02 / ISO 27001 READINESS
Build an information security management system your team can operate — with a clear path from gap assessment to independent certification audits.
Book a 30-minute callTHE STARTING POINT
For technology businesses pursuing ISO 27001 to meet customer requirements, enter procurement processes or bring structure to security as they grow.
We help define an information security management system (ISMS) that fits your organisation. If you already have SOC 2 controls or other security practices, we identify what can be reused and what still needs work.
The assessment considers ISO/IEC 27001:2022 requirements and the applicability of Annex A controls to your risks. A gap assessment does not replace an internal audit or certification audit. Penetration testing is scoped separately.
AFTER THE GAP ASSESSMENT
An evidence-based review of current practices against the agreed ISMS scope, with gaps, priorities and recommended actions.
THE DELIVERY PLAN
Sequenced workstreams, owners, dependencies and target milestones — based on your starting point and team availability.
THE WORKING CHECKLIST
Required ISMS documents, risk treatment and Statement of Applicability, with the supporting records to create or improve.
THE INVESTMENT DECISIONS
A scoped implementation proposal and recommended purchases or testing. Supplier quotes are confirmed separately; penetration testing is scoped separately.
These are gap assessment outputs. Implementation, tooling deployment and audit support follow under an agreed scope.
YOUR PATH TO READINESS
Understand your business, interested parties, services, locations and customer requirements. Agree the assessment scope.
Review governance, risks, controls and evidence. Present the gap assessment report and implementation roadmap.
Develop the agreed documentation, facilitate risk assessment and treatment, coordinate control improvements and help teams establish repeatable processes.
Coordinate an internal audit with appropriate objectivity and impartiality, support management review and track corrective actions before certification.
Help prepare for Stage 1 and Stage 2 audits, organise evidence and support responses and corrective actions requested by the independent certification body.
BROONAT supports readiness and implementation. An independent certification body performs the certification audits and decides whether to issue a certificate. Certification-body fees and any separately engaged internal auditor are outside our scope unless explicitly included.
HANDS-ON IMPLEMENTATION
When the roadmap calls for new security tooling, we can take it from requirements and budget planning through procurement, technical deployment and handover.
Define requirements, review your existing stack, compare suitable tools and recommend a budget and implementation plan.
Work with vendors on quotes and licensing, help arrange the purchase with your approval, and set up subscriptions under your organisation’s ownership.
Install, configure and integrate the agreed tools into your environment — such as endpoint protection, device management, identity and access management, or vulnerability management.
Check the agreed configuration and integrations, document the setup and walk your team through day-to-day operation. Ongoing administration can be scoped separately.
Tool selection, purchases and technical changes are agreed with you before execution. Implementation is separately scoped from the gap assessment and performed with authorised access. Licences and other third-party charges are budgeted separately from BROONAT’s service fees.
WHO DOES WHAT
BROONAT / DELIVERY OWNERSHIP
One point of contact to lead the agreed programme and keep it moving.
Review gaps, set priorities and maintain the delivery roadmap.
Draft ISMS documentation, facilitate risk workshops and prepare the Statement of Applicability.
Select tools, coordinate approved purchases, configure and integrate.
Organise collection, track actions and check readiness with control owners.
Coordinate requests, prepare your team and help address auditor questions.
YOUR TEAM / DECISIONS & ACCESS
Leadership approves priorities, policies and risk decisions. Your internal owners provide access and evidence, operate controls and participate in reviews.
We make the actions needed from your team clear. Your organisation remains responsible for its controls.
INDEPENDENT ASSURANCE
An independent certification body performs the certification audits and decides whether to issue a certificate. Internal audit arrangements preserve objectivity and impartiality.
BROONAT supports preparation and audit coordination; assurance decisions remain independent.
PLANNING AHEAD
The agreed engagement can include an ISMS scope, risk register, treatment plan, Statement of Applicability, policies, control procedures and evidence records — developed around how your organisation actually works.
The schedule depends on your existing practices, scope, available people and certification-body availability. After assessment, we agree milestones and identify what can run in parallel. Certification is not guaranteed by a target date.
Ongoing vCISO support can help maintain the risk register, review controls, coordinate internal reviews and prepare for surveillance audits. This is agreed as a separate scope.
YOUR NEXT MOVE
Tell us why you’re pursuing certification, your current security practices and any customer deadlines. We’ll help scope a practical starting point.
Book a 30-minute callScope, timing and fees agreed before work begins.
