCybergen
Internal auditCybergen
Management reviewCybergen
Stage 1 auditCertification body
Stage 2 auditCertification body
Certificate issuedCertification body
Annual surveillanceBoth
Scope matters
A certificate applies to the scope of the ISMS. It is worth checking which services, locations and activities are covered.
Assurance, not a guarantee
Certification shows a management system meets the standard. It does not guarantee an organisation will never experience a cyber incident.
Accreditation adds weight
Certification by an accredited body provides additional independent assurance to customers and regulators.
The standards
The ISO standards behind your security
Some standards can be certified. Others provide the specialist guidance we use to build and run your management system.
ISO/IEC 27002Guidance
Security controls
Reference controls and guidance covering access, threat intelligence, supplier security, incident management and more.
ISO/IEC 27005Guidance
Information security risk management
Identify, assess, treat and monitor information security risks.
ISO/IEC 27017Guidance
Cloud security
Cloud-specific controls clarifying customer and provider responsibilities. The current edition is 27017:2026.
ISO/IEC 27018Guidance
Personal data in public cloud
Protect personal data processed by public cloud service providers.
ISO/IEC 27035Guidance
Incident management
Prepare for, detect, assess, respond to and learn from information security incidents.
ISO/IEC 27701Certifiable
Privacy management
A Privacy Information Management System. Standalone since the 2025 edition, or used with ISO 27001.
ISO/IEC 27000Guidance
Overview and vocabulary
The concepts and structure of the information security management family.
ISO 22301Certifiable
Business continuity
A business continuity management system to continue or restore priority activities after disruption.
ISO/IEC 42001Certifiable
AI management
Requirements for an AI management system covering governance, risk, transparency and responsible use.
ISO/IEC 20000-1Certifiable
IT service management
Management and delivery of IT services, relevant to managed service providers and IT operations.
ISO 9001Certifiable
Quality management
A quality management system for consistent products, services and customer satisfaction.
Certifiable requirements standard you can be certified against Guidance supports implementation
Start with your goal
What are you trying to achieve?
Choose an outcome to see the standards involved and how we would help.
YOUR GOAL
Become ISO 27001 certified
Relevant standards
ISO/IEC 27001ISO/IEC 27002ISO/IEC 27005How Cybergen helps
Gap assessment, ISMS implementation, risk assessments, policy development and certification readiness.
YOUR GOAL
Improve cloud security
Relevant standards
ISO/IEC 27017ISO/IEC 27018How Cybergen helps
Cloud security assessment, control reviews and shared-responsibility advice.
Related: Cloud securityYOUR GOAL
Prepare for a cyber incident
Relevant standards
ISO/IEC 27035How Cybergen helps
Incident response planning, playbooks, tabletop exercises and response capability reviews.
Related: Tabletop exercisesYOUR GOAL
Protect personal data
Relevant standards
ISO/IEC 27701How Cybergen helps
Privacy management gap assessment, privacy risk reviews and implementation support.
Related: GDPR complianceYOUR GOAL
Improve business continuity
Relevant standards
ISO 22301How Cybergen helps
Business impact analysis, continuity planning, recovery exercises and certification readiness.
Related: Business continuityYOUR GOAL
Govern and secure AI use
Relevant standards
ISO/IEC 42001How Cybergen helps
AI governance assessments, policy development, AI risk assessment and certification readiness.
Related: AI GovernanceHow we help
Support at the level you need
Whether you need a quick health check, full implementation or someone to run your management system, we tailor the engagement to you.
ASSESS
Know where you stand
- Initial discovery workshop
- Benchmark assessment against the standard
- Full gap analysis with a prioritised plan
- Pre-certification readiness review
IMPLEMENT
Build it with us
- Everything in Assess
- Risk assessment and Statement of Applicability
- Policies, procedures and controls documentation
- Awareness training and project management
- Certification body engagement and Stage 1 remediation
MAINTAIN
Keep it working
- We run your management system for you
- Scheduled independent internal audits
- Management review support
- Continual improvement and surveillance audit preparation
Implementation roadmap
A clear path to certification
Every step of a full ISO 27001 implementation, with regular project updates throughout.
