ISO 27001 Readiness
Understand the gaps between your current security practices and the ISO 27001 requirements in your agreed scope. TISA Hub helps organise risk, control ownership, documentation and evidence so your team can work through the next actions.
Readiness support is scoped to your organisation and its existing controls.
Capabilities
For founders, CTOs and security leaders preparing an information security management system, reviewing an existing programme or responding to an assurance requirement from a customer.
Identify the business activities, systems, information and dependencies included in the review. Capture existing policies, responsible people and the assurance outcome you are working towards before deciding what needs to change.
Compare applicable requirements with the controls and evidence already available. Record gaps and questions that need validation, distinguish missing documentation from missing operational practice, and prioritise the work with your team.
Document security risks in business context, including affected systems, current controls and proposed treatment. Establish review and acceptance responsibilities so decisions remain understandable after the assessment.
Develop or review policies and supporting procedures around how your organisation operates. Make control ownership, approval, review and day-to-day responsibilities explicit rather than leaving the programme dependent on a document set alone.
Connect applicable requirements to supporting records, system settings and operational activities. Build an evidence gap list and a remediation plan with proposed owners, dependencies and review criteria for the work in scope.
Support internal review planning and documentation checks within the agreed engagement. Hand over the requirements map, findings and open actions so your team can maintain the programme and coordinate with an independent certification provider.
What useful work looks like
A useful readiness deliverable explains what was reviewed, what supports each finding and which decisions remain open. It should help leadership prioritise changes and give control owners a practical record to maintain.
The excerpt shows a possible deliverable structure. Scope and acceptance criteria are agreed for your requirement.
An example account is still enabled after its owner has left. The removal process has no named review owner.
Fictional example. A real assessment uses evidence from the agreed environment.
Where to start
These are possible starting points. We agree the deliverables and boundaries for your requirement.
Start with your current controls, available evidence and the business need behind the review. Agree which systems and requirements the assessment covers.
A documented baseline, evidence gaps and a prioritised remediation plan.
Work through a defined group of findings, such as unclear ownership, incomplete procedures or evidence that needs an operational review.
Updated control documentation, an evidence map and open actions for the agreed scope.
Give your team focused guidance while it works through the readiness plan. Review decisions, ownership and documentation at agreed checkpoints.
Review notes, a maintained action register and a practical handover to the internal programme owner.
Ways to engage
A specific output with an agreed scope.
Focused guidance for a decision or review.
An agreed operating scope and ownership.
Responsibilities, availability and support arrangements are established per engagement.
Start a conversation
Share the systems in scope, the controls and evidence you already have, and the review you are preparing for. We can discuss a useful starting engagement.
