ISO 27001: your ISMS, built to pass the audit
We build your information security management system to ISO/IEC 27001:2022, support you through to certification and keep it alive afterwards. Pragmatic, prioritised by risk and run on a GRC platform instead of Excel lists.
What makes an ISMS under ISO 27001
ISO/IEC 27001 is the internationally recognised standard for information security management systems. It requires you to assess your risks systematically, select suitable controls, measure their effectiveness and improve the system continuously.
The 2022 version contains 93 controls in Annex A, grouped into organisational, people, physical and technological controls. New topics include threat intelligence, cloud security, data leakage prevention and secure development.
A certification is valid for three years, with annual surveillance audits. For many customers, tenders and insurers, it is the proof that you put information security into practice.
How we implement it with you
Scope & Gap
1–2 weeksContext, interested parties, scope and gap analysis against the standard.
Risk & SoA
2–4 weeksRisk assessment, treatment plan and Statement of Applicability.
- Risk register
- SoA with justifications
Implementation
project-basedPolicies, processes and technical controls, aligned with your systems.
- Policy set
- Training
Audit & certification
4–8 weeksInternal audit, management review and support during the Stage 1 and Stage 2 audits.
What you have at the end
Frequently asked questions
How long does an ISO 27001 implementation take?
For an SME, we typically expect four to nine months until you are ready for certification, depending on scope and starting point.
What does an ISO 27001 implementation cost?
That depends on size, scope and maturity. We estimate effort and budget in the initial consultation. For ongoing operation, Swiss GRC Hosting is available from CHF 5'990.– / year.
Can you also certify us?
No. Only an accredited certification body may issue a certificate. We prepare you and support you through the audits, so that your independence is preserved.
We still have an ISO 27001:2013 certificate. What now?
The transition period to the 2022 version ended on 31 October 2025. If your certificate has not yet been transitioned, we review the gap to the new version with you.
Where do you stand today?
In a free initial consultation, we clarify your scope and the next three steps.