Skip to main content
Contact Us

ISO 27001 consultancy · Europe

ISO 27001 certification, built on real operations

We build your information security management system (ISMS) with your team, so auditors see evidence from your daily operations.

Book a readiness call See the certification path
ISO/IEC 27001:2022ISMS

Seven clauses and 93 Annex A controls

  1. 4Context of the organisation
  2. 5Leadership
  3. 6Planning and risk
  4. 7Support
  5. 8Operation
  6. 9Performance evaluation
  7. 10Improvement
  8. A.5Organisational controls (37)
  9. A.6People controls (8)
  10. A.7Physical controls (14)
  11. A.8Technological controls (34)
Each requirement backed by evidenceAudit-ready
01 · Certification path

From first gap to a three-year certificate

We prepare you for every audit. An accredited certification body issues the certificate.

01With Q-SEC

Gap and build

Scope, risk assessment, controls and evidence

02With Q-SEC

Readiness

Internal audit and management review, done first

03Certification body

Stage 1 audit

The auditor reviews your documentation

04Certification body

Stage 2 audit

The auditor tests controls in practice and issues a three-year certificate

05Years 1–3

Keep it

Yearly surveillance audits, then recertification

Q-SEC works with your teamIndependent audit
Book a readiness call
02 · The operating rhythm

Your ISMS runs on a yearly cycle

Certification means you run the system and improve it each year. We set up that routine with your team.

  • PPlanAssess risks and choose controls
  • DDoImplement and operate them
  • CCheckMeasure, audit and review
  • AActFix the root cause and improve
Talk to a compliance expert
03 · What auditors check

What your auditor will ask to see

Policies that match how you operate, and records that prove it.

Clause
Requirement
What we do
Evidence your auditor sees
4–5
Scope and leadership
ISMS scope, roles and security policy
Scope statement, approved policy
6
Risk assessment and treatment
Risk method, register and treatment plan
Risk register, Statement of Applicability
7
Support
Competence, awareness and document control
Training records, controlled documents
8
Operation
Controls run and risks treated day to day
Operating records, treatment status
9
Performance evaluation
Internal audit and management review
Audit report, review minutes
10
Improvement
Nonconformities fixed at the root
Corrective action log
A
93 Annex A controls
Technical and organisational controls you select: access, MFA, logging, hardening
Evidence mapped to each control
Common audit findings we design out from day one: last-minute preparation, risk registers that don’t match reality, and controls with no evidence.
Get a gap analysis
04 · How we help

Governance, evidence and real controls

01Governance

ISMS and risk management

An ISMS your leadership runs.

  • Ownership, roles and accountability
  • Risk assessment and treatment
  • Virtual CISO (vCISO) advice
  • You get: risk-driven decisions
02Audit readiness

Evidence and documentation

Smoother audits, fewer surprises.

  • Policies that reflect real operations
  • Evidence linked to clauses and Annex A
  • Support through internal and external audits
  • You get: a traceable evidence repository
03Technical controls

Security that works

Controls that cut risk and produce evidence.

  • Identity, access and MFA
  • Hardening, logging and monitoring
  • Fixes for audit findings
  • You get: controls that hold up
Mölnir, Q-SEC audit partner

Independent audit work, delivered with Mölnir

We build and run your ISMS. Our partner Mölnir performs the independent audit work, with no hand-off gap in between.

ISO 27001PCI DSS QSASOC 2GDPR
Visit Mölnir →
Talk to an ISO 27001 consultant
05 · Questions

ISO 27001 FAQ

Book a readiness call
Is ISO 27001 mandatory?
No. ISO/IEC 27001 is a voluntary standard, but customers, partners and tenders often require it, and it gives you a strong baseline for regulations such as NIS2 and DORA.
How long does ISO 27001 implementation take?
It depends on your scope and how mature your controls already are. After a gap analysis we give you a realistic plan, with the internal audit and management review scheduled before your certification audit.
Do you issue the ISO 27001 certificate?
No. Certificates come from an accredited certification body. We prepare your ISMS and evidence and support you through each audit. Our partner Mölnir delivers the independent audit work.
What is a Statement of Applicability?
A mandatory document that lists the Annex A controls, says whether each applies to you, and justifies including or excluding it. Auditors use it as their map of your ISMS.
What changed in ISO 27001:2022?
ISO restructured Annex A from 114 controls in 14 domains to 93 controls in four themes (organisational, people, physical, technological), with 11 new controls such as threat intelligence and secure coding.
Can ISO 27001 support NIS2 or DORA compliance?
Yes. Much of an ISMS maps onto NIS2 Article 21 and DORA ICT risk requirements, so one evidence base can serve several. See NIS2 compliance.
Readiness call

Plan your certification back from your deadline

Your scope, who’s asking for the certificate and when.

“Q-Sec helped us move from patching issues to running a proper security programme. They tightened our data protection, built a compliance path for DORA and GDPR, and trained our team to think like security professionals.”
Oleksandr PankovOleksandr PankovCEO, Miloan Polska
Teams we work with
MiloanColobridgeFinXFlypayYuria-PharmCashpointFinmeAmigo
Book an ISO 27001 readiness call

We reply within 1 business day.

Pixel icons by Streamline, CC BY 4.0.