ISO/IEC 27001 Readiness
ISMS scoping, risk assessment, Statement of Applicability, Annex A controls and certification audit preparation.
- Covers
- ISMS scopingRisk assessmentStatement of ApplicabilityAnnex A controlsInternal auditAudit support
- How we work
- Consultation → Gap assessment → Risk & SoA → Implement → Internal audit → Certification audit
The certificate is a requirement or scoring point. Our fix: A scoped plan that focuses on what certification really requires.
See the common problemsThe risk register and Statement of Applicability never get finished. Our fix: A facilitated method, a working register and a justified SoA.
See the common problemsClauses, Annex A, the Statement of Applicability and how certification works.
Read the essentialsAnswer 12 quick yes/no questions based on ISO/IEC 27001 requirements. Get an indicative score and your top gaps.
Try the ISO 27001 readiness checkAnswer a few quick questions and a Skylius specialist will prepare practical recommendations.
Request a consultationISO/IEC 27001, ready for your certification audit.
We help you build an information security management system (ISMS) that meets ISO/IEC 27001: scope, risk assessment, Statement of Applicability, policies and Annex A controls. Then we prepare you for the certification audit by the accredited certification body you choose.
Take the 2-minute ISO 27001 readiness check →
Who it is for
Asked for ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system. Certification is voluntary, but clients, tenders and partners increasingly ask for it.
Companies bidding on tenders
Tenders and enterprise clients that list ISO/IEC 27001 certification as a requirement or a scoring point.
Certification often requiredCloud, SaaS & IT service providers
Providers that host, process or manage client data and need to show a recognised security system.
Client assuranceGrowing organisations
Companies that want security managed as a system, with owners, risks and reviews, not ad-hoc fixes.
Structured securityAlready working on NCA or Aramco CCC
Organisations with national controls in progress that want one management system covering several frameworks.
Shared controlsSound familiar?
Why ISO projects stall.
A tender asks for ISO 27001
The certificate is a requirement or scoring point, and you do not know where to begin.
Clauses and Annex A feel abstract
The standard is clear on what is required, less on how to do it in your company.
Risk assessment and SoA stuck
The risk register and Statement of Applicability never get finished.
Audit booked, evidence not ready
Records, internal audit and management review are missing or out of date.
ISO/IEC 27001 in brief
Know the standard before you start.
The standard
ISO/IEC 27001:2022Requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).
The controls
Annex A: 93 controls in 4 themesOrganisational, people, physical and technological controls. You decide which apply through risk assessment and justify them in the Statement of Applicability.
Who certifies
An accredited certification bodyYou choose the body. The certification audit runs in two stages: Stage 1 reviews readiness and documentation, Stage 2 checks the ISMS in operation.
After certification
A three-year cycleSurveillance audits keep the certificate in place during the cycle, followed by recertification.
Clauses or Annex A?
| Clauses 4–10 | Annex A | |
|---|---|---|
| What it is | Mandatory requirements for the management system | Reference list of information security controls |
| Covers | Context and scope, leadership, risk assessment and treatment, support, operation, performance evaluation, improvement | Organisational (37), people (8), physical (14) and technological (34) controls |
| How it applies | Every clause applies | Selected through risk treatment, recorded in the Statement of Applicability |
Our role, clearly: Skylius is a readiness and implementation partner. We are not a certification body, we do not issue certificates and we do not claim accreditation. The certification decision stays with the accredited body you choose.
What we do
From scope to audit, we do the work.
Six workstreams, one accountable team. You make the decisions and own the ISMS; we build, implement and document with you.
ISMS scoping & context
We define what the ISMS covers and why, so the certificate matches what your clients expect.
- Context, interested parties and their requirements
- Scope statement: locations, teams, systems and services
- Information security policy and objectives
Start here: a clear scope keeps the project the right size.
Risk assessment & Statement of Applicability
We set up a risk method your team can repeat, run the first assessment with you and turn it into decisions.
- Documented risk assessment method and criteria
- Risk register with owners and treatment options
- Risk treatment plan approved by risk owners
- Statement of Applicability covering all 93 Annex A controls, each included or excluded with a justification
Policies & procedures
We write the documents for you, in clear language and sized to your organisation.
Approved by top management.
Who owns what in the ISMS.
Accounts, privileges and reviews.
Requirements and monitoring.
Reporting, response and learning.
Versions, approvals and retention.
Annex A controls implementation
Our engineers implement the technical controls you selected and help you put the organisational ones into practice.
Internal audit & management review preparation
Before the certification audit, the standard expects you to check your own ISMS and review it at management level.
- Internal audit programme and audit of the ISMS
- Nonconformities recorded with corrective actions
- Management review inputs prepared and minuted
- Metrics showing objectives are monitored
Support through the certification audit
We help you choose and prepare for an accredited certification body, then support you through Stage 1 and Stage 2.
