Identify what the business needs to protect
Understand relevant information, services, obligations and interested parties before setting security requirements.
01 / The Service
An ISMS Built Around Your Real Business Risks
An information security management system sets the governance, processes and assurance activities through which an organisation manages the confidentiality, integrity and availability of its information.
Make risk treatment explainable
Use structured assessments to choose proportionate measures, agree risk ownership and document decisions.
Operate and improve the controls
Turn written intentions into assigned work, regular review and evidence that reflects the real environment.
2-sec's role is consultancy, implementation support and certification readiness; certification decisions are made independently by a certification body.
02 / What 2-sec Can Deliver
From Initial Gap Analysis to Ongoing ISMS Improvement
Start with the support you need now, or coordinate the wider implementation programme from scope definition through certification readiness.
Gap analysis
Assess the current management system, implemented controls, evidence and areas needing attention before certification
ISMS scope and governance
Establish boundaries, leadership responsibilities, policies, stakeholder requirements and ISMS objectives
Information security risk assessment
Define risk criteria, identify and evaluate risks, and connect treatment to business priorities
Statement of Applicability
Explain selected and excluded Annex A controls, their justification and implementation status
Control implementation
Work alongside teams to improve controls, processes, configurations and security responsibilities
Policies and documentation
Create clear, usable documented information and records demonstrating how the ISMS operates
Staff awareness
Support security competence and awareness across relevant staff and management
Internal audit and management review
Evaluate the ISMS and prepare decision-quality evidence for leadership review
Certification readiness
Review gaps, evidence and corrective actions ahead of independent certification assessment
Ongoing ISMS support
Maintain risk reviews, internal audits, supplier oversight, control effectiveness and continual improvement
03 / The Management System
Security Is a Management System Not a Policy Folder
ISO 27001 expects leadership direction, a defined ISMS, risk-based controls, competence, performance monitoring and documented improvement. The challenge is connecting those moving parts into a working operating model.
01 Who makes risk and security decisions?
02 What controls are necessary and why?
03 How do we know those controls remain effective?
The management system should follow how the business actually operates rather than creating a parallel compliance bureaucracy.
DIRECTIONLeadership and Scope
Business context, interested parties, objectives and resources.
OPERATIONSRisk and Controls
Treatment decisions, accountable owners and real safeguards.
ASSURANCEReview and Improve
Internal audit, monitoring, management review and corrective action.
04 / The Implementation Journey
Six Phases From Business Context to Certification Readiness
A risk-based approach helps prevent the common mistake of implementing every possible security control before understanding the organisation's actual exposure and responsibilities.
01
Set scope and secure leadership support
Define the services, assets, processes, sites and boundaries of the proposed ISMS; agree objectives, authority and resources
THE DECISIONWhat must this ISMS cover?Working output: Approved scope and leadership roles
02
Understand risk and interested parties
Identify legal, regulatory, contractual and business expectations; establish risk criteria and assess information security risks
THE DECISIONWhich risks need treatment?Working output: Risk assessment and treatment priorities
03
Select controls and document applicability
Choose controls to treat risk, compare against Annex A and record inclusion, exclusion, justification and status in the Statement of Applicability
THE DECISIONWhy is each control needed?Working output: Statement of Applicability
04
Implement the management system
Establish policies, skills, procedures, safeguards, evidence collection and day-to-day control ownership
THE DECISIONDo the controls actually work?Working output: Operating processes and evidence
05
Audit and review performance
Perform internal audits, monitor measures, address nonconformities and undertake management review
THE DECISIONWhat needs correction before an external audit?Working output: Internal audit findings and management actions
06
Prepare for independent certification
Address readiness gaps and support the organisation through certification body Stage 1 and Stage 2 processes
THE DECISIONCan the ISMS demonstrate conformity?Working output: Evidence and corrective action tracking
The sequence is illustrative. Actual certification arrangements, deliverables and durations depend on scope and the independent certification body's requirements.
05 / Risk and Control Applicability
The Statement of Applicability Connects Risk to Control Decisions
The Statement of Applicability is not simply a list of controls. It records which controls are necessary, why they are included or excluded and whether they have been implemented.
2-sec / ISMS CONTROL MODELILLUSTRATIVE STATEMENT OF APPLICABILITY
RISK AND TREATMENT
CONTROL DECISION
OPERATING EVIDENCE
Information accessConfidentiality risk
Access controlJustified and selected
Owner assignedEvidence maintained
Service interruptionAvailability risk
Continuity measuresRisk treatment mapped
Testing recordsReview scheduled
Supplier accessThird-party risk
Supplier governanceResponsibility documented
Assurance reviewEvidence tracked
Demonstrative structure only · Control selection is specific to the organisation
Organisational controls
Governance, policies, suppliers, incidents and information managementThe first Annex A theme includes organisational responsibilities and operating practices.
People controls
Screening, awareness, terms of employment and reporting responsibilitiesSecurity is shaped by the knowledge, access and behaviour of people.
Physical controls
Facilities, equipment, environmental protection and secure areasPhysical safeguards still matter where information and equipment are located.
Technological controls
Identities, devices, logging, secure development and operational securityTechnical measures must reflect assessed risk and supported operation.
06 / ISMS Evidence01 02 03 04 05
Documentation That Supports Real Decisions and Real Audits
The goal is an information security management system your teams can operate and demonstrate, not a binder that looks convincing until someone asks for evidence.
