Prepare an information security management system around your services, risks and customer commitments. Fusion helps connect policies with the controls and operating evidence your organisation needs to demonstrate.
Review my ISMS scope and readiness →
What this service covers
ISO/IEC 27001 specifies requirements for an information security management system. Fusion helps organisations connect information assets, risks, responsibilities and implemented controls to a clearly defined ISMS scope.
Who should consider it?
IT businesses, professional-service firms and other organisations handling information that matters to customers, operations or contractual commitments.
How Fusion supports your team
- Agree the ISMS scope, interfaces and information responsibilities.
- Support a documented risk-assessment and risk-treatment approach.
- Organise the Statement of Applicability and evidence ownership.
- Prepare internal audit, management review and corrective-action follow-up.
Prepare these records for the initial discussion
The final checklist depends on the agreed scope. An initial review can start with:
- Scope, asset and risk information appropriate to the business.
- Risk-treatment records and the Statement of Applicability.
- Evidence of access management, supplier oversight and relevant operational controls.
- Incident, competence, audit and review records.
A practical issue to resolve early
A policy set is not proof that controls operate. Evidence must match the actual systems and services in scope. An ISMS certificate is not a guarantee that a security incident can never occur.
Timeline and cost factors
The programme depends on your scope, sites, existing documentation, evidence gaps, testing needs and internal availability. External assessment fees and schedules are separate from consultancy. Share the relevant information so we can define a realistic scope, responsibilities and quotation; no fixed timeline or outcome is guaranteed.
ISO 27001 questions organisations ask
Can we define a scope for one service or business unit?
The ISMS scope should clearly describe the activities, locations, information and interfaces included. It must make sense for your risks and customer commitments. Confirm the proposed certification scope with the independent body.
What if our systems are hosted by cloud or outsourced providers?
List the relevant providers, services and shared responsibilities at the scope review. Your preparation should address the information and supplier relationships relevant to the ISMS, rather than assuming outsourcing removes your responsibilities.
Is this a technical security test?
ISO/IEC 27001 concerns an information security management system. Penetration testing, vulnerability assessments and other technical work should be scoped separately where relevant; a certificate does not guarantee that incidents can never occur.
What should we share for an initial proposal?
Provide a short service overview, site list, workforce size, hosting and supplier summary, existing policies or certifications and the customer deadline. Avoid sending passwords, credentials, live vulnerabilities or confidential customer data through the enquiry form.
Authoritative reference
ISO official ISO/IEC 27001 information. Scheme and standard requirements should be checked again when the engagement scope is agreed.