Which ISO 27000 family standards matter when your customer asks for ISO 27001 certification
When a customer, contract or regulator asks for ISO 27001, the only standard in the ISO/IEC 27000 family you can be certified to is ISO/IEC 27001:2022, the requirements for an information security management system (ISMS). Certification bodies issue the certificate after an audit, not ISO, and the certificate covers the scope you define. Everything else in the family is either guidance you may use to build or audit the ISMS, or an extension that adds requirements only for particular sectors or services. Your first decision is therefore to confirm that the request names 27001 and not a guidance document, since a certificate to 27002 or 27005 does not exist.
Several supporting documents change the work even though they are not certifiable. ISO/IEC 27002:2022 gives the control guidance behind the Annex A controls, ISO/IEC 27005 covers risk management, ISO/IEC 27004 covers performance measurement and ISO/IEC 27007 guides internal and external auditors. The overview document has been revised: ISO/IEC 27000:2026 (edition 6, published July 2026) replaced the 2018 edition, which ISO withdrew on 3 July 2026. Check that any internal template or consultant pack cites the current overview, and confirm with your certification body which edition it will audit against. Sector and service extensions matter when they apply to you: ISO/IEC 27017 for cloud services, ISO/IEC 27701 for privacy, ISO/IEC 27019 for energy, ISO/IEC 27011 for telecommunications and ISO 27799 for health. Confirm with the customer whether they expect any of these to be named in the scope or in the certificate.
Which standards a certification buyer must understand first
Only one standard in the ISO/IEC 27000 family can be certified, but the others shape what an auditor expects to see. The cards below separate the certifiable requirements from the overview, control guidance and accreditation rules that surround them, so you know which document each conversation with a certification body should reference.
ISO/IEC 27001:2022 requirements
This is the only standard in the family that an organization can be certified to. It sets the requirements for an information security management system, including the clauses on context, leadership, planning, support, operation, performance evaluation and improvement, plus the Annex A control list. Confirm with your certification body which edition and amendment it will audit against, and make sure the statement of applicability maps to the 2022 Annex A controls rather than the 2013 set.
ISO/IEC 27000:2026 overview
Edition 6 of the overview document explains the core concepts of an information security management system and how the documents in the family relate to each other. It was published in July 2026 and replaced the 2018 edition, which was withdrawn on 3 July 2026. Use it as the shared vocabulary for internal policies, auditor discussions and supplier questionnaires, and check that any older document your team cites still points to a current edition.
ISO/IEC 27002:2022 control guidance
This standard gives implementation guidance for each Annex A control, including what the control aims to achieve and how organizations commonly put it into practice. It cannot be certified to, so an auditor will not test your organization against its text. Use it to design and document your controls, and expect certification bodies to test the outcomes in your statement of applicability and the evidence behind them.
ISO/IEC 27006-1 audit rules
Accredited certification bodies follow this standard, which adds requirements for auditing and certifying information security management systems on top of the general body rules. It sets how audit time is determined, and IAF MD 29:2024 required certification bodies to apply it to all clients by 31 March 2026. Ask your certification body how it has applied this rule to your audit time and whether its quote reflects it.
ISO/IEC 17021-1 certification body rules
This standard sets the general requirements that certification bodies must meet for management system certification, including impartiality, competence and the certification cycle. A three-year cycle with at least one audit in each calendar year is the expectation most buyers will see in practice. Before signing, confirm the certification body is accredited for ISO/IEC 27001 through an accreditation body recognized in the IAF CertSearch database.
Climate amendment and the 2024 changes
Amendment 1:2024 adds two climate-related points to the standard. Clause 4.1 requires the organization to determine whether climate change is a relevant issue, and a note under clause 4.2 explains that interested parties may have climate-related requirements. Your context and risk documentation should record that decision, even if the answer is that climate change is not relevant to your scope. Ask your certification body how it will check the determination.
Which guidance standards an in-house team can buy and when they help
Four guidance standards in the 27000 family are worth knowing about before you buy anything: ISO/IEC 27005:2022 on information security risk management (62 pages, CHF 225 according to ISO's listing), ISO/IEC 27003:2017 on ISMS implementation guidance (45 pages, currently under revision), ISO/IEC 27004:2016 on measuring security performance (58 pages, CHF 225, marked for revision) and ISO/IEC 27007:2020 on auditing an ISMS (39 pages, CHF 196). None of them is certifiable and none adds requirements to ISO/IEC 27001. They are optional aids that explain how to carry out parts of the standard you must meet anyway.
