Building an ISMS to ISO 27001
SMEs and service providers required by customers, NIS2 or TISAX to have structured information security, or that want to get certified.
Updated: 2026-11
An ISO 27001 ISMS is the solid foundation for NIS2, TISAX, customer requirements and possible certification. We build it to fit your company: scope, risk assessment, statement of applicability, policies, responsibilities and internal audit. The certification audit is carried out by an accredited body.
Many companies have individual security measures but no system holding them together. When a customer asks about the ISMS or NIS2 requires risk management, scope, risk assessment and evidence are missing.
An ISMS does not have to be heavy. What matters is that it fits the actual risks and is lived day to day, rather than sitting in a binder.
What you get
Scope and context
Defined scope, interested parties and requirements the ISMS must meet.
Risk assessment and treatment
Method, risk register and treatment plan aligned with your systems and processes.
Statement of applicability
Reasoned selection of controls from Annex A of the standard.
Policies and roles
Lean policies and clear responsibilities instead of extensive manuals.
Internal audit and management review
Preparation and execution of the first internal audit and the management review.
How it runs
- 01
Baseline
Existing measures, customer and legal requirements, scope.
- 02
Risks
Carry out the risk assessment, select controls, write the statement of applicability.
- 03
Rollout
Introduce policies, processes and responsibilities, train staff.
- 04
Review
Internal audit, management review and, on request, support during the certification audit.
Price framing
Depends on scope, locations and starting point; built in stages with fixed scope per stage.
Indicative, not a binding quote — the frame is confirmed during scoping.
Parent service: Cyber readiness & IT security
FAQ
Do you certify us to ISO 27001?
No. Only an accredited certification body may certify. We build the ISMS and prepare you for the audit.
How long does it take?
For an SME with a clear scope, usually a few months, depending on the starting point and team availability.
Does an ISMS cover NIS2 duties?
A large part of the risk management duties. Registration, statutory reporting channels and management duties come on top.
Building an ISMS to ISO 27001
SMEs and service providers required by customers, NIS2 or TISAX to have structured information security, or that want to get certified.