Advisory

ISO 27001 Compliance & Audits

Implement, certify and maintain ISO 27001, from initial scope through the full three-year cycle.

Certified once. Maintained for three years.

ISO 27001:2022 sets up an Information Security Management System (ISMS) that aligns people, policies, processes and technology around risk. We deliver the lifecycle: scoping, risk assessment, Annex A control selection (93 controls across four themes), the Statement of Applicability, internal audits, certification support and annual surveillance through the three-year cycle. We've led ISMS implementations across government, financial services, healthcare and SaaS, landing the certificate first time instead of an 18-month drift. We map controls to Essential Eight, APRA CPS 234, SOCI Act and PCI DSS at once, so evidence works across multiple audits.

ISO 27001 Compliance & Audits

ISO/IEC 27001:2022 with Amendment 1:2024.

ISO/IEC 27001:2022 is the current edition. Amendment 1:2024 adds climate action to the rules on your context and the needs of interested parties. You must decide whether climate change is relevant to your ISMS, and whether the people with a stake in it have needs linked to climate.

Clauses 4 to 10 are still the core of what you are certified against. Annex A is a list to choose from: you pick the controls your own risk calls for. The Statement of Applicability records which controls you need, why each is in or out, and how far each is in place.

  • 37 organisational controls - Annex A.5

    These cover governance, policy, roles, suppliers, cloud services, incidents, continuity and compliance.

  • 8 people controls - Annex A.6

    These cover screening, terms of work, awareness, the disciplinary process and remote work.

  • 14 physical controls - Annex A.7

    These cover site boundaries, secure areas, equipment, media, utilities, monitoring and safe disposal.

  • 34 technological controls - Annex A.8

    These cover identity, access, endpoints, cryptography, networks, development, logging, monitoring and resilience.

Why our ISMS engagements land first time.

10-step methodology

A structured path from scope definition to registration. We've run it hundreds of times; you're running it once, so there's no guesswork and no first-timer blind spots.

2022 revision-ready

We align with the 93-control Annex A structure - Organisational, People, Physical and Technological themes - not legacy 2013 thinking.

Multi-framework mapping

We map controls to Essential Eight, APRA CPS 234, SOCI Act and PCI DSS, so one evidence pack satisfies multiple audits.

Multi-year retention

We run surveillance and tune the ISMS across all three years of the cycle - not just implementation, then handover.

From scope to certificate in six stages.

  1. Step 1: Scope & context

    Set the ISMS scope, interested parties, legal and regulatory context, and security objectives (clauses 4 and 5).

  2. Step 2: Risk assessment

    Asset-threat-vulnerability modelling against agreed risk criteria, with a risk register and treatment plan (clause 6).

  3. Step 3: Control selection

    Annex A mapping, Statement of Applicability and control-treatment plan for all 93 controls.

  4. Step 4: Implementation

    Control deployment, policy library, staff training and evidence collection across the ISMS (clauses 7 and 8).

  5. Step 5: Audit & review

    Internal audit program execution, management review and corrective action tracking (clauses 9 and 10).

  6. Step 6: Certify & maintain

    Stage 1 / Stage 2 certification by an accredited body, then annual surveillance audits through the 3-year cycle.

Full-lifecycle ISO 27001 services.

ISMS implementation

We define scope, analyse context and risk methodology, then design controls and build the Statement of Applicability - a 10-step process.

Certification support

Stage 1 and Stage 2 readiness checks, mock audits and certification body liaison, through to certificate issuance.

Annual audits

We deliver the internal audit program against clause 9.2, plus readiness checks for the external surveillance audit.

Risk assessment

We model assets, threats and vulnerabilities to drive control selection, reviewed annually as the standard requires.

Control implementation

Technical and administrative control design across all 93 Annex A controls with remediation roadmaps.

Ongoing ISMS consultation

We keep documentation updated, run management reviews, tune incident response and report KPIs, as your business changes between certification cycles.

What a well-run ISMS actually does.

Risk-aligned control design

Controls selected against your actual risk assessment, not a copy-paste register. The Annex A Statement of Applicability holds up at Stage 2.

Documentation library

Policies, procedures, evidence templates and records, structured for auditor review - not a 200-page PDF dump.

Executive sponsor enablement

Board-facing narrative, ISMS charter and annual management-review support, so executive engagement is real, not theatre.

Staff training program

Security awareness, role-specific training and tabletop exercises for key staff, as clauses 7.2 and 7.3 require.

Internal audit program

Annual internal audit schedule, findings log and corrective action tracking, aligned to clause 9.2.

Multi-framework reuse

Evidence mapped once, reused for PCI DSS, APRA CPS 234, Essential Eight, SOCI Act and customer due-diligence questionnaires.

Proof you'll have in your hand.

  • You get an ISO 27001:2022 certificate, issued by an accredited certification body.

  • ISMS aligned to your actual risk profile, not a template control library

  • You get an Annex A Statement of Applicability that holds up at Stage 2 audit.

  • You get an evidence library, reusable across APRA CPS 234, Essential 8, PCI DSS and SOCI Act audits.

  • You get surveillance audit clearance across all three years of the certification cycle.

2022
Standard version
93
Annex A controls
3 yrs
Certification cycle
Annual
Surveillance audits

ISMS credentials on our team.

ISO 27001 Lead Auditor ISO 27001 Lead Implementer CISSP CISM CRISC IRAP CREST ISO 27001 Lead Auditor ISO 27001 Lead Implementer CISSP CISM CRISC IRAP CREST

ISO 27001 questions, quickly answered.

What's the difference between the 2013 and 2022 revision?

The 2022 revision cuts Annex A from 114 controls across 14 domains to 93, across four themes: Organisational, People, Physical, Technological. New controls cover threat intelligence, cloud security, ICT readiness for business continuity, data leakage prevention and more. Existing 2013 certifications transition by October 2025.

How long does certification take from start to finish?

A typical ISMS build runs 6-9 months, from kick-off to Stage 2 audit. Mature organisations with existing controls need 4-6 months. Surveillance audits run annually for the three-year cycle.

Do we need a dedicated security team before we start?

No, but you need an accountable executive sponsor and a named ISMS owner. We bring the security expertise. The accountability has to stay with you.

What happens at Stage 1 vs Stage 2?

Stage 1 is a documentation review. The certification body checks your ISMS paperwork is complete and defensible. Stage 2 is an operational audit. They check the ISMS is actually being followed, with evidence from the last 3-6 months.

How does surveillance work across the 3-year cycle?

Annual surveillance audits check a subset of controls - roughly a third each year - plus any high-risk or changed areas. A recertification audit happens in year 3. Findings must be closed, or the certificate can be withdrawn.

Can the same evidence be used for other audits?

Yes - that's a big reason customers run ISO 27001 in the first place. We map controls to Essential 8, APRA CPS 234, SOCI Act and PCI DSS at once, so one piece of evidence often satisfies four different auditors.

Who issues the actual certification - Vectra or someone else?

A separate accredited certification body issues the certificate - JAS-ANZ or IAF accredited. We implement the ISMS and support you through their audit. We're not the certifier, which keeps things genuinely independent.

Start with a conversation.

Speak to us about your cyber governance and compliance requirements.

Send us a message

What can we help with?

A sentence or two is plenty. We'll ask for detail when we reply.