The most common fit is ISO/IEC 27005 for the risk assessment and risk treatment work behind clause 6.1.2 and the Statement of Applicability. A team that has never run a structured risk method often benefits from its worked approach. ISO/IEC 27004 helps when you need to define measures for clause 9.1, such as what you monitor, how often, and how results are analyzed. ISO/IEC 27007 is useful for the people who run the internal audit required by clause 9.2, because it describes how to plan and conduct an ISMS audit. ISO/IEC 27003 suits a team building the ISMS from scratch, though its revision means you should check whether a newer edition is in progress before relying on the 2017 text.
Before you purchase, confirm the current edition, status and price on the ISO committee pages for each standard, since the revision status can change between your research and your order. Also decide who will read the documents. A small team may only need the risk method and the audit guidance, while a larger program may want all four. If you plan to hire a consultant, ask whether their method follows these standards, so your internal records match what the certification body will review. Guidance of this kind can help your team, but the certification body judges the evidence you produce, not whether you bought the guidance.
Which 27000 family standard answers which buyer question
This table maps the ISO/IEC 27000 family to the buyer question each standard answers, and shows which document an organization is certified against. Only ISO/IEC 27001 issues a certificate, so the other rows tell you what to read, what to apply and who on your team or your advisers needs it. Confirm the current status of each standard on the ISO committee page before you cite it in a contract or audit plan.
| Standard | What it is | Certifiable | Who needs it |
|---|---|---|---|
| ISO/IEC 27001:2022 | The ISMS requirements standard, with Annex A controls drawn from ISO/IEC 27002 | Yes | The organization seeking certification, and the customers and regulators who ask for a certificate |
| ISO/IEC 27000:2026 | Overview of ISMS concepts, principles and how the 27000 documents relate, with the vocabulary | No | Anyone new to the family, including the sponsor, project lead and board reader |
| ISO/IEC 27002:2022 | Control guidance for the Annex A controls, which ISO states cannot be certified | No | Control owners and engineers writing procedures and configuring technical controls |
| ISO/IEC 27003:2017 | ISMS implementation guidance, under revision | No | Project leads planning the ISMS build and its governance |
| ISO/IEC 27004:2016 and 27005:2022 | 27004 covers measuring ISMS performance for clause 9.1; 27005 covers information security risk management | No | Risk owners and the team that produces metrics for management review |
| ISO/IEC 27006-1:2024 and 27007:2020 | 27006-1 sets requirements for certification bodies; 27007 guides auditors of an ISMS | No | Certification bodies and internal auditors. Organizations use these to check how an audit should run |
| ISO/IEC 27017 and 27018 | Cloud guidance: 27017 for cloud service controls, 27018 for protecting PII in public clouds | No | Cloud providers and cloud customers, usually reviewed alongside the ISO 27001 scope |
| ISO/IEC 27701 | Privacy information management extension, which ISO/IEC 27002 names as a privacy standard | No | Organizations processing personal data that need a privacy management view. Confirm its certification status on the ISO page |
| ISO/IEC 27011, 27019 and 27799 | Sector standards named in ISO/IEC 27002 for telecom, energy and health controls | No | Telecom, energy and health organizations that apply sector-specific control guidance |
Which sector and cloud extensions apply to your organization
ISO/IEC 27017 gives cloud-specific guidance on the security controls in ISO/IEC 27002, and it applies to both cloud service providers and cloud service customers. It is not certified on its own. Organizations usually use it as an add-on to an ISO 27001 ISMS, and the cloud-specific considerations feed into the risk assessment and the Annex A controls, including the cloud services control in clause 5.
- Provider side: Responsibilities for configuration, multi-tenant isolation, and customer data handling are documented and assessed.
- Customer side: Responsibilities for configuring the cloud, managing identities, and securing workloads are assigned to named roles.
- Shared responsibility records: Each party's obligations are written down so an auditor can trace them to evidence.
- Certificate scope: The cloud services in scope are named in the ISMS scope statement.
Before buying, ask the certification body whether it will reference the cloud guidance in your audit plan and how it will verify the shared responsibility model. Confirm the current edition of the standard with the certification body and the ISO committee page.
ISO/IEC 27018 is a code of practice for protecting personally identifiable information (PII) in public cloud services, written for providers that process PII on behalf of their customers. It builds on ISO/IEC 27002 and works alongside ISO/IEC 27001 and ISO/IEC 27017. Like 27017, it is normally assessed as part of an ISO 27001 ISMS audit rather than issued as a separate certificate.
