ISO 27001

The ISO/IEC 27001 standard provides companies of any size and from all sectors of activity with guidance for establishing, implementing, maintaining and continually improving an information security management system.

Gap Analysis - AKRUP begins every ISO 27001 engagement with a detailed Gap Analysis of your current information security posture. Through thorough document reviews and structured interviews with key stakeholders, we evaluate your existing processes, policies, and technical controls against the ISO/IEC 27001 standard. The result is a clear, evidence-based report showing where your organisation stands today and outlining exactly which areas need improvement to meet the certification requirements. This foundational step provides you with a strategic roadmap for successful implementation.

Implementation - Following the gap analysis, our experienced consultants guide you through every step of the ISO 27001 implementation process. We assist in drafting all required documentation, including the Statement of Applicability, risk treatment plans, security policies, procedures, and records. Where necessary, we also amend your existing Information Security Management System (ISMS) to bring it into alignment with ISO 27001 best practices. To make the process as smooth as possible, we include full project management services as standard, ensuring all tasks are tracked, coordinated, and completed on time—with minimal disruption to your business.

Audit - When you’re ready for certification, AKRUP helps you select the most appropriate ISO 27001 certification body, taking into account your industry, size, and audit history. We conduct pre-audit readiness assessments, prepare your internal team, and ensure all documentation is audit-ready. During the certification audit, our consultants provide active support—whether remotely or onsite—acting as your representatives to explain the ISMS and address any auditor questions. Our presence ensures a smooth audit process and increases the likelihood of first-time certification success.

Post Audit - Achieving ISO 27001 certification is just the beginning of your information security journey. At AKRUP, we provide ongoing post-audit support to ensure that your Information Security Management System (ISMS) continues to operate effectively and remains compliant with the standard over time.

Our services include assistance with follow-up assessments, such as surveillance and recertification audits, as well as the implementation of any corrective actions identified during the certification process.

To further support long-term compliance, we offer comprehensive ISMS maintenance, including annual reviews, policy updates, internal audits, and risk assessments. This ensures your ISMS remains up to date, effective, and aligned with your business objectives and evolving threat landscape.

ISMS Maintenance - Maintaining an ISO 27001-certified Information Security Management System (ISMS) is an ongoing responsibility. At AKRUP, we offer annual ISMS maintenance services to ensure your system remains compliant, effective, and aligned with both ISO 27001 requirements and the evolving needs of your organisation. Our maintenance services include regular reviews and updates of your security policies, procedures, and risk assessments. We also conduct internal audits, assist with management reviews, and monitor the implementation of corrective actions. By proactively managing your ISMS throughout the year, we help ensure you're always prepared for surveillance audits, reduce the risk of non-compliance, and support continuous improvement in your security posture.

ISO/IEC 27001 – International Standard for Information Security – It is a globally recognized standard that provides a framework for establishing, implementing, maintaining, and continuously improving an Information Security Management System (ISMS).

Focuses on Confidentiality, Integrity, and Availability (CIA) – The standard ensures that organisations protect sensitive data from unauthorized access, maintain data accuracy, and ensure availability when needed.

Risk-Based Approach – Organisations must identify, assess, and manage information security risks through a structured risk management process.

Annex A – 93 Controls in 4 Domains – The standard includes security controls covering organisational, people, physical, and technological aspects, helping companies address various security threats.

Certification Process – Organizations undergo an independent audit by an accredited certification body to verify compliance with ISO 27001 requirements and obtain certification.

Applicable to All Industries – While widely used in IT, finance, and healthcare, ISO 27001 applies to any organisation handling sensitive information, improving trust and regulatory compliance.