Delivery
8-month plan to certification
Month 1 · Kickoff & Gap
Scope, interested parties, risk appetite, gap vs. 27001:2022 and Annex A, business case.
Month 2 · Risk Assessment
Asset inventory, threat modeling, risk matrix, treatment plan and draft Statement of Applicability (SoA).
Months 3–4 · Documentation
Corporate security policies, specific procedures, records, KPIs and RACI matrix per control.
Months 5–6 · Controls in place
Implementation of technical controls (IAM, logging, backup, vulnerability management, cryptography, supplier security).
Month 7 · Internal audit
Full internal audit, management review meeting, corrective action plan, mock stage 1 simulation.
Month 8 · Stage 1 + Stage 2
External audit with accredited body, certification support, findings closeout. Issued certificate.
