ISO 27001

ISO 27001 certifies that you run an information security management system, not that you own a set of tools. The auditor checks whether your scope, risk treatment and controls fit together and stay in operation. turingsecure holds the controls, the evidence and the audit trail behind each step, so the certificate reflects work you can prove.

What the Standard Requires

An ISMS the Auditor Can Follow End to End

ISO 27001 is built around a management system. You define the scope of the ISMS, decide which assets, sites and services it covers, then run a risk assessment and choose a treatment for each risk you accept, reduce or transfer. The Statement of Applicability records which of the Annex A controls apply and why, and it is the document the auditor works from first.

Certification then happens in two stages. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the controls actually operate. After the certificate is issued, annual surveillance audits and a recertification every three years check that the system keeps improving rather than standing still.

ISO 27001 ISMS scope, risk treatment and Statement of Applicability

The Certification Journey

Four Steps, Each Backed by Records

Scope and Risk: Define what the ISMS covers, then assess and treat risk. turingsecure keeps the risk register and the treatment decisions next to the assets they apply to.
Statement of Applicability: Record which Annex A controls apply and why. The control library tracks applicability, owner and implementation status for every entry.
Stage 1 and Stage 2: The documentation review and the operating audit run against one system. Findings become corrective actions you can track to closure.
Surveillance and Improvement: Evidence stays linked to controls with expiry reminders, so each annual surveillance audit finds a current, working management system.