Remote GRC service
ISO 27001 Consultant
Remote ISO 27001 consulting: gap analysis, ISMS scope, risk assessment, Statement of Applicability, policies, internal audit and certification audit preparation for ISO/IEC 27001:2022.
ISO/IEC 27001 certification shows customers that information security is run as a managed system. Getting there means scoping the ISMS, assessing risk, choosing and evidencing Annex A controls, and proving the system works through internal audit and management review.
Ian helps organisations plan and run that work remotely, from a first gap analysis to a ready-for-audit ISMS. Available as a consulting project, a fixed-term contract or as part of a full-time remote role, depending on what your organisation needs.
Who it is for
- Organisations whose customers or tenders now ask for ISO 27001 certification.
- Teams with SOC 2 or NIST CSF work in place that want to extend to ISO 27001.
- Certified organisations that need help with surveillance audits or a backlog of findings.
What is included
- Gap analysis against ISO/IEC 27001:2022 clauses 4 to 10 and all 93 Annex A controls.
- ISMS scope statement, context and interested parties analysis.
- Risk assessment method, risk register and risk treatment plan.
- Statement of Applicability linked to risks and evidence.
- Information security policy and topic-specific policies.
- Internal audit, management review pack and certification audit preparation.
How it works
- 1Scope and gap analysis. Agree the ISMS scope and measure the current position against every clause and control.
- 2Plan. Turn the gaps into a prioritised plan with owners, dates and the evidence each control needs.
- 3Build. Run the risk assessment, write the SoA and policies, and support control owners as controls are implemented.
- 4Verify. Run the internal audit and management review, close findings and prepare for Stage 1 and Stage 2.
Frequently asked questions
Can ISO 27001 consulting be done fully remotely?
Yes. Gap analysis, risk workshops, policy writing, evidence reviews and internal audits can all be run over video calls and shared documents. Physical controls are reviewed with photos, walkthrough videos or a local contact.
Do you need a consultant to get ISO 27001 certified?
No, but an experienced guide shortens the path, avoids over-engineering and helps you avoid common audit findings. Many organisations use a consultant for planning and audit preparation and run the controls themselves.
What is the first step towards ISO 27001?
Agree the scope and run a gap analysis. The free GRC Compliance Readiness Assessment on this site gives a quick first view before a full review.
Free resources
Work together
Share your role, contract or project and Ian will reply by email to discuss scope and timing.
Go to the request form