Framework
ISO/IEC 27001
The international standard for an information security management system. We help you build an ISMS in line with the standard. If you want to get certified, we prepare you for the audit; the certification itself is carried out by an accredited certification body.
The framework explained
What is ISO/IEC 27001?
What is it?
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). It helps you organise information security in a structured way, based on your organisation’s risks. It covers the confidentiality, integrity and availability of information, taking people, processes and technology into account.
Who is it for?
The standard applies to organisations of any size and in any sector. It is relevant if you handle sensitive information, if customers ask for assurances or if you want to organise your security in a structured way. Certification is optional, unless, for example, a contract requires it. You can also work with the standard without getting certified.
Why take action?
An ISMS makes responsibilities, choices and follow-up explicit. It helps you maintain your measures and evaluate and improve how well they work. A certificate gives customers independent confirmation for the defined scope. It does not guarantee that incidents won’t happen, and it does not replace a separate check against legal obligations.
Where do you start?
- Define the scope: which activities, information, systems and locations are included?
- Assess and treat risks, and justify the measures you choose.
- Put the processes into practice and collect evidence of implementation and follow-up.
- Carry out internal audits and a management review. If you wish, go for certification by an independent certification body.
Public sources · content checked on 5 October 2026
Our approach
From gap analysis to a working ISMS
- 1Gap analysisWhere do you stand against the standard?
- 2Building the ISMSScope, policy, risk analysis, statement of applicability and registers.
- 3Internal auditWith an independent reviewer.
- 4Management reviewReview by management and, if you wish, preparation for the certification audit.
Frameworks
Explore the other frameworks
Each framework has its own scope and evidence requirements. Often, several apply at once.
Want to build an ISMS in line with ISO/IEC 27001?
Tell us about your current way of working, customer expectations and any certification goals. Together we determine the scope and the right support.