What should an ISO 27001 engagement deliver?

Does the whole organisation need to be in scope?

The scope can cover a defined part of the organisation, but it must describe relevant interfaces and dependencies honestly. An information security management system, or ISMS, coordinates policies, responsibilities, risk assessment and improvement. A boundary around a customer-facing service may still depend on central identity administration, shared offices and outsourced support.

Ask the engagement to produce a written scope identifying activities, locations, information and supporting technology. Record exclusions and why they are reasonable. A smaller boundary can reduce initial work, but it may not satisfy a customer's requirement if the service they buy sits partly outside it. Confirm the assurance question with procurement or the customer before treating a narrow certificate as the desired result.

What should the consultant examine before drafting policies?

The consultant should examine how security decisions and controls already operate. Useful inputs include service ownership, asset records, supplier agreements, access reviews, incident records, continuity arrangements and previous audit findings. Interviews should include business owners as well as IT: information risk also follows recruitment, purchasing, finance and records handling.

Specify how evidence will be sampled and protected. A discovery report should distinguish an absent control from a control that exists but lacks a reliable record. Those problems need different treatment. For a mid-sized organisation, reusing a sound change process is usually more maintainable than introducing a parallel security approval process. Agree secure document exchange, access limits and deletion arrangements before sharing sensitive material.

Is Annex A a checklist of controls we must all implement?

Annex A is a reference set used when determining necessary controls; it is not a requirement to implement every listed control without considering risk. The organisation must establish a risk assessment approach, evaluate information security risks and decide how to treat them. Necessary controls can also come from outside Annex A.

The Statement of Applicability records necessary controls, the reasons for inclusion, implementation status and the justification for excluding Annex A controls. Scope the work so that these decisions trace back to business risks, legal or contractual duties and operating conditions. A control marked implemented should have supporting evidence. Risk acceptance belongs to authorised organisational owners, not to a consultant completing a spreadsheet on their behalf.

How is consultancy different from certification?

Consultancy helps develop and improve the ISMS, while a certification body independently assesses conformity. Internal audit and management review are also part of the management system; neither is replaced by buying an external certificate. Internal auditors need sufficient competence and objectivity, including avoiding an unchecked review of their own work.

Make proposals distinguish implementation support, internal audit, certification preparation and certification-body charges. Certification commonly involves a first-stage review of readiness and a second-stage assessment of implementation, followed by ongoing surveillance arrangements. The certification body determines its audit requirements. In the UK, check accreditation and the relevant scope through UKAS rather than relying on a badge in a proposal. No adviser should promise a certification outcome regardless of the evidence.

What evidence should we accept at the end?

Accept a usable system with named owners, traceable decisions and a realistic maintenance cycle. Deliverables may include the agreed scope, risk assessment method, risk register, treatment plan, Statement of Applicability, required policies, audit findings and management review records. Specify which documents the adviser drafts, which activities staff perform and which decisions leadership must approve.

Test whether the organisation can update the risk register after a service change, address a nonconformity and produce control evidence without the adviser. Keep unresolved findings visible, with accountable owners and agreed next steps. Certification readiness is not the same as resilience under disruption: connect the ISMS to response exercises and supplier assurance rather than letting the audit calendar determine every priority.

Reference points: ISO's introduction to ISO/IEC 27001 and UKAS accredited organisation search. Consult the applicable standard and your chosen certification body for detailed requirements.