ISMS readiness and maintenance
ISO 27001 readiness built around your real business
TSC Security helps companies define and operate an ISO 27001-aligned information security management system. Your leadership retains responsibility for the ISMS and its risk decisions while we support readiness and implementation. An accredited certification body conducts the certification audit and issues any certificate.
Who this helps
- Global SaaS and cloud companies
- Companies responding to international customer requirements
- Organizations formalizing risk governance
- Teams maintaining an existing ISMS
Problems it addresses
- ISMS scope is too broad or unclear
- Risk treatment is disconnected from operations
- The Statement of Applicability lacks support
- Internal audit and management review are not established
- Corrective actions do not have accountable owners
What the work includes
ISMS scope and context
Define boundaries, interested parties, business context, and information security objectives.
Risk and applicability
Build the risk assessment, treatment plan, and Statement of Applicability.
Policies and documented processes
Document policies and processes that match actual business practices.
Control operation and evidence
Put agreed controls into operation and maintain evidence for the ISMS.
ISO 27001 internal audit
Clause 9.2 internal audits led by qualified ISO 27001 internal auditors, including at least one with no involvement in your program beyond the audit.
Certification preparation and maintenance
Prepare management review materials with your leadership, coordinate corrective actions and the certification body, and support recurring ISMS operation.
Expected outcomes
A clear and maintainable ISMS
Risk treatment connected to business priorities
Evidence for internal and certification audits
Corrective actions and program reviews with named owners
How the engagement works
Define scope
Establish the ISMS boundary and organizational context.
Assess risk
Identify, evaluate, and plan treatment for information security risks with your risk owners.
Implement the ISMS
Put policies, controls, evidence, and governance into operation.
Review
Perform a clause 9.2 internal audit with a qualified auditor outside the delivery team, then prepare management review materials for your leadership.
Coordinate certification
Coordinate the certification audit and follow corrective actions through to closure.
Maintain
Operate and improve the ISMS across the certification cycle.
Frequently asked questions
Does TSC Security issue ISO 27001 certificates?
No. An accredited certification body conducts the certification audit and issues the certificate. TSC Security supports readiness, implementation, coordination, and ongoing maintenance.
What is the Statement of Applicability, and who approves it?
It records which Annex A controls apply, why any are excluded, and their implementation status. TSC Security can prepare it; your organization reviews and approves its scope and risk treatment.
Do we need to create new processes for ISO 27001?
Not necessarily. Existing processes can support the ISMS when they meet the requirements and are documented and operated consistently. The goal is to fit the system to how the business works, not create duplicate paperwork.
Can TSC Security perform our internal audit if it helped implement our controls?
Yes. ISO 27001 requires internal auditors to be objective and not audit their own work, and the audit can be performed by an outside party. Each internal audit includes at least one qualified auditor with no involvement in your program beyond the audit. Your certification body still performs the certification audit.
Need security leadership and execution without building a full internal team?
Tell us what is driving the work. We will help identify the engagement model that fits your company.
Book a security strategy call