ISO/IEC 27001 certification
An information security management system helps organisations manage information-security risk and protect the confidentiality, integrity and availability of information. AAA provides an impartial, predominantly remote certification journey with clear audit planning and communication.
What the audit evaluates
Risk management
How information-security risks are assessed, treated, accepted and kept under review.
Controls and evidence
How selected controls and the Statement of Applicability align to identified risks.
Governance and improvement
How leadership, competence, monitoring, internal audit and corrective action sustain the ISMS.
How the certification journey works
We agree the information, services, locations and boundaries covered by the proposed certification. The audit programme reflects the complexity of your organisation and its information security risks.
1. Application and planning
Tell us about your services, people, sites and technology to see an initial fee based on your answers. We then review the declared ISMS scope and plan the audit programme.
2. Stage 1 and Stage 2
Stage 1 reviews the design and readiness of the information security management system. Stage 2 samples how risk treatment and controls operate in practice through interviews and evidence.
3. Review and decision
Findings are recorded clearly. After any required response, technical review and an independent certification decision take place before a certificate is issued.
Audits are predominantly remote where appropriate to the scope and risks. Sensitive evidence is handled through agreed, controlled channels.
What evidence might we sample?
We look at how the ISMS is defined, managed and used in the agreed scope. Depending on your activities, evidence may include:
Risk and treatment
The risk assessment method, risk decisions, treatment plan and Statement of Applicability, including reasons for control selection or exclusion.
Controls in use
Examples from access management, asset handling, supplier security, incident response, continuity and technical operations relevant to the scope.
Oversight and improvement
Objectives, performance measures, internal audits, management review and corrective action where controls or outcomes need attention.
AAA assesses your ISMS independently. We explain audit criteria and findings but do not implement the controls we certify.
Make the ISMS boundary clear
Describe which information, services, teams and locations the certification covers, and where suppliers or hosted services fit into that boundary. For example, a cloud service may rely on outsourced hosting and remote staff; the scope should still make the organisation’s responsibilities and interfaces understandable to a buyer. The audit samples your own risk decisions and the controls you selected in the Statement of Applicability.
Build the right audit programme
The initial fee reflects your declared people, sites, activities and standards. Annual surveillance is priced separately. Any agreed physical onsite days are charged at £400 per day plus VAT.