01Discover
- Discovery workshops
- Interested parties
- ISMS objectives and scope
02Assess risk
- Risk assessment
- Control selection
- Statement of Applicability
03Build
- Core ISMS documentation
- Controls documentation
- Business continuity planning
04Operate
- Awareness training
- Internal audit
- Management review
05Certify
- Pre-audit assessment
- Stage 1 remediation
- Stage 2 audit support
06Improve
- Continual improvement reviews
- Surveillance audit preparation
- Ongoing project updates
ISO internal auditing
An independent view, before the certification body
ISO 27001, ISO 22301 and ISO 9001 all require internal audits, usually at least once a year. Our auditors provide the objectivity and expertise an internal team may lack, finding gaps and nonconformities before your external auditor does. One-off or ongoing, single or multiple sites.
- 1ScopeAgree and document the audit scope.
- 2PlanProduce an audit plan for your approval.
- 3ScheduleAgree dates, onsite or remote.
- 4AuditTest processes, controls and evidence.
- 5ReportNonconformities and opportunities for improvement.
RTS security audits
Annual security audits for remote gambling operators
Many Gambling Commission remote licensees must commission an annual, independent security audit against the security requirements in the Remote gambling and software Technical Standards (RTS), which are based on ISO/IEC 27001:2022.
Independent and qualified
Audits by auditors independent of the licensee and suitably qualified to assess ISO/IEC 27001:2022.
Report in the right format
A documented audit report with major and minor nonconformities, opportunities for improvement and a remediation plan.
Ready for the 7-day rule
Major nonconformities must be reported to the Commission within 7 days, with management responses. We help you prepare them.
Onsite or remote, one-off or ongoing
Gap analysis and remediation support before the formal audit if you need it.
Why Cybergen
ISO specialists who understand security
Practitioners, not just paperwork
We are a security services company, so the controls we help you design are ones we test, monitor and respond to every day.
Proportionate and practical
An ISMS that fits how you work, without unnecessary bureaucracy.
Connected services
Penetration testing, incident response, awareness training and vCISO support that evidence your controls.
Independent by design
We prepare you for certification. Accredited certification bodies carry out the certification audit.
What is ISO 27001?
ISO/IEC 27001 is the main international standard for information security management. It sets out the requirements for an Information Security Management System (ISMS) to identify risks, protect information and continually improve.
Does Cybergen issue the ISO certificate?
No. We help you prepare for certification. An independent, accredited certification body carries out the Stage 1 and Stage 2 audits and issues the certificate.
How long does ISO 27001 certification take?
It depends on your scope, size and starting point. A gap analysis gives you a realistic timeline and plan before you commit.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the requirements you can be certified against. ISO 27002 provides guidance on implementing the security controls.
Does ISO 27701 certification mean we comply with GDPR?
No. ISO/IEC 27701 can support GDPR accountability, but certification does not automatically mean an organisation complies with GDPR.
Do we need internal audits?
Yes. ISO 27001, ISO 22301 and ISO 9001 require internal audits, usually at least annually. We can carry these out independently on your behalf.
Can you run our ISMS for us?
Yes. Our managed service maintains your management system, runs internal audits and reviews, and prepares you for surveillance audits.
What is an RTS security audit?
An annual independent security audit required for many Gambling Commission remote licensees, assessing compliance with the RTS security requirements based on ISO/IEC 27001:2022.
Book a consultation
Start your journey to ISO certification.
Tell us which standard you are working towards and where you are today. We will recommend the right next step.
Prefer to talk? Call +44 (0) 1865 950 828
Or email [email protected]
Thanks, we've received your enquiry
A member of our team will be in touch shortly.