ISO 27001 consultancy
ISO 27001 certification, without the headache.
Practical ISO 27001 consultancy from a team that holds the certification itself. We help you scope, build and run an information security management system (ISMS) that passes audit and works day to day.
About the standard
The international standard for information security.
ISO/IEC 27001 sets out how to establish, run and continually improve an information security management system. The current version, ISO/IEC 27001:2022, includes 93 Annex A controls grouped into four themes: organisational, people, physical and technological.
Certification is awarded by an independent, accredited certification body after a two-stage audit, then maintained through surveillance audits over a three-year cycle. We prepare you for each step; the certification body carries out the audit.
- Gap analysis and scoping
- Risk assessment and Statement of Applicability
- Policies and procedures that fit how you work
- Internal audit
- Certification audit preparation
- Ongoing ISMS support or a vCISO
Our approach
Six steps to certification.
01 Gap analysis
Where you stand against the standard, and what needs doing.
02 Scope and risk assessment
Define your ISMS scope and assess the risks that matter.
03 Build the ISMS
Policies, procedures, controls and your Statement of Applicability.
04 Internal audit
An independent check that everything works before the auditors arrive.
05 Certification audit
Support through the Stage 1 and Stage 2 audits.
06 Continual improvement
Keep the ISMS working through surveillance audits and recertification.
Our customer contracts require us to comply with ISO 27001 and CyberQ just ticks all those boxes.
By the numbers
The threatin numbers.
39,790
Cyber Essentials certifications awarded in the year, plus 12,850 Cyber Essentials Plus
Source: NCSC Annual Review 2025
35%
of large UK businesses hold Cyber Essentials, up from 21%
48%
of large UK businesses formally review their immediate suppliers’ cyber risks
Why CyberQ Group
Expertise you can rely on.
CREST accredited
Independent testing to a standard recognised by government, regulators and insurers.
ISO 27001 certified
We hold ourselves to the same standard we help our clients achieve.
Globally resilient, 24/7/365
Teams in multiple locations, so cover never depends on a single site.
Birmingham HQ, five regions
Headquartered in Alpha Tower, supporting organisations across the UK, Europe, South Africa, the US and Asia.
Related services
Explore further.
Certification Support
Expert help to achieve Cyber Essentials and ISO 27001.
Explore →vCISO as a Service
Senior security leadership, without the cost of a full-time hire.
Explore →Cyber Maturity Assessment
A clear picture of where you stand and a prioritised roadmap.
Explore →Third-Party Supplier Risk Management
Understand and reduce the risk your suppliers bring.
Explore →
It depends on your size, scope and starting point. Organisations with good foundations move faster. AskQ’s ISO 27001 Readiness Check gives you an indicative view in two minutes.
A key ISO 27001 document that lists the Annex A controls, whether each applies to your organisation, and why. It links your risk assessment to the controls you implement.
No. Certification must be carried out by an independent, accredited certification body. We prepare you for the audit and support you through it.
ISO/IEC 27001:2022. The transition period from the 2013 version has ended, so new certifications are to the 2022 version.
AskQ ISO 27001 Readiness
How close are you to ISO 27001?
Seven questions, an instant readiness score and an indicative path to certification.
Get started
Talk to our team.
Book a call with a CyberQ specialist, or call us on 0800 0614 715. No obligation, no jargon.