Aligned with ISO/IEC 27001:2022 & Annex A
Certification-Ready Before the Auditor Arrives
Gap analysis against Annex A, ISMS build-out, and the internal audit the standard requires. So your certification audit holds no surprises.
The problem
The Binder Nobody Reads
Most first-time certifications fail the same way. A policy template pack gets bought, filled in, and filed — and the certification auditor finds no evidence anyone actually lives by it. The documents exist. The management system does not.
The second surprise arrives later: Clause 9.2 requires an internal audit before the external one. Companies routinely discover this weeks before the auditor is booked, with no independent party available to run it.
Our approach
An ISMS That Survives Contact With an Auditor
We build the ISMS in the order the standard actually reads: scope first, then risk method, then controls — so the Statement of Applicability reflects decisions you made rather than boxes you ticked.
Then we run the internal audit that Clause 9.2 requires, as an independent party, and give you a findings report with corrective actions your management review can act on. By the time the certification body arrives, nothing in your ISMS is new information.
How It Works
01
Scoping & Gap Analysis
Scope definition — the decision that drives total cost more than any other.
Gap analysis against clauses 4–10 and all 93 Annex A controls.
Credit for what you already have: existing policies, tooling, practices.
A realistic timeline and effort estimate to certification-readiness.
02
ISMS Build-Out
Risk assessment method and risk register, applied to your real assets.
Statement of Applicability with documented justifications.
Policy set written for your organisation, not lifted from a template.
Evidence routines — so records accumulate as you work, not the week before the audit.
03
Internal Audit (Clause 9.2)
Independent internal audit as required by Clause 9.2.
Findings classified by severity, with corrective actions.
Conducted the way a certification auditor would: sampling, interviews, evidence.
04
Management Review & Handover
Management review input pack per Clause 9.3.
Certification body selection and Stage 1 / Stage 2 preparation.
Handover to your internal owner, with the operating rhythm documented.
How we deliver
Your Team Runs It. We Make It Work.
Certification is a project, not a workshop. We work alongside your team over six to twelve months depending on scope and starting maturity — you own the ISMS at the end, not us.
You receive:
Gap report against clauses 4–10 and Annex A.
ISMS documentation set including scope, SoA and risk register.
Internal audit report with findings and corrective actions.
Management review pack ready for Clause 9.3.
Who it’s for
Ideal For:
First-time certifiers: a customer or tender made ISO 27001 non-negotiable.
Companies with a stalled ISMS: documentation exists, nothing operates.
Certified organisations: who need an independent internal auditor each cycle.
Teams facing NIS2 or TISAX too: one control set, mapped across all three.
Why Invest in This?
Impact 01
Audit Confidence
The internal audit finds what the certification auditor would have found — while it still costs you nothing but time.
Impact 02
Contract Access
ISO 27001 is a procurement precondition in most enterprise and public-sector tenders. No certificate, no shortlist.
Impact 03
No Rework
A scope set correctly at the start is the single biggest lever on total certification cost. Most overruns start here.
Tracer
by Vective
Between the tests,
Tracer keeps checking.
This service shows where you stand today. Tracer, our continuous security assurance, keeps finding and proving the ways in between engagements, re-checks every fix and keeps the evidence your auditors ask for.
Scoped to your situation.
Not to a price list.
ISO 27001 Readiness
Gap analysis, ISMS build-out and internal audit
Format: project engagement alongside your team, remote or on site.
Duration: typically six to twelve months to certification-readiness.
Scope: clauses 4–10, all 93 Annex A controls, internal audit.
Deliverables: gap report, ISMS documentation, internal audit report.
Independence: we prepare you; an accredited body certifies you.
Questions,
answered.
Anything else on your mind? Ask us directly, we are happy to help.
Do you issue the certificate?
How long does the whole thing take?
Can you act as our internal auditor on an ongoing basis?
We bought a policy template pack. Is that a head start?
That’s not all.
More ways we can help.
TÜV-certified AI Expert & Practical Practitioner Expertise
AI Agent Development for Software Teams
A 3-day deep dive transforming developers into AI engineers. Build functional RAG prototypes and production-ready code.
ISO 27001 Aligned Methodology
AI Agents & Secure Automation
Master Agentic AI & Sovereign Automation. Learn to build secure AI agents using Pything, n8n, Dify and more in this advanced 4-hour Vective workshop. Stop chatting, start building.
TÜV-certified AI Consultant
AI Potential Analysis & Strategy Workshop
Transform your team from AI experimenters to AI strategists in one day. Includes 3 prioritized use cases and a 6-month roadmap.
Not sure which service fits?
Let’s find out together.
In a free 30-minute call we look at where you stand and what would help you most. If it is not us, we will tell you who.