ISO/IEC 27001 is still the certificate your client understands without you having to explain it. The current edition is 27001:2022, with an Annex A reorganised into 93 controls across four themes. The transition from the 2013 edition closed on 31 October 2025: certificates based on the old version are no longer valid.
What it is actually for
Three very concrete things: passing the vendor assessment of large clients, qualifying for tenders that demand it, and having a management system underneath that carries NIS2, DORA or the Spanish ENS. Certifying purely for the badge leaves you with a tidy folder and the same risks.
What we do
Phase 1
Gap analysis
We measure the real distance between what the regulation demands and what you have today, control by control. No generic checklists: we review evidence, not statements of intent.
Phase 2
Action plan
Every gap becomes a task with an owner, an effort estimate and a priority based on risk. You decide what comes first knowing what protects you most.
Phase 3
Remediation
We work alongside you through delivery: policies, procedures, technical controls and evidence, until compliance holds up in front of an auditor.
An honest limit: we do not certify. Certification is issued by an accredited, independent body, and that independence is precisely what gives the certificate its value. Our job is to get you to the audit with the system built, the evidence in place and no surprises.
Scope of work
Definition of the ISMS scope: what is in and what is out. It is the decision that most drives cost and the one most often improvised.
Risk assessment and treatment with a defensible methodology, not an inherited spreadsheet.
Statement of Applicability across the 93 Annex A:2022 controls, with justified exclusions.
Drafting of policies and procedures matched to how you actually work, not generic templates an auditor spots at the first question.
Technical controls: the Annex A items that require real configuration — vulnerability management, logging and monitoring, access control, cryptography, secure development.
Internal audit and preparation of the management review.
How we work
1
Scope and context
Interested parties, legal and contractual requirements, and the exact boundary of the system. Getting this right saves months later.
2
Gap analysis against 27001:2022
Clauses 4 to 10 and the 93 Annex A controls, with evidence and a maturity level per control.
3
Risk assessment and treatment plan
Methodology, asset inventory, assessment and treatment decisions signed off by the people who should sign them.
4
Building the system
Documentation, control implementation and the records the audit will ask for.
5
Internal audit and dry run
We walk the audit before the auditor does, with the same questions. What surfaces here will not surface in the certification audit.
6
Support through stage 1 and stage 2
We are with you during the certification audit and through closing any nonconformities.
What you get
A full gap analysis against 27001:2022.
Risk assessment methodology and the assessment itself, executed.
Statement of Applicability, justified control by control.
The ISMS documentation set, written for your organisation.
Internal audit report with nonconformities and a closure plan.
Action plan through to the certification audit date.
Who does the work. The same team that audits, not an account manager. Governance, risk and compliance: CISSP, CISM, ISO 27001 Lead Auditor, ENS and Risk Analysis (CCN), certified DPO, CCSP and CDPP (ISMS Forum) and PMP (PMI). On the technical side: OSCP, CRTO II and eWPTX, ranked in the top 1% of the CCN-CERT Atenea platform. We have run compliance projects for crypto exchanges, universities and public administrations.
Questions we get asked
How long does it take?
It depends on scope and on what you already have. A small organisation with tidy processes and a contained scope moves far faster than a group with several sites and legacy systems. After the gap analysis we give you a realistic calendar, not a commercial one.
Will it cover NIS2, DORA or the ENS?
As a base, yes, and it is the intelligent way to approach it. The ISMS gives you governance, risk assessment and most of the controls. What has to be added afterwards is what is specific to each regulation. We work by reusing evidence across frameworks so you do not pay twice for the same thing.
We hold a 2013 certificate. Is it still valid?
No. The transition to the 2022 edition closed on 31 October 2025. If your certificate is still anchored to the old version, the Statement of Applicability and the risk assessment need updating to the new Annex A.
Can you audit us after implementing it?
The internal audit, yes, and we do it. The certification audit, no: it is issued by an accredited independent body, and whoever implements cannot certify. We say this up front because some firms imply otherwise.
Certify, or put your house in order first?
Half an hour with an auditor to scope it, see what you already have and decide whether certifying now pays off or whether to start with the risk assessment.
Phone: +34 686 250 244 (Mon-Fri, 9:00 to 18:00 CET) · Email: info@jaymonsecurity.com
We reply within 2 working hours.
