ISO 27001 and other standards
ISO consulting for SMBs
We take you from the first meeting to the audit, and we stay after: eight phases, concrete deliverables and the Nelmos platform to keep your ISMS alive for every surveillance audit and recertification.
ISO
27001
CERTIFIABLE
CYBERSECURITY, THE STEP BEFORE
You need to be protected before you certify. We review your company real-world security as a step before, and alongside, certification.
Exposed attack surface
What of your company is visible from the outside — domains, services, open ports — so we can close what shouldn't be there.
Access control and passwords
Who can get into what, with which permissions and which passwords. The first door that needs to be shut properly.
Backups and recovery
That they exist, that they get tested, and that you know how long recovery would take if something fails.
Basic team training
The weakest link is usually human: phishing, shared passwords, unencrypted files. Practical training, not a one-hour talk.
Incident response
A clear plan for what to do, who to notify and how to contain the problem when something happens.
HOW THE STANDARD IS STRUCTURED
ISO 27001 is made of two blocks: ten clauses and Annex A. Knowing what each block asks for is the first step to implementing it well.
The ten clauses
The first three clauses introduce the standard: scope, references and terms. They are not audited.
From the fourth onwards they are the mandatory requirements that get audited. They start with understanding the context of the organisation and continue with leadership, planning, support, operation, evaluation and improvement.
Tap a clause to see what it asks for.
Annex A
93
reference controls assessed one by one.
The controls are grouped into 4 themes.
Organisational · 37
People · 8
Physical · 14
Technological · 34
Not every control applies to every organisation: each one decides in its Statement of Applicability which controls apply and why, and which procedures it needs to implement them.
Excluding a control requires a justification. You cannot leave out one that your risk assessment says you need.
We guide you through every step, from defining the context to the audit.
Talk to a consultantTHE EIGHT PHASES
This is what a company goes through from the first meeting to a living ISMS. Every phase closes with a document on the table; from phase 05 on, the cycle repeats every year.
- 01
Phase 01
Initial briefing
We assess the real state of your security: which formats, which guidance and which models are already in place. That produces the starting diagnosis.
What you get
Initial diagnosis report
Gap analysis
Preliminary scope and process maturity
Current coverage against the standard
sample
Governance and policies
35%
Access control
60%
Continuity
20%
- 02
Phase 02
Defining scope and context
We define which processes are in. Context is clause 4 of the standard, the first auditable requirement: instead of tackling the whole company at once, you work through it process by process.
What you get
Scope document
Context and interested parties
Map of the processes assessed
What goes into the management system
In scope
Sites
Services
Data
Suppliers
Out of scope
R&D projects
- 03
Phase 03
Risk management and Statement of Applicability
The information assets are inventoried and, on top of them, their threats and vulnerabilities. With that you go down Annex A control by control.
What you get
Information asset inventory
Scored risk assessment
Statement of Applicability (SoA)
Risk matrix
sample
Impact
Likelihood
Treated risk
- 04
Phase 04
Documenting and implementing the controls
Each control is documented so it can be implemented: access, incidents, backups. None of them exists for its own sake: the risk that justifies it was identified first.
What you get
ISMS policies
Procedures and internal rules
Evidence for every control in place
Statement of applicability
A.5.7 Threat intelligence
Applies
A.6.3 Awareness
Applies
A.8.16 Monitoring
Applies
A.7.4 Physical monitoring
Not applicable · justified
- 05
Phase 05
Internal audit
The standard requires it. It assesses how the company responds to failures and nonconformities before a third party does.
What you get
Internal audit plan
Internal audit report
Nonconformities and corrective actions
After the internal audit
sample
0%
Conformity
Nonconformities raised and closed before the external auditor arrives.
- 06
Phase 06
Management review
Management reviews the system and signs it off. A formal sign-off, required by the standard.
What you get
Management review minutes
Decisions and resources approved
Improvement actions opened
Management review minutes
Internal audit results
Nonconformities and corrective actions
ISMS objectives and resources
Management
APPROVED
A requirement of the standard: management reviews the system and signs off on the record.
- 07
Phase 07
Certification audit
The audit itself, with the external auditor. We stand with you through stage 1 and stage 2 until the findings are closed.
What you get
Support through stage 1 and stage 2
Findings closed out
ISO 27001 certificate
Certification audit
ISO 27001
CERTIFIED
Stage 1 (documentation) + stage 2 (on site) with the certification body.
- 08
Phase 08
ISMS maintenance
The certificate does not close the work: with the Nelmos platform and our hands-on support, the ISMS stays alive day to day — risks, incidents, training, evidence — ready for the surveillance audit every year and recertification every 3.
What you get
Platform for ongoing ISMS management
Risk, incident and review-minutes register
Control evidence ready for every audit
ISMS maintenance platform
Risk and incident register
Review minutes and training
Control evidence kept current
Running, never stops
A living ISMS, not a PDF shown off once a year.
↻ Loops back to phase 05 (surveillance audit) every year · full recertification every 3 years
WHO DELIVERS IT
The team running your project has already implemented ISO 27001 in a real organisation: we know where it hurts before we get there.
We support you preparing for and passing certification. The certification audit is signed by an accredited, independent body — not by Nelmos.
We cover ISO 27001 and other standards your clients or public administration ask for.
Frequently asked questions
Phase 00 · the starting point
LET'S START WITH THE DIAGNOSIS
45 minutes with you and we tell you, with no strings attached, where you stand and how much real work there is until the certificate. Then we send you a fixed quote.
45 minutes on a video call
A real picture of where you stand
A tailored quote after the call
M
T
W
T
F
S
S
Pick a day first