Home  Security Services  ISMS & ISO 27001

ISMS & ISO 27001
— certified, continuously

An Information Security Management System that passes the audit and keeps running afterwards — ISO/IEC 27001:2022 controls mapped once, evidenced automatically, reused for NIS2, DORA, SOC 2 and Cyber Essentials Plus.

Talk to us about this All Security services

ISMS & ISO 27001

SECURITY SERVICES

Topics we cover

ISO 27001:2022Annex A 2022 controlsStatement of ApplicabilityContinuous complianceNIS2DORASOC 2 Type IICyber Essentials PlusISO 27701Compliance automation

Status quo · late 2026

What has changed — and why it matters now

The 2022 transition is over

Every certificate is now on ISO 27001:2022 — 93 Annex A controls, four themes, and new controls for cloud, threat intelligence, data masking and secure coding that auditors actively test.

One control set, many regimes

NIS2 and DORA are live across the EU and the UK Cyber Security and Resilience Bill is landing. Boards want a single control framework that evidences all of them, not parallel spreadsheets.

Evidence is collected by machines

Compliance-automation platforms pull evidence from Entra, AWS, GCP, GitHub and HR systems continuously. A once-a-year audit sprint is now a red flag to customers and insurers.

How we approach it

Our method for ISMS & ISO 27001

01Scope & contextInterested parties, legal register, interfaces, and a scope that matches how you actually sell — including AI systems and SaaS estate.

02Risk methodologyAsset- and scenario-based risk assessment aligned to ISO 27005, with risk appetite the board has signed.

03Controls & SoAAnnex A 2022 mapped to your stack; SoA justified control by control; policies written to be read.

04Operate & evidenceAutomated evidence collection, internal audit programme, management review, KPIs and corrective action tracking.

05Stage 1 & 2Auditor selection, readiness review, certification support and the surveillance cycle after.

In depth

One ISMS, several certificates

ISO 27001 + 27017 / 27018

Cloud-specific and PII-in-cloud extensions for SaaS providers.

ISO 27701

Privacy Information Management layered onto the ISMS for GDPR accountability.

ISO 42001

AI Management System sharing the same risk, audit and management-review machinery.

SOC 2 crosswalk

Trust Services Criteria mapped to Annex A for US customers.

NIS2 / DORA

Article-level mapping for essential entities and financial services ICT risk.

What you get

Deliverables

Risk assessmentsPolicy frameworksControls mappingAudit readinessCertification support

Technology-agnostic

Platforms we work across

We design for the outcome first and choose the platform second — across Microsoft, AWS and Google Cloud, and every major AI provider.

Microsoft Purview Compliance ManagerAWS Audit ManagerGoogle Cloud Security Command CenterVantaDrataServiceNow IRM

More Security services

Penetration Testing SOC & Security Monitoring Security Architecture Identity & Access Management Vulnerability Management DevSecOps & Secure Development GDPR & Data Protection GRC Programmes

Ready to talk about ISMS & ISO 27001?

One email reaches the architects and engineers who will do the work. We reply within one working day.

info@uspc.co.uk Contact page

ISMS & ISO 27001— certified, continuously