- Processor duties: The provider documents how it processes PII only on the customer's instructions.
- Return and deletion: Procedures cover return, transfer, and deletion of PII at the end of the service.
- Disclosure controls: Requests from law enforcement or other third parties are recorded and handled under documented rules.
- Subcontractors: Use of sub-processors is disclosed and governed by contract.
Cloud customers should not assume that a provider's 27018 claim covers their own data handling. Ask the provider for the certificate scope and the statement of applicability, and confirm with your own certification body how that evidence is used in your audit.
ISO/IEC 27701 is the privacy extension in the 27000 family. It adds requirements for a privacy information management system (PIMS) that controllers and processors of PII can operate, and it is built on the management system structure of ISO/IEC 27001. Organizations that already hold an ISO 27001 certificate typically extend their ISMS to cover privacy, so the privacy requirements sit alongside the security requirements.
- Privacy-specific controls: Lawful basis, consent records, data subject requests, and retention are documented and tested.
- Controller and processor roles: The organization states which role it holds for each processing activity.
- Shared evidence: Many security controls, such as access control and logging, serve both the ISMS and the PIMS.
- GDPR alignment: Records support the accountability duties of the GDPR, although certification does not replace legal compliance.
The current edition and whether the certificate is issued as a standalone or as an extension should be confirmed with the certification body before you contract. Ask how it will treat the existing ISO 27001 scope.
ISO/IEC 27019 is sector guidance for the energy industry, and ISO/IEC 27011 is guidance for telecommunications organizations. ISO/IEC 27002 names both as sector-specific standards that add controls for their areas. They are used to tailor the controls in an ISO 27001 ISMS, for example to control process control systems in utilities or network operations in telecoms. They are not normally issued as separate certificates.
- Operational technology: Energy operators often apply 27019 guidance to control systems that run generation, transmission, or distribution.
- Network operations: Telecom operators apply 27011 guidance to network elements, lawful interception, and service continuity.
- Regulatory overlap: Sector regulators may set their own requirements, which the ISMS should map to rather than replace.
- Scope boundaries: Plants, networks, and substations are included or excluded explicitly in the scope statement.
Ask the certification body whether it has experience with these sectors and how it will sample operational technology sites. Confirm with the standards body whether the sector guidance applies to your activities.
ISO 27799 is guidance for information security in health informatics. It is based on ISO/IEC 27002 and helps health care organizations apply controls to patient records, clinical systems, and medical devices. Like the other sector guides, it is used to shape an ISO 27001 ISMS rather than to issue a separate certificate. Health care organizations also face national and sector-specific rules, which the ISMS should address.
- Patient records: Access, retention, and audit logging for clinical data are defined in the controls.
- Medical and connected devices: Asset inventories and patch processes cover devices that cannot easily be taken offline.
- Third-party access: Vendors who support clinical systems are assessed under the supplier controls.
- Business continuity: Procedures cover downtime for clinical services and restoration of records.
Health care buyers should confirm with the certification body which health informatics guidance it expects to see referenced in the audit and how it handles sites with mixed clinical and administrative networks.
How 27006-1 and 17021-1 shape the audit you will pay for
Accredited certification bodies do not audit against ISO/IEC 27001 alone. They work to ISO/IEC 17021-1:2015 for management system certification in general, plus ISO/IEC 27006-1:2024, which adds requirements specific to information security management systems. IAF MD 29:2024 required certification bodies to apply ISO/IEC 27006-1:2024 to all clients by 31 March 2026, so any audit you book now should be run under it. Ask the certification body to confirm in writing which edition its audit plan and audit time calculation follow, and check that its accreditation scope covers ISO/IEC 27001 before you sign.
The certification cycle under ISO/IEC 17021-1 lasts three years and requires at least one audit in every calendar year, either a surveillance audit or the recertification audit. Budget for that recurring cost from the start, not only the initial certification. ISO/IEC 27006-1:2024 sets how audit time is determined in its Annex C, and the number of auditor days in your quote should trace back to that method, including the size of the ISMS, the number of sites and the complexity of the scope. Ask the certification body to show that calculation so you can see which inputs drive the price and which ones you can change by narrowing scope or consolidating sites.
