Goal: define ISMS boundaries and identify what needs to be built.

Define ISMS scope, boundaries, and interfaces with organisational context and interested parties.

Conduct gap analysis against ISO 27001:2022 Clauses 4–10 and Annex A controls.

Assess current policies, procedures, risk practices, and evidence collection.

Build the Statement of Applicability (SoA) with justifications for included/excluded controls.

Create a certification roadmap with priorities, owners, and dependencies.

Goal: implement your ISMS and Annex A controls.

Establish ISMS processes for context, leadership, planning, support, and operation.

Implement technical controls (e.g., access management, cryptography, operations and communications security, SDLC).

Implement organisational controls (e.g., policies, asset management, HR security, suppliers, incident, continuity, compliance).

Deploy automated evidence collection integrated with Microsoft 365, Azure, AWS, or other environments.

Create documentation: information security policy, risk methodology, SoA, internal audit, corrective action, management review, and operational procedures.

Goal: prove the ISMS works and close gaps before certification.

Role-based enablement for ISMS owners, control operators, and leadership (competence and awareness).

Conduct internal audits against ISO 27001:2022; document findings and nonconformities.

Gather operation evidence for all processes and controls; ensure documentation is complete and retrievable.

Run the management review covering performance, audit results, risks, and improvements.

Execute a remediation sprint to close nonconformities and implement corrective actions.

Goal: complete certification and establish ongoing maintenance.

Select and engage an accredited certification body; manage logistics and document submission.

Support Stage 1 readiness (document review) and address observations.

Prepare for Stage 2 (implementation audit) with final evidence reviews, team briefings, and audit coordination.

Provide Stage 2 support on-site and manage findings and corrective actions.

Post-certification: set the surveillance calendar, continuous monitoring, improvement cadence, and change management.