What this service covers
ISO/IEC 27001 specifies requirements for an information security management system. Fusion helps organisations connect information assets, risks, responsibilities and implemented controls to a clearly defined ISMS scope.
Who should consider it?
IT businesses, professional-service firms and other organisations handling information that matters to customers, operations or contractual commitments.
How Fusion supports your team
- Agree the ISMS scope, interfaces and information responsibilities.
- Support a documented risk-assessment and risk-treatment approach.
- Organise the Statement of Applicability and evidence ownership.
- Prepare internal audit, management review and corrective-action follow-up.
Prepare these records for the initial discussion
The final checklist depends on the agreed scope. An initial review can start with:
- Scope, asset and risk information appropriate to the business.
- Risk-treatment records and the Statement of Applicability.
- Evidence of access management, supplier oversight and relevant operational controls.
- Incident, competence, audit and review records.
A practical issue to resolve early
A policy set is not proof that controls operate. Evidence must match the actual systems and services in scope. An ISMS certificate is not a guarantee that a security incident can never occur.
Timeline and cost factors
The programme depends on your scope, sites, existing documentation, evidence gaps, testing needs and internal availability. External assessment fees and schedules are separate from consultancy. Share the relevant information so we can define a realistic scope, responsibilities and quotation; no fixed timeline or outcome is guaranteed.
Common questions
Who makes the final decision?
Fusion Certification is an independent consultancy. We support preparation, documentation and implementation. Assessment, certification, rating or approval decisions belong to the relevant independent body or scheme authority.
Can you quote without reviewing the scope?
An initial estimate may be possible, but a dependable proposal needs the activities or products, sites, intended customer requirement and available records. Testing, travel and external-body charges should be identified separately.
What should I share first?
Share the exact buyer or tender requirement, your activity or product range, site locations and any existing certificate or assessment report. Do not send confidential records through a public form; we can agree a suitable exchange method.
Authoritative reference
ISO official ISO/IEC 27001 information. Scheme and standard requirements should be checked again when the engagement scope is agreed.