ISO/IEC 27001:2022
ISO/IEC 27001 implementation
Build an information security management system (ISMS) your team can run and an auditor can examine. Aegentra defines the scope, runs the risk assessment, develops the Statement of Applicability, implements agreed controls and organises the evidence for an independent certification body, with consultants based in Europe working remotely and on site in Germany.
What we deliver
What the implementation produces
Your written scope sets the deliverables and who owns each one. The programme is built around these outputs.
- ISMS scope and context
- A defined boundary covering services, sites, systems and suppliers, with interested-party requirements and the obligations that apply to you.
- Risk assessment and treatment
- Agreed risk criteria, an information security risk register, treatment decisions and accountable owners.
- Statement of Applicability
- The controls your risks require, their implementation status and the reason for each inclusion or exclusion, checked against the 93 reference controls in Annex A.
- Policies and procedures
- The documented information the standard requires, written to match how your organisation actually works.
- Implemented controls and evidence
- Agreed control work and an evidence register showing what operates, who owns it and when it was last checked.
- Management review and handover
- Preparation for management review, an open-action record and an organised handover for the certification audit.
Context
What ISO/IEC 27001 is
ISO/IEC 27001:2022 is the international standard for an information security management system. Clauses 4 to 10 set the management-system requirements; Annex A lists 93 reference controls that you compare against the controls your risk treatment requires. The standard asks for controls selected by risk, not a fixed checklist.
Certification is performed by an independent certification body in two stages: Stage 1 reviews the documented system, Stage 2 assesses whether it operates effectively. Aegentra implements and prepares; the certification body decides.
ISO/IEC 27001 and NIS2
The NIS2 Directive (Directive (EU) 2022/2555) requires essential and important entities to take appropriate cybersecurity risk-management measures (Article 21), including risk analysis, incident handling, business continuity, supply chain security and access control. ISO/IEC 27001 is widely used to structure and evidence those measures.
An ISO/IEC 27001 certificate does not by itself demonstrate NIS2 compliance. Whether and how the Directive applies to you, and what national implementation requires, needs its own assessment. We map the ISMS to the measures in Article 21 so that one system supports both.
What this service is not
It is not certification, legal advice or an internal audit of our own work. Internal audits are scoped separately and performed by a consultant who had no part in the implementation, or by a separate provider.
How it runs
From scoping call to certification audit
Scoping call
We confirm why you need ISO/IEC 27001, which services and sites belong in scope, which controls already operate and your target dates. You then receive a fixed-fee proposal.
Gap assessment
We compare what operates today with the standard and agree priorities with accountable owners.
Risk and applicability
We run the risk assessment, agree treatment and record the selected controls in the Statement of Applicability.
Build
Policies, procedures and agreed control changes are implemented with your team and recorded as evidence.
Internal audit and management review
A separately scoped, independent internal audit tests the ISMS, then leadership reviews results, risks and actions.
Certification handover
We organise the evidence pack and open actions for Stage 1 and Stage 2. Audit dates are set by the certification body you choose.
Who it suits
Organisations this suits
- Organisations whose customers or tenders ask for ISO/IEC 27001 certification.
- Entities preparing cybersecurity risk-management measures under NIS2 that want a recognised management-system structure.
- Software and service companies handling customer data in the cloud.
- Teams with a stalled or template-based ISMS that would not survive a Stage 2 audit.
- Organisations certified to another ISO standard that want to integrate information security.
Questions
Frequently asked questions
Does ISO/IEC 27001 certification make us NIS2 compliant?
No. ISO/IEC 27001 can structure and evidence many of the cybersecurity risk-management measures that Article 21 of Directive (EU) 2022/2555 requires, but a certificate does not by itself demonstrate NIS2 compliance. Your obligations depend on whether you are in scope and on national implementation, and both need a separate assessment.
Do we have to implement all 93 Annex A controls?
No. Annex A is a reference list. You select the controls your risk treatment requires, record them in the Statement of Applicability and justify each exclusion.
Does Aegentra issue the certificate?
No. Aegentra is not a certification body. An independent accredited certification body performs the Stage 1 and Stage 2 audits and decides certification. Its fees are separate and paid directly to it.
How long does implementation take?
It depends on the scope, your starting point, technical complexity and how quickly decisions and evidence are available. We confirm a plan after the scoping call and do not promise a certification date, because audit dates are controlled by the certification body.
What does it cost?
We do not publish a price. After a scoping call we quote a fixed fee for the agreed scope, with assumptions, responsibilities and exclusions written down.
Can you also run our internal audit?
Yes, as a separate engagement. The auditor will be a consultant who had no part in implementing your ISMS, after documented checks of competence, prior involvement and conflicts of interest. If objectivity cannot be protected, a separate provider is required.
Planning ISO/IEC 27001?
Tell us your scope and deadline. We will tell you honestly what it takes.