Compliance · ISO 27001
ISO 27001 readiness for growing businesses
We help you build and run an information security management system that stands up to a certification audit: gap analysis, risk assessment, policies, technical controls and the evidence to show they work.
What it is
A management system, not just a checklist
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current edition was published in 2022.
It asks you to understand your information risks, decide how to treat them and keep improving. The core requirements cover context, leadership, risk assessment, operation, monitoring, internal audit and management review. Annex A lists reference controls, grouped into organisational, people, physical and technological themes, which you select based on your risks and record in a Statement of Applicability.
Certification is carried out by an independent certification body. In the UK, many organisations choose one accredited by UKAS.
- Risk-based: controls are chosen for your business, not applied blindly
- Certification audit in two stages, then regular surveillance audits
- Recognised internationally by customers and procurement teams
How we help
The work behind a successful audit
We work alongside the person who owns information security in your business, so the system is yours and you can run it after we step back.
Gap analysis
A structured review against the standard’s requirements and Annex A, so you know what already exists, what is missing and how big the job is.
Scope and risk assessment
We help you set a sensible scope, build an asset and risk register and decide how each risk will be treated.
Policies and Statement of Applicability
Practical, right-sized policies written for how your business actually works, and a Statement of Applicability that explains every control decision.
Technical controls
Our engineers implement the technical side: access control, multi-factor authentication, encryption, logging, backups, patching and secure configuration.
Evidence and internal audit
Records, reports and reviews that show the ISMS is operating, plus help preparing for your internal audit and management review.
Ongoing ISMS support
After certification we help keep risk registers, access reviews and evidence current between surveillance audits.
The route to certification
Five stages to audit-ready
Timescales depend on your scope and starting point. We give you a realistic plan after the gap analysis.
Step 1: Gap analysis
Where you are today against the standard, with a prioritised action plan.
Step 2: Plan and scope
Agree the ISMS scope, owners and risk method, and choose a certification body.
Step 3: Implement
Put the policies, processes and technical controls in place, starting with the highest risks.
Step 4: Operate and review
Run the ISMS long enough to produce evidence, then complete an internal audit and management review.
Step 5: Certification audit
Your certification body carries out the stage 1 and stage 2 audits. We are on hand to support your team.
Our own position
Why we say aligned, not certified
Denwen Technology runs its own business to the ISO 27001 framework: we assess risks, control access, check our suppliers and review how we work. We are not certified, because certification requires an external audit that we have not yet undertaken.
We think it matters to be precise about this. When you are preparing for ISO 27001, you need advisers who describe standards accurately, and our own practices are set out in our trust centre.
FAQ
ISO 27001 questions
This page is general information, not legal advice. Requirements change, so we always work from the current published version of a scheme or regulation, and alongside your legal adviser or data protection lead where the law is involved.
Free IT & security review
Find out where your IT is exposed — in 30 minutes
A senior engineer reviews your setup, security and backups, then gives you a plain-English action list. No obligation, no hard sell.