ISO

ISO/IEC 27001 readiness and certification support

We build the ISMS with you, starting from scope and the risk assessment. A first system and a multi-site system use the same engagement: we agree the sites, the shared controls, and the site-specific risks before we start. The Statement of Applicability, policies, and evidence index follow from those decisions, so the documents agree with each other. Before the Stage 1 audit we run an internal audit and a management review, because the auditor asks for both.

Scope this with us See how CASK works

Engagement brief

Fixed scope

Works against

ISO/IEC 27001:2022ISO/IEC 27002:2022ISO/IEC 27005:2022

Typical duration

Typically 3-6 months

You end with

An ISMS ready for the Stage 1 audit

Who does what

AccountableYour named owner

ResponsibleA Truvara practitioner

Drafts and citesCASK

Phases

01Set the scope
02Assess risk
03Write the Statement of Applicability and policies
04Collect evidence and rehearse the audit

We confirm scope and timing after a first call.

When teams call us

Usually one of these is true.

01
A large customer made ISO/IEC 27001 a contract condition
02
Tenders list the certificate as a requirement and you keep missing out
03
Someone started an ISMS last year and the documents stopped matching
04
You have a SOC 2 report and customers outside the US want ISO

What you receive

From scattered records to work you can defend.

Drag the divider. On the left, where the work usually starts. On the right, the files you receive.

What you receive

The files from this engagement

Gap assessment

ISMS scope statementReport
Risk assessmentAssessment
Gap findings against Annex AAssessment

Implementation

Risk treatment planPlan
Statement of ApplicabilityRegister
Information security policy setPolicy
Evidence index by Annex A controlRegister

Before the engagement

What we usually find on day one

Two scope documents, and nobody knows which one is current
Risk workshop notes as a photo of a whiteboard
Annex A sheet with three owners and empty evidence cells
The Statement of Applicability does not match the working sheet

Whatever was saved last. Scope, risk, and evidence still disagree.

What it works against

The standards in scope, named before we start.

CASK maps every requirement to evidence in the workspace, so scoping starts from what already exists and what is missing.

ISO/IEC 27001:2022
ISO/IEC 27002:2022
ISO/IEC 27005:2022

Key areas covered

Policies and responsibilities
People
Physical security
Technology
Risk assessment and treatment
Supplier relationships
Incident management
Business continuity
Internal audit
Management review

We agree which parts are in scope on the first call.

How it runs

The path to the outcome.

One sequence, from the records you already have to the outcome in your hands.

1
Set the scope
Agrees with leadership which sites, teams, and systems the ISMS covers, and records why.
2
Assess risk
Runs the risk workshop and sets likelihood, impact, and treatment with each owner.
3
Write the Statement of Applicability and policies
Decides which Annex A controls apply and edits policies to match how your teams work.
4
Collect evidence and rehearse the audit
Follows up with control owners on missing evidence, then runs the internal audit, chairs the management review, and presents the readiness findings.

What we need from you

A short list, agreed on day one.

An ISMS owner with time each week
A leadership sponsor for scope, risk appetite, and the management review
Access to IT, HR, and vendor records
Control owners who can join a workshop and answer follow-ups

Questions

What buyers ask us first.

An accredited certification body audits the ISMS in two stages and issues the certificate. We prepare you for both stages and can join your team in the audit sessions.

Once the internal audit and management review have run and the evidence index has no open gaps. Certification bodies book ahead, so we set a target date with you early and plan backward from it.

Yes. Many SOC 2 controls line up with Annex A. CASK maps your existing SOC 2 evidence to Annex A controls, and the practitioner confirms each match before it goes in the evidence index.

In a CASK workspace on the practitioner's machine, as ordinary files you receive at the end. The agent sends request content only to the AI provider you approve, and Truvara does not use workspace content to train models.

A surveillance audit comes every year, and the ISMS needs internal audits, risk reviews, and management reviews in between. Compliance as a Service runs that cycle with your team.

Also considered

Customers also look at

Compliance as a Service

We run the compliance pods we agree up front: risk management, governance, internal audits, and partner and vendor risk management.

ISO/IEC 27001:2022SOC 2ISO/IEC 42001:2023

Monthly, with the cadence agreed in scope

Service organization controls reporting

SOC readiness examination and attestation support

Prepare for a SOC 1 or SOC 2 examination, Type 1 or Type 2, and support the observation window when the report needs one.

AICPA Trust Services CriteriaAICPA SOC 2 Description CriteriaSOC 1

Readiness in 6-10 weeks, then support across a 3-12 month observation window

Cybersecurity

Cybersecurity baseline and roadmap

Compare where you are to where you need to be against the baseline you choose, such as NIST CSF 2.0, CIS Controls, or a cloud benchmark, and leave with a prioritized roadmap.

NIST CSF 2.0CIS Controls v8CIS Benchmarks

Typically 4-6 weeks

ISO/IEC 27001 readiness and certification support

Usually one of these is true.

From scattered records to work you can defend.

The standards in scope, named before we start.

The path to the outcome.

A short list, agreed on day one.

What buyers ask us first.

Want us to scope this with you?

ISO/IEC 27001 readiness and certification support

Usually one of these is true.

From scattered records to work you can defend.

The standards in scope, named before we start.

The path to the outcome.

A short list, agreed on day one.

What buyers ask us first.

Want us to scope this with you?

ISO/IEC 27001 readiness and certification support

Usually one of these is true.

From scattered records to work you can defend.

The standards in scope, named before we start.

The path to the outcome.

A short list, agreed on day one.

What buyers ask us first.

Do you issue the certificate?

When can we book the certification audit?

Can we reuse our SOC 2 work?

Where does the ISMS data sit?

What happens after certification?

Customers also look at

Compliance as a Service

SOC readiness examination and attestation support

Cybersecurity baseline and roadmap

Want us to scope this with you?

ISO/IEC 27001 readiness and certification support

Usually one of these is true.

From scattered records to work you can defend.

The standards in scope, named before we start.

The path to the outcome.

A short list, agreed on day one.

What buyers ask us first.

Do you issue the certificate?

When can we book the certification audit?

Can we reuse our SOC 2 work?

Where does the ISMS data sit?

What happens after certification?

Customers also look at

Compliance as a Service

SOC readiness examination and attestation support

Cybersecurity baseline and roadmap

Want us to scope this with you?