Project + managed Assess & assure
ISO 27001 and CAF compliance
If a customer, regulator or board wants proof your security is managed, a policy folder won't do. We get you ready for ISO 27001 or the NCSC CAF, then keep the evidence current.
- Standards
- ISO 27001 · CAFwith Cyber Essentials as the foundation
- Readiness
- [x] monthstypical SME time to certification audit
- Evidence
- Continuouscollected as you go, not the week before
- Internal audit
- Includedwe find the issues before the auditor does
01 / The problem
Compliance shouldn't be a scramble every year.
Evidence lives in spreadsheets
Screenshots, exports and sign-offs get gathered by hand before each audit. Then they're forgotten until the next one.
The standard is easy to over-build
ISO 27001 asks you to choose controls based on risk. Many firms copy a template and end up with policies nobody follows.
The CAF asks for outcomes
The CAF asks whether you achieve security outcomes, not whether a document exists. That's hard to prove with paperwork alone.
02 / What’s included
Ready for this audit, and the one after.
Gap analysis
We measure where you are against ISO 27001 or the CAF and show what's missing.
ISMS build
Scope, risk assessment, Statement of Applicability, policies and procedures. An ISMS (information security management system) sized for your organisation.
CAF alignment
We assess each CAF principle against the indicators of good practice and plan the work to close the gaps.
Evidence automation
We connect your systems to a compliance platform so control evidence is collected continuously.
Internal audit
An internal audit and management review before your certification audit, so the findings come from us first.
Ongoing compliance
We keep the ISMS running between audits: risk reviews, policy updates, evidence and surveillance audit preparation.
[Placeholder: offer for this service, written by ITB]
03 / How it works
From gap to certificate, then keep it.
- Assess A gap analysis against the standard, with a plan and a realistic timeline.
- Build Risk assessment, controls, policies and evidence, sized to your organisation.
- Get audit-ready Internal audit, fixes, then support through the external audit or CAF review.
- Run We keep evidence and the ISMS current, so surveillance audits become routine.
If you only open your ISMS the week before the audit, you don't have an ISMS. You have a folder.
ITB on compliance
04 / Why ITB
Compliance built on controls we actually run.
Much of the evidence for ISO 27001 and the CAF comes from day-to-day security: logging, patching, backups and incident response. If we already run those for you, producing the evidence is our job.
| What it takes | Do it yourself | With ITB |
|---|---|---|
| Risk assessment and Statement of Applicability | Templates and guesswork | Built with you, around real risks |
| Evidence collection | By hand, before each audit | Collected continuously |
| Internal audit | Find an auditor, or skip it | Included |
| Operational controls (logging, patching, backup) | Separate suppliers, separate evidence | One team, one evidence trail |
| Surveillance audits | Start again each year | Ready all year |
· 05 / Questions
ISO 27001 and CAF, plainly answered.
Q01 Do you certify us to ISO 27001?
No. Certification comes from an independent certification body; in the UK, pick one accredited by UKAS. We get you ready, run the internal audit and support you through the certification audit.
Q02 How long does ISO 27001 take?
It depends on your size, scope and what's already in place. For our SME clients, [x] to [x] months from gap analysis to certification audit is typical. The certificate lasts three years, with surveillance audits in between.
Q03 What is the NCSC CAF?
The Cyber Assessment Framework from the NCSC (National Cyber Security Centre). It sets out four objectives and 14 principles for managing cyber risk. It was written for operators of essential services under the NIS (Network and Information Systems) Regulations, and is now used more widely across the public sector.
Q04 Which version of ISO 27001?
ISO/IEC 27001:2022. The transition period from the 2013 version has ended, so new and renewed certificates are against 2022.
Q05 Do we need Cyber Essentials as well?
Often, yes. Customers may ask for both. Cyber Essentials is a technical baseline; ISO 27001 is the management system around it. They overlap, so evidence for one helps with the other.
Related services
Security Assessments & Consulting
A lighter first look before committing to a standard.
See the serviceCyber Essentials & IASME
The technical baseline most ISO 27001 projects start from.
See the serviceManaged SIEM / SOC
Logging and monitoring evidence, and the CAF's detection objective.
See the servicePentesting
Technical testing evidence auditors often ask to see.
See the service· [Placeholder]
[Placeholder] [Placeholder]
[Placeholder: written by ITB]