Build an ISMS that can survive after certification.
Certification is a milestone. The ISMS is the operating model. Preparation has to connect context, scope, risk treatment, control applicability, ownership, evidence, internal audit, management review, corrective action, and continual improvement.
Documentation should describe the system, not substitute for it.
Context & scope
Interested parties, issues, boundaries, interfaces, dependencies, and the part of the business the ISMS governs.
Risk & treatment
Methodology, evaluation, treatment decisions, objectives, and the logic connecting risk to control selection.
Control operation
Ownership, implementation, evidence, exceptions, competence, communication, and recurring activity.
Review & improvement
Monitoring, internal audit, management review, corrective action, objectives, and continual improvement.
The SoA should be the visible logic of the ISMS, not a copied control list.
Why is this control applicable?
Control applicability should follow context, risk treatment, obligations, and the organization’s chosen control environment.
Can the organization support the claim?
Ownership, implementation status, operating evidence, exceptions, and dependencies should match what the SoA says.
An ISMS stays alive through its feedback loop.
Controls run as designed.
Processes, objectives, and responsibilities function day to day, not just on paper.
Performance gets tracked.
Effectiveness, changes, and exceptions are captured as they happen, not reconstructed later.
Someone checks independently.
Internal audit evaluates the system on its own, separate from the people who operate it.
Leadership evaluates the system.
Suitability, adequacy, and effectiveness get a real executive review, not a rubber stamp.
The system gets better.
Corrective action and changed objectives close the loop instead of repeating the same gaps.
What buyers usually need clarified.
Which version do you prepare against?
ISO/IEC 27001:2022, the current version. It restructured Annex A into four themes instead of fourteen clauses and placed more weight on the management system itself, which is why this engagement treats the ISMS as the actual deliverable rather than a static list of controls to check off.
Do you issue the certificate?
No. Certification is issued by an independent, accredited certification body after Stage 1 and Stage 2 audits. Neon Clarity prepares the management system, risk treatment, and evidence so that process goes smoothly, but the certification decision itself belongs to that independent body.
Do you only assess Annex A?
No. Preparation includes the management-system clauses, risk treatment, Statement of Applicability, control operation, evidence, internal audit, management review, and improvement.
How long does ISO 27001 preparation take?
Timeline depends on how much of the management system already exists. Organizations starting from a mature security program often move faster than those without existing risk treatment or evidence practices.
Can you support the surveillance audits after certification?
Yes. Continuous Compliance or Fractional CISO support can help keep the ISMS operating between certification and recertification cycles.
Prepare for certification by building the system that comes after it.
Bring us the certification pressure, current ISMS, SoA, audit timeline, or customer requirement. We will prepare the management system, not just the document set.
You do not need to diagnose the exact engagement before contacting us. Bring the pressure, milestone, or decision.
Talk Through the AssessmentExplore All Assessments