Customers, investors and regulators increasingly want proof that you manage information security deliberately. An enterprise customer’s security questionnaire can stall a deal for weeks, and India’s Digital Personal Data Protection Act expects reasonable security safeguards for the personal data you process. “We take security seriously” is not an answer any of them will accept.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). Certification shows that security in your organisation is governed, measured and improved, with controls chosen to fit your actual risks rather than copied from a checklist. SentryArk takes you from a first risk assessment to a working ISMS and an audit-ready organisation, without burying your team in paperwork.
Risk assessment and management
Every sound security programme starts with knowing what you are protecting. We identify the information assets that matter to your business — customer data, source code, financial systems, the people and suppliers who handle them — then the threats each one faces and the weaknesses that expose it.
Each risk is rated on likelihood and impact and recorded in a risk register with a named owner. We then help you decide how to treat it: reduce it with a control, transfer it, avoid it, or accept it knowingly. The result is a treatment plan with owners and timelines your management can track, and board-level reporting that shows risk going down over time.
Third parties get the same scrutiny. Many of the most serious exposures we find in testing sit in systems built or run by suppliers, so vendor risk is part of every assessment rather than an afterthought.
ISO 27001 implementation
We guide you through the standard step by step. Together we agree the scope of your ISMS, then compare current practice against clauses 4 to 10 and the Annex A controls to show what already exists and what is missing.
From there we write policies and procedures that match how your teams actually work, select the Annex A controls your risks call for, and produce the Statement of Applicability that records each decision. Everything we create is yours to keep and improve after the engagement ends.
Before the certification body arrives, an independent internal audit and management review find the remaining gaps, and corrective actions are closed in time. We then support you through the stage 1 and stage 2 audits, help you respond to any auditor findings, and plan for the surveillance audits that follow.
Controls that work in practice
Most ISO 27001 consultants stop at documentation. Our team also runs penetration tests, red team engagements and a 24/7 SOC, so the technical controls we recommend are ones we have seen hold up — and seen fail — against real attackers.
That changes the advice you get. When your Statement of Applicability says access is reviewed, logs are monitored and vulnerabilities are patched, we can test whether that is true. A penetration test or SOC onboarding alongside your ISMS turns paper controls into evidence an auditor, a customer or a regulator can follow.
How an engagement runs
- Scoping and gap analysis — agree the ISMS scope and measure current practice against the standard.
- Risk assessment — inventory assets, assess threats and vulnerabilities, and build the risk register.
- Risk treatment and controls — select and implement controls, write policies, and prepare the Statement of Applicability.
- Internal audit and review — an independent internal audit and management review, with corrective actions closed.
- Certification support — through stage 1 and stage 2 audits, and planning for surveillance.
What we test
- Asset and data inventory — what you hold, where it lives and who owns it
- Threat and vulnerability analysis for each asset
- Risk rating, risk register and treatment plan with named owners
- Third-party and vendor risk
- ISMS scope, policies and procedures for clauses 4 to 10
- Annex A control selection and the Statement of Applicability
- Internal audit and management review
- Support through stage 1 and stage 2 certification audits
What you receive
- Gap analysis report against ISO/IEC 27001:2022
- Risk register and risk treatment plan
- Statement of Applicability
- ISMS policies and procedures
- Internal audit report and corrective action plan
- Certification audit support
- Board-level risk reporting
Frequently asked questions
Do you issue the ISO 27001 certificate?
No. Certificates are issued by accredited certification bodies after an independent audit. We prepare you for that audit — scope, risk assessment, controls, documentation and internal audit — and support you through it, so the certification body's audit has no surprises.
How long does it take to get ready for certification?
It depends on your size, scope and how much is already in place. The gap analysis at the start tells us what is missing, and we agree a realistic timeline in the proposal before work begins.
Can you do a risk assessment without a full ISO 27001 project?
Yes. Many clients start with a standalone risk assessment to answer a customer questionnaire, prepare for a board review or prioritise security spending. The risk register it produces carries straight into an ISMS later if you decide to certify.
We are already certified. How can you help?
We can run your internal audit independently, refresh your risk assessment, help you move to the 2022 version of the standard, and test the technical controls your Statement of Applicability says are in place.