Who it is for
A proportionate engagement with clear boundaries.
Organisations starting an ISO/IEC 27001 programme, recovering a stalled implementation or approaching a certification assessment.
Advisory & readiness
ISO/IEC 27001 gap & readiness assessment
Find what is missing, whether you are establishing an ISMS baseline or preparing an operating system for certification.
Example: supplier security
Know what needs attention.In place
Supplier register
Unproven
Security reviews performed?
Missing
Approved risk decisions?
Next step
Assign owners and priorities
ISMSPriorities
What is included
- Scope and current-state review
- Clause 4–10 and applicable-control gap analysis
- Evidence and ownership review
- Selected process walkthroughs
- Prioritised action roadmap
Typical outputs
- Gap and readiness assessment
- Evidence action list
- Prioritised action roadmap
- Leadership briefing
What we need from you
- Proposed ISMS scope
- Available policies, risk and control records
- Relevant evidence and process owners
- Target timeline if known
Timing
Usually 2–5 working days for a defined scope; the emphasis changes with your stage and evidence maturity.
Pricing basis
Fixed-fee after scope and evidence readiness are understood.
Important exclusions
- Formal internal-audit opinion unless separately scoped and independent
- Remediation implementation unless agreed
- Certification or a guaranteed certification outcome
One service, scoped to your stage
Baseline first, or a check before certification?
Starting or rebuilding
We establish a baseline, identify missing arrangements and evidence, then prioritise a practical implementation roadmap.
Approaching certification
We examine how the operating ISMS, owners and available evidence stand against the planned assessment. This is advisory and does not replace the required independent internal audit.
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.