ISMS scope and objectives
Defined boundaries, interested-party requirements, leadership responsibilities and information security objectives.
Information security risk assessment
Methodology, criteria, risk decisions, assigned treatment actions and owners.
Statement of Applicability
Selected controls, their rationale, implementation status and justified exclusions.
Policies and operating evidence
Documented information linked to practical processes, people and technical controls.
Internal audit and corrective action
Audit findings, management review records, monitoring and improvement activities.
Specific deliverables depend on the agreed consulting scope and existing ISMS maturity.
2-sec / ISMS
ILLUSTRATIVE ISMS WORKSPACEInformation Security
Information Security
Management System
01Scope and interested parties
02Risk assessment and treatment
03Statement of Applicability
04Audit and management review
Conceptual report · Not actual customer data
07 / Leadership and Ownership01 02 03 04
An ISMS That Has Owners Beyond the Security Team
ISO 27001 requires more than security specialists. Decisions, resources, responsibilities and improvement work cross leadership, IT, operations, HR, procurement and business functions.
Leadership and risk owners
Set the scope, approve objectives, allocate resources and make risk treatment decisions.
IT and security teams
Implement safeguards, measure effectiveness and maintain evidence.
People and business operations
Maintain awareness, processes, access responsibilities and incident reporting.
Suppliers and assurance stakeholders
Clarify contractual security obligations, shared controls and assessment needs.
2-secISMS MANAGEMENT REVIEW / CONCEPT
EXECUTIVE SECURITY GOVERNANCEDecisions
Decisions
with owners
01Risk ownersAccountability assignedTRACKED
02Control statusEvidence availableTRACKED
03Audit actionsCorrective work trackedTRACKED
04Management reviewDecisions recordedTRACKED
08 / Engagement FitSTARTING THE JOURNEY IMPLEMENTING CONTROLS MAINTAINING CERTIFICATION
The Right Support Depends on Your ISMS Maturity
Whether you're starting from scratch, preparing for an external audit or maintaining an existing certificate, the work should fit the decisions and gaps in front of you.
ISMS gap and readiness review
Understand the current state, choose an appropriate ISMS scope and define the work ahead.
ISMS development and implementation
Build the management processes, evidence and risk treatment programme with accountable teams.
Audit and ongoing advisory
Support internal audits, corrective actions, management review and continual improvement.
09 / Why 2-secRISK-BASED CONSULTING IMPLEMENTATION SUPPORT ASSURANCE AND IMPROVEMENT
Security Consultancy That Makes the Management System Work
2-sec's existing ISO 27001 practice describes top-down, risk-based work with leadership, control implementation, documentation, internal audit and ongoing support, backed by wider technical security expertise.
Begin with business context
Define objectives and risk before selecting controls or producing documentation.
Help teams make changes
Bring the risk treatment plan into operating processes, roles and technical measures.
Prepare beyond the first audit
Support internal review, corrective action and the ongoing management system cycle.
The independent certification body determines certification outcomes. Consultant qualifications and customer claims should be verified before publication.
10 / Buyer Questions
What to Know Before Implementing ISO 27001
These answers help distinguish a working ISMS from a paperwork exercise and clarify how independent certification fits the process.
What is ISO 27001?
ISO/IEC 27001 is an international standard specifying requirements for establishing, implementing, maintaining and continually improving an information security management system, or ISMS.
What is the current ISO 27001 version?
The current published edition is ISO/IEC 27001:2022, with Amendment 1:2024 covering consideration of climate change in the organisation's context and relevant interested-party requirements.
Does ISO 27001 require every Annex A control?
No. Annex A contains 93 reference controls organised into four themes. Necessary controls are determined through risk treatment and compared against Annex A; exclusions require justification in the Statement of Applicability.
What is a Statement of Applicability?
It records the controls the organisation has determined necessary, the reasons for including them, their implementation status and justification for excluding Annex A controls.
What is the difference between ISO 27001 consulting and certification?
A consultant helps establish and improve an ISMS and prepare for assessment. An independent certification body assesses conformity and makes the certification decision.
What happens during Stage 1 and Stage 2?
Stage 1 examines ISMS documentation and readiness. Stage 2 evaluates implementation and effectiveness of the management system against the requirements within the agreed certification scope.
How long is an ISO 27001 certificate valid?
Accredited certification normally operates on a three-year cycle with periodic surveillance audits and recertification, provided the certification body maintains the organisation's certification.
How long does ISO 27001 implementation take?
It depends on the organisation's size, existing controls, scope, risk profile and the maturity of its management processes. An assessment of the current state is the starting point for a reliable plan.
Is ISO 27001 the same as Cyber Essentials?
No. ISO/IEC 27001 is a risk-based management system standard covering information security governance. Cyber Essentials assesses a defined baseline of five technical controls. They can complement one another.
Does ISO 27001 certification guarantee there will be no cyber incidents?
No. Certification concerns the ISMS within its certified scope and does not guarantee the absence of breaches, vulnerabilities or future incidents.
11 / Your Next Move
Build an ISO 27001 Programme Your Business Can Operate
Tell us where your ISMS stands, what certification or customer requirements you're working towards and which risks and responsibilities need clarification. We'll discuss the most useful next step.
Prefer to talk first? Call the 2-sec team using the number above.