ISO 27001 readiness
Find out what an ISO 27001 audit would ask — before you pay for one.
A structured readiness assessment against ISO/IEC 27001:2022. You get a gap list with owners and evidence, so the certification engagement you eventually book is shorter, cheaper and considerably less surprising.
- 51 requirements assessed, in plain English
- 47 of them covered by mapped controls you may already have answered
- Evidence attached per requirement, with review dates
- Gaps become owned, decided work rather than a list
Readiness only. Cyber Guys is not a certification body and does not issue ISO certification — that requires an accredited external body engaged separately.
Northside Legal · gap summary
- Requirements met with evidence28
- Partially met13
- Not met10
- Answered via mapped controls47
- Gaps raised into action plan23
- Artefact typeSelf-assessment
Every export carries the disclaimer that belongs on a self-assessment, inside the PDF.
How it works
Understand it. Assess it. Close it. Then engage an auditor.
- 1
Understand what is being asked
Each requirement is restated in plain English — what it actually wants, and what evidence would satisfy it — rather than reproduced as standards prose.
- 2
Assess honestly
Record where you genuinely are, attach the evidence you already have, and mark what is missing. Overstating here only moves the surprise to the audit.
- 3
Close the gaps with owners
Gaps become recommendations with urgency, effort, indicative cost and a named owner — and a decision, including a recorded acceptance where you consciously choose not to act yet.
- 4
Engage a certification body
When you are ready, you engage an accredited body separately. You arrive with the evidence collected and organised, which is the expensive part of most first audits.
Why readiness first
Most failed first audits fail on evidence, not on security.
Organisations are usually doing more than they can prove. The expensive part of a certification engagement is assembling evidence for controls that were already in place but never documented.
- Evidence is attached to a control once and reused wherever that control appears.
- Each evidence item has a verification state and a review date, so staleness is visible.
- The gap list distinguishes “not doing it” from “doing it, cannot prove it”.
- Decisions not to act are recorded with a named person, which an auditor would rather see than a silence.
- Reassessment is versioned, so continual improvement is demonstrable.
What it does not do
The boundary, stated plainly.
It does not certify you.
Certification comes from an accredited certification body after an audit. No software product can issue it.
It does not write your ISMS for you.
Policy templates and structure help, but the management system has to reflect how your organisation actually runs.
It does not reproduce the standard.
ISO standards are copyrighted. You will need a licensed copy from the publisher if you are pursuing certification.
It is not legal advice.
Where a requirement touches a legal or contractual obligation, that is a question for your adviser, not for us.
See your ISO 27001 gap list.
Fifteen minutes, against a real readiness assessment, with the evidence model and the disclaimers that go on the export.