These rules also set a boundary you need to respect. A certification body must stay impartial, so it cannot provide the consultancy for the ISMS it will later audit, and it cannot design the controls it assesses. The organization owns its controls, its risk decisions and its Statement of Applicability. An implementation partner can prepare systems, configuration, documentation and evidence, but it should not be the same firm that certifies you. Confirm the separation in writing with both parties, and treat any suggestion that the certification body will help build the ISMS as a conflict of interest to raise before the audit starts.
How to read the 27000 family in the order your project needs it
This sequence moves a team from the contractual requirement to a certifiable scope, a risk-based control set, measurement and internal audit, so each standard is read when its output is needed.
Confirm the certificate requirement and edition
Start with the customer contract, tender or regulator letter and record exactly which standard, which edition and which scope the buyer expects. Ask whether the buyer requires ISO/IEC 27001:2022 or accepts the 2013 edition, since IAF MD 26:2023 required all 2013 certifications to expire or be withdrawn by 31 October 2025. Confirm whether the Amendment 1:2024 climate changes apply to your certification body's audit. The output is a short requirements note that names the standard, the edition, the certificate holder and the sites or services in scope. The step is done when the commercial owner and the security lead have signed the same note.
Read ISO/IEC 27001:2022 and 27000:2026
Buy or read ISO/IEC 27001:2022 first, since its clauses 4 to 10 are the certifiable requirements, then read ISO/IEC 27000:2026 for the terms and principles it relies on. The 2026 edition replaced the 2018 overview, which was withdrawn on 3 July 2026, so use the current document. The team lead drafts a gap list against clauses 4 to 10 and notes which terms need a shared definition. The output is a clause-level gap list and a glossary agreed by the project team. The step is complete when every clause has an owner and an open or closed status.
Use ISO/IEC 27002 for control guidance
Read ISO/IEC 27002:2022 alongside the 93 Annex A controls to understand the purpose and expected implementation of each control. Remember that 27002 is guidance and cannot itself be certified, so use it to design controls, not to claim conformity. The control owners draft implementation notes for each Annex A control that applies. The output is a control implementation register with the owner, the implementing system and the evidence location for each control. The step is done when every control in the register is either implemented or marked as excluded with a reason.
Apply ISO/IEC 27005 for risk assessment
Use ISO/IEC 27005:2022 to choose a risk identification, analysis and treatment method that fits your organization's size and risk appetite. The risk owner selects the method, defines impact and likelihood criteria, and runs the assessment against the assets in scope. The output is a documented risk method, a risk register and a set of treatment decisions. These decisions are the direct inputs to the Statement of Applicability, so each Annex A control should trace back to a risk or a legal or contractual obligation. The step is complete when treatment decisions are approved by management and linked to controls.
Use ISO/IEC 27004 for performance measurement
Apply ISO/IEC 27004:2016, which supports the monitoring, measurement and evaluation required by clause 9.1 of ISO/IEC 27001. Define a small set of metrics tied to your control objectives, decide how often each is measured, and record who analyzes the results. Note that ISO marks 27004 as to be revised, so confirm the current status before relying on it. The output is a measurement plan with metrics, owners, frequencies and reporting records. The step is done when the first measurement cycle has produced results that management has reviewed and recorded.
Use ISO/IEC 27007 to plan internal audit
Use ISO/IEC 27007:2020 as guidance for planning and running internal audits of the ISMS, including audit criteria, sampling and reporting. The internal audit lead writes an audit programme that covers all clauses and the controls in the Statement of Applicability before the certification body arrives. The output is an internal audit plan, completed audit records and a list of nonconformities with corrective actions. The step is complete when internal audits have covered the full scope and the management review has considered the results.
Check for sector extensions in ISO/IEC 27002
Review the sector standards named in the introduction to ISO/IEC 27002:2022, including ISO/IEC 27017 for cloud services, ISO/IEC 27701 for privacy, ISO/IEC 27019 for energy, ISO/IEC 27011 for telecommunications and ISO 27799 for health. Confirm with the customer or regulator whether any of these applies to your services, and record the decision. The output is a short extension decision note that either adds specific controls to the register or states why no extension applies. The step is done when the decision has been reviewed by the risk owner and the certification body has been told which extensions are in scope.
Mistakes that add cost when buyers chase the wrong standard
Buyers who start from a logo or a customer questionnaire often purchase the wrong documents, rely on superseded editions or pay for scope nobody required. The cards below cover the decisions that most often add cost in the ISO/IEC 27000 family, and what to check before committing money or effort.
