ISMS and compliance
ISO 27001 aligned policies, controls and audit readiness, shaped around how your team already works.
What is an ISMS?
An information security management system, or ISMS, is how an organisation runs security day to day: the risks it knows about, the rules it follows, and the evidence that it follows them.
ISO 27001 is the international standard for an ISMS. We help you build one your team can actually keep running, not a binder that sits on a shelf.
What we do
-
Gap assessment
We compare where you are today with ISO 27001 and its Annex A controls, and give you a prioritised list of what is missing.
-
Policy set
Practical policies and procedures written for your organisation, in language your staff will read and follow.
-
Controls
We help you put the technical and organisational controls in place, and collect the evidence auditors ask for.
-
Audit support
Internal audits and readiness checks led by an ISO 27001 Lead Auditor, and support through the certification audit.
How we test. Our work follows ISO/IEC 27001 and the guidance in ISO/IEC 27002. Where you already have penetration test results, we use them as evidence for the technical controls.
What you get
- A gap assessment report with a prioritised roadmap
- Risk assessment and risk treatment plan
- Statement of Applicability
- A policy set that fits your organisation
- An audit readiness check before certification
Why Mica Shield
ISO 27001 Lead Auditor certified, so you are prepared for the questions auditors actually ask.
Why Mica Shield
Auditor on the team
ISO 27001 Lead Auditor certified, so you are prepared for the questions auditors actually ask.
Testers, not just consultants
We know how controls fail under attack, so the controls we recommend hold up.
Shaped around you
We build on how your team already works instead of replacing it.
Questions buyers ask
How long does ISO 27001 implementation take?
It depends on your size and where you start. The gap assessment tells us both, and gives you a realistic plan with dates before you commit to the full project.
Do you issue the ISO 27001 certificate?
No. Certification is issued by an accredited certification body. We get you ready, run the internal audit, and support you during the certification audit.
Is a gap assessment useful if we are not going for certification?
Yes. It shows where your security programme is weak and what to fix first. Many teams use it as a roadmap even without a certificate.
We already do penetration tests. Do we still need an ISMS?
Testing finds technical weaknesses. An ISMS makes sure risks are managed, owned and reviewed across the whole organisation. They work best together.
What is a Statement of Applicability?
It is the ISO 27001 document that lists each Annex A control, says whether it applies to you, and explains why. Auditors review it closely.
Related services
Tell us what you need tested
We will come back with a scope, a timeline and a fixed price.