Build an ISMS that can be operated and evidenced—not a document set that only exists for the audit.
The examples below are illustrative advisory outputs and do not represent a specific client.
Business scope, interested parties, dependencies, interfaces, and governance boundaries.
Repeatable risk criteria, risk register, treatment decisions, owners, and residual risk.
Control-by-control ownership, required evidence, current status, and remediation priority.
Critical gaps, pre-audit actions, internal audit dependencies, and management decisions.
Confirm ISMS boundaries, context, risk method, obligations, and control applicability.
Assign owners, close control gaps, and establish repeatable evidence.
Prepare internal audit, management review, corrective action, and certification evidence.
It depends on scope, current maturity, resource availability, and evidence quality. A readiness assessment should precede a target audit date rather than forcing the program into an arbitrary timeline.
No. Certification is performed by an accredited certification body. Advisory work prepares the ISMS, evidence, and governance for that independent audit.