Buying every standard before scoping
Teams often purchase the whole 27000 family on the assumption that each document is needed for certification. Only ISO/IEC 27001:2022 is certified against, and the other documents are guidance that helps with specific tasks. Start with the scope of the ISMS, the customer or regulator asking for certification, and the certification body's requirements, then buy only the guidance those tasks need.
Treating 27002 as a certifiable checklist
ISO/IEC 27002:2022 gives guidance on the Annex A controls and cannot itself be certified to. Auditors test the organization against the requirements in ISO/IEC 27001 and the controls it selects in its Statement of Applicability. Build evidence for each Annex A control and its stated purpose, not for every sentence of the guidance document.
Assuming 2013 certificates still count
Certifications to ISO/IEC 27001:2013 had to expire or be withdrawn by the end of the 36-month transition period under IAF MD 26:2023. An organization that still presents a 2013 certificate to a customer is not certified to the current edition. Ask the certification body for a certificate issued against the 2022 edition and check the certificate's validity in the IAF CertSearch database.
Relying on the withdrawn 2018 overview
ISO/IEC 27000:2018 was withdrawn when the 2026 edition replaced it. Policies, training decks and gap assessments that cite the 2018 overview for terms and concepts now point to a superseded document. Update internal references to the current overview and confirm that vocabulary used in the Statement of Applicability and risk documents matches it.
Paying for an unrequested sector extension
Sector standards such as ISO/IEC 27017 for cloud services, ISO/IEC 27701 for privacy, ISO/IEC 27019 for energy, ISO/IEC 27011 for telecommunications and ISO 27799 for health add controls for specific areas. Buying or implementing them without a contract, regulator or customer requirement adds effort and audit scope. Ask the customer which extension, if any, they expect, and get that in writing before scoping it.
Who owns the standards work, the partner and the certification body
The organization owns its information security management system and decides which standards it adopts, which controls it applies and how it scopes the ISMS. That decision sits with the leadership team, not with a consultant or a platform vendor. Before work starts, write down which members of the ISO/IEC 27000 family the organization relies on, such as ISO/IEC 27001:2022 for the requirements, ISO/IEC 27002:2022 for control guidance and ISO/IEC 27005:2022 for risk management, and who signs off each one. A partner can only prepare evidence against standards the organization has chosen, so the choice comes first.
An implementation partner such as DeployOpen plans and builds the technical side: it can configure self-hosted open-source platforms, set up logging and access controls, and organize the evidence those systems produce against the chosen standards. It does not decide whether a control is effective, does not write an audit report and does not issue a certificate. Ask any partner to state that boundary in the written scope. Also confirm who keeps the policies, risk decisions and Statement of Applicability after the engagement ends, because the organization must run them every day.
Only an accredited certification body issues an ISO 27001 certificate. That body must be independent of the firm that designed or implemented the ISMS, and the European Accreditation FAQs on consultancy and impartiality set out why a certification body cannot audit work its own staff prepared. Before accepting a certificate, check it in the IAF CertSearch database, which ISO still points to for accredited certificates, and confirm that the scope on the certificate matches the scope the organization intends to sell to customers.
Questions buyers ask about the ISO 27000 family
When a customer says ISO 27000, which standard do they mean?
They almost always mean ISO/IEC 27001, the only standard in the family that an organization can be certified against. Customers usually ask for the certificate, so the ISMS requirements in ISO/IEC 27001:2022 are what the certification body audits. The 27000 family contains more than a dozen standards, but most of them are guidance. ISO/IEC 27000:2026 is an overview that explains the vocabulary and how the documents relate, and it is useful for training and for aligning internal teams. Ask the customer to name the exact standard, edition and scope in the contract or questionnaire, because a vague request for ISO 27000 can hide a mismatch between what they want and what you can certify.
Do we need ISO 27002 to get ISO 27001 certified?
No standard requires you to buy ISO/IEC 27002, but you will need its guidance to implement the Annex A controls well. ISO/IEC 27001:2022 lists 93 Annex A controls in four themes, and those controls are drawn from ISO/IEC 27002:2022. ISO states that 27002 cannot itself be certified to. Its value is explanatory: the control guidance helps your team understand the intent behind each control and how an assessor will look for evidence. Many organizations buy a copy for the people who write policies and configure systems, and treat it as a reference rather than a checklist. Confirm the current edition and purchase terms with ISO before budgeting.
Is ISO 27005 required for the ISO 27001 risk assessment?
