Who it is for
A proportionate engagement with clear boundaries.
Technology SMEs that need a proportionate ISO/IEC 27001 management system without handing away management ownership.
Advisory & readiness
ISO/IEC 27001 implementation support
Dublin-based, staged support from ISMS scope and governance to an evidence-producing management system your SME can operate.
Example: access approval
Make the connections work.Policy
Approval before access
Owner
IT / access owner
Control
Approve, then provision
Evidence
Request + approval + activity
ISMSIn operation
What is included
- Context, scope and governance workshops
- Risk and Statement of Applicability method
- Policy and procedure tailoring
- Control implementation planning
- Evidence and meeting cadence
- Internal capability transfer
Typical outputs
- Tailored ISMS framework
- Policy and procedure set
- Risk and control registers
- Implementation roadmap
- Operating guidance
What we need from you
- Business and product context
- Technical architecture
- Existing practices and documents
- Named owners and leadership participation
Timing
Commonly 8–20 weeks, depending on starting maturity and team availability.
Pricing basis
Phased fixed-fee or time-based support, with scope-change controls.
Important exclusions
- Management decision-making
- Owning client risks or controls
- Certification
- Independent audit of Mang Morgan’s own implementation work without safeguards
Dublin-based · supporting SMEs across Ireland
A practical ISO 27001 implementation route.
Mang Morgan helps technology SMEs establish an information security management system that reflects how the organisation actually operates. Support can be delivered remotely across Ireland, with hybrid or on-site activities agreed where they add value.
- Define the context and scopeConfirm organisational boundaries, interested parties, leadership responsibilities and the services, people, locations and technology in scope.
- Establish the risk methodAgree a repeatable approach for identifying, analysing, evaluating and treating information-security risk.
- Develop the treatment frameworkBuild the risk treatment plan and Statement of Applicability while management retains every risk and applicability decision.
- Tailor policies and proceduresAdapt the controlled document set to the SME’s actual processes, technologies, responsibilities and contractual needs.
- Operate and collect evidenceEmbed controls, awareness, measurement, management review and corrective-action routines that produce reliable evidence.
- Prepare for independent assessmentOrganise evidence and address readiness gaps before the separately accepted internal audit and certification-body assessment.
Planning your certification journey
Know what happens before and between the assessments.
Before Stage 1
Agree the ISMS scope, establish the risk and control framework, operate the planned routines and prepare the evidence index. Include management review and an appropriately independent internal audit in the programme. We can discuss certification-body selection and assessment logistics as part of the agreed advisory scope; you appoint the certification body directly.
Between Stage 1 and Stage 2
Review the certification body’s feedback, agree who owns each action and organise evidence of the work completed. Advisory support for those actions is included only where the statement of work provides for it. The certification body determines assessment readiness and makes the certification decision.
Your team’s commitment
Nominate an ISMS owner, a leadership sponsor and the people responsible for technical and business processes. Workshops, document review and operating the controls require their time. We agree that commitment by phase during scoping so the plan fits your team’s capacity.
Technical work and ongoing support
Policy tailoring and control planning do not automatically include configuring cloud systems, deploying tools or fixing vulnerabilities. Those activities, support during certification and later maintenance are separately defined in the proposal, with clear owners and handover arrangements.
Frequently asked questions
Does this service result in certification?
No. Mang Morgan does not issue ISO/IEC 27001 or ISO/IEC 27701 certificates or guarantee a certification outcome. A certification decision remains outside this engagement.
How is the scope confirmed?
We confirm the intended outcome, management-system boundary, criteria, locations, processing context, evidence, stakeholders, dates and limitations before issuing the final proposal.
Can the work use a client platform?
We can work in authorised client-owned GRC or privacy-management platforms where appropriate. Platform status helps organise evidence but does not replace testing or professional judgement, and platform experience does not imply partnership.
What happens if the scope changes?
Additional sites, products, processing activities, jurisdictions, frameworks, interviews, revisions, travel, remediation or accelerated dates are assessed through agreed change control.
Start with a defined scope
A clear plan. An agreed fee.
Tell us your objectives and timing. Your proposal will set out the work, deliverables and responsibilities.