- Guidance on selecting an accredited certification body
- Stage 1 documentation readiness
- Stage 2 preparation and staff briefings
- Help closing any findings, then surveillance audit upkeep
Bundle it: pair the ISMS with an IT maintenance contract so controls keep running between audits.
How we work
A clear path, step by step.
Consultation
We learn why you need ISO 27001 and what already exists.
Gap assessment
Clauses and Annex A reviewed against your setup.
Risk & SoA
Risk assessment, treatment plan and Statement of Applicability.
Implement
Policies written, controls implemented and records started.
Internal audit
Internal audit and management review completed.
Certification audit
Stage 1 and Stage 2 with your chosen certification body.
RealisticTimelines depend on your scope, how mature your current controls are and the certification body’s schedule. The ISMS also needs to run for a period so there are records to audit.
Deliverables
What you receive.
What is covered, and why.
Clauses and Annex A status with actions.
Repeatable method, owners and treatments.
All 93 controls, included or excluded, justified.
Written for you, ready to approve.
Technical controls configured and documented.
Findings and corrective actions.
Inputs, decisions and minutes.
Surveillance and review reminders.
Interactive · ISO 27001 readiness check
How ready is your ISMS?
Answer 12 quick yes/no questions based on ISO/IEC 27001 requirements. Get an indicative readiness score and your top gaps.
Have you defined and documented the scope of your ISMS?Clause 4
Is there an information security policy approved by top management?Clause 5
Are information security roles and responsibilities assigned?Clause 5
Do you have a documented risk assessment method and a current risk register?Clause 6
Is there an approved risk treatment plan and a Statement of Applicability?Clause 6
Are information security objectives set and measured?Clause 6 & 9
Do you keep an inventory of information assets with owners?Annex A
Are access rights controlled, reviewed and protected with MFA where needed?Annex A
Are supplier security requirements defined and monitored?Annex A
Is there a working process for reporting and handling security incidents?Annex A
Have you completed an internal audit of the ISMS?Clause 9
Has management reviewed the ISMS and recorded decisions?Clause 9
Indicative only. It does not replace a gap assessment or the certification body’s audit, and it does not cover every requirement of the standard.
Your readiness score
Answer the questions to see where you stand.
Not started
Close these first
- Answer the questions to see your priorities.
Why Skylius
An ISMS that works, not just documents.
For more than 16 years, Skylius has delivered IT, network and security projects for companies across Saudi Arabia: over 2,500 projects for more than 2,000 clients.
Our own engineers implement the technical Annex A controls you select.
No hand-offs between consultants, IT vendors and integrators. One accountable partner.
Policies and procedures sized to your organisation, in clear language.
Controls can be mapped once to support ISO 27001, NCA controls and client requirements where they overlap.
Based in Al Khobar and working on site across the Eastern Province and the Kingdom.
Technology we work with
Proven platforms, chosen per control.
FAQ
Questions about ISO/IEC 27001.
Have a different question about ISO 27001 readiness? A specialist will reply on WhatsApp.
No. Only a certification body can issue the certificate, and you should choose one that is accredited. Skylius is not a certification body and does not claim accreditation. We prepare your ISMS and support you through the certification body’s audit.
With scope. We agree what the ISMS will cover, run a gap assessment against the clauses and Annex A, and give you a plan. Most of the early work is decisions only your management can make; we prepare everything around them.
A required document listing the Annex A controls, whether each one is included or excluded, the justification, and whether it is implemented. It links your risk treatment decisions to the controls in place.
Annex A was restructured from 114 controls in 14 domains to 93 controls in 4 themes, with new controls such as threat intelligence, information security for cloud services and data leakage prevention. The transition period for certificates against the 2013 version has ended, so new work should use ISO/IEC 27001:2022.
It runs in two stages. Stage 1 reviews your documentation and readiness; Stage 2 checks that the ISMS operates as described. If the certification body grants the certificate, surveillance audits follow during a three-year cycle.
They serve different purposes: NCA controls are national requirements for entities in scope, ISO 27001 is a voluntary international certification. Many controls overlap, so we map evidence once where we can and avoid duplicate work.
Not necessarily. ISO 27001 does not require specific products. We start with what you have and recommend a right-sized, vendor-neutral option only where a control genuinely needs one.
It depends on scope, current maturity and the certification body’s schedule. The ISMS also needs to operate for a while so there are records to audit. After the gap assessment you receive a plan with realistic timings.
ISO/IEC 27001 readiness
Walk into your audit prepared.
Tell us why you need ISO 27001 and what is already in place. We will propose a scope and a clear plan to get your ISMS audit-ready.