ISO/IEC 27001 requires a documented information security risk assessment and risk treatment process, but it does not name ISO/IEC 27005 as mandatory. ISO/IEC 27005:2022 is risk management guidance that many organizations use because it gives structure to identifying, analyzing and evaluating risks. Your certification body will judge whether your method is consistent and produces the outputs the standard asks for, including a Statement of Applicability linked to your risk treatment decisions. You can use another recognized method if it meets those needs. Buying ISO/IEC 27005 is a modest one-time cost that recurs only if you buy a later edition, and it is a reasonable choice for a team with no existing method.
What happened to the 2018 ISO 27000 overview?
ISO/IEC 27000:2018, titled Overview and vocabulary, was withdrawn on 3 July 2026 when the 2026 edition replaced it. The new ISO/IEC 27000:2026 is an overview of the core concepts and principles behind an ISMS and explains how the documents in the family relate. If your policies, training materials or customer documents cite the 2018 edition, update those references to the 2026 edition and record the change in your document control process. ISO had made the 2018 edition available at no cost, so existing copies remain useful for reference, but auditors will expect current citations. Check the ISO committee page for the current status before you update your documents.
Does a cloud or privacy extension change the ISO 27001 audit?
Extensions such as ISO/IEC 27017 for cloud services, ISO/IEC 27701 for privacy and ISO 27799 for health add controls or requirements for specific areas, so they can change what is in scope and what evidence the auditor reviews. ISO/IEC 27002 names these sector standards as sources of additional controls. The core ISO 27001 audit still runs against the same management system clauses and Annex A, but the scope statement, the Statement of Applicability and the evidence for those areas will reflect the extension. Ask your certification body early whether an extension will be audited as part of the same certificate or as a separate certification, and confirm the audit time impact in writing. Audit time is set under ISO/IEC 27006-1:2024, so ask how the body determined its figure.
What parts of ISO 27001 can our own team do in-house?
Your own team owns the ISMS, so it must do the work that defines and runs it: setting the scope, making leadership decisions, writing and approving policies, running risk assessments, operating controls and reviewing performance. Your team can also learn the standards directly, using ISO/IEC 27000:2026, ISO/IEC 27002:2022 and ISO/IEC 27005 as study material. Outside help is most useful for gap analysis, building evidence collection, and running internal audits, because the internal auditor should be independent of the work being audited. An implementation partner such as DeployOpen can prepare self-hosted systems and evidence in your own infrastructure, but it cannot issue a certificate. Only an accredited certification body does that, and a consultant that also audits you may create an impartiality conflict.
How long does a certification last once we achieve it?
Under ISO/IEC 17021-1, a management system certification cycle lasts three years, and the certification body must audit at least once in every calendar year of that cycle. Those audits are surveillance visits, with a full recertification audit at the end of the cycle. Plan your internal audit and management review calendar around these visits so evidence is ready each year. Budget for the recurring cost of surveillance and recertification audits, which the certification body quotes separately from the initial audit. Confirm the current cycle terms and audit days with your chosen body before signing, because the time they need depends on your scope and number of sites.
How DeployOpen helps you map standards to your systems
DeployOpen starts by agreeing which standards in the ISO/IEC 27000 family apply to your organization and which documents your systems must evidence. We then plan, build and document the self-hosted open-source platforms inside your own infrastructure that produce that evidence. Certification itself is always decided by an independent certification body.
How we scope
- We confirm which certifiable standard, guidance documents and sector extensions your customers or contracts actually require.
- Scope, deliverables and timelines are written down and agreed before any work starts, in a fixed-scope engagement.
- We map the systems, cloud accounts and data centers that fall inside the ISMS boundary so the scope matches your environment.
How we build
- We implement and configure the open-source platforms inside your own cloud accounts, data centers or air-gapped networks.
- We harden the systems and set up logging, access controls and backups so they can generate evidence for each Annex A control in scope.
- We test the configured systems with security testing where the written scope includes it, and record the results for your assessor.
How we hand over
- We document the configuration, operating procedures and evidence sources so your own staff can run and explain them.
- We prepare the evidence package and readiness material for your certification body, which decides what it accepts.
- We transfer administration, runbooks and documentation to your team, with the handover recorded as part of the written scope.
How we support
- Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement ends.
- A retainer can keep platforms patched and backed up, and keep evidence current through each surveillance and recertification audit.
- Ask us to confirm in writing which standards and platform changes the retainer covers before you sign.
