ISO 27001 Consultancy for International Organisations
Build an information security management system that reflects your business, rather than a collection of documents prepared for an audit. We support ISO 27001 readiness and implementation for defined entities, locations and information-processing activities.
Our Approach to ISO 27001
Build an information security management system that reflects your business, rather than a collection of documents prepared for an audit. We support ISO 27001 readiness and implementation for defined entities, locations and information-processing activities.
Based in the UK. Working internationally.
Our consultancy model supports remote collaboration with leadership and IT teams across locations. At the start of each engagement, we agree the countries and entities in scope, meeting arrangements, delivery responsibilities and any onsite requirements. Service hours and response commitments are set out in the agreed scope.
Everything You Need From ISO 27001
- ISMS scope definition and leadership responsibilities
- Information-security risk assessment and risk treatment
- Statement of Applicability and control selection
- Policies, procedures and supporting records
- Asset, supplier and access management
- Internal audit support, management review and certification readiness
Scoping across entities and locations
International scope needs deliberate boundaries. We agree which entities, locations, suppliers, systems and responsibilities are included, how evidence is gathered and which local obligations need specialist input.
Certification is performed by an independent certification body. Cloud Agile's own certification does not certify your organisation, guarantee a pass or determine your certification scope.
Deliverables depend on the agreed engagement: gap assessment, scope, ISMS roadmap, risk and treatment work, control evidence, readiness support and a review rhythm.
Scope, leadership and risk
Scope determines the size of everything that follows. We define it deliberately, around the services, locations and information that matter, and make sure leadership responsibilities are real rather than nominal.
- Scope statement covering services, locations, people and systems
- Interested parties and the requirements they place on you
- Roles, responsibilities and management commitment
- Risk assessment methodology that your team can actually repeat
- Risk register with owners, treatments and review dates
- Statement of Applicability justifying each control decision
Policies, controls and evidence
Auditors look for a system that is used, not a folder of documents. We write policies that match your working practices, then implement the technical and organisational controls behind them.
- Policy set proportionate to the organisation, not a generic library
- Access control, asset management and supplier assurance
- Technical controls across identity, endpoints, cloud and infrastructure
- Incident management, business continuity and change processes
- Evidence and records generated by routine operation rather than retrofitted
- Awareness and training records
Audit readiness and continual improvement
Certification is awarded by an independent accredited certification body following a formal two-stage audit. Cloud Agile provides consultancy and readiness work; we do not audit or award certification.
Once certified, the system has to keep running: internal audits, management reviews, corrective actions and surveillance audits are part of the ongoing commitment, and we support that cycle.
- Internal audit programme and support in running it
- Management review agenda, inputs and records
- Corrective action and nonconformity handling
- Preparation for stage one and stage two certification audits
- Support during surveillance audits and continual improvement
ISO 27001: key questions answered
What does the service include?
Defining the ISMS scope, the risk assessment and treatment plan, the Statement of Applicability, policies and procedures, implementation of the chosen controls, evidence gathering and internal audit readiness.
How does the certification process work?
Once the management system is operating and producing evidence, an accredited certification body carries out a two-stage audit. If certified, surveillance audits follow during the certification cycle. The duration depends on your scope and starting point.
What does Cloud Agile do, and what does the certification body do?
Cloud Agile helps you build and run the management system and prepare for audit. The accredited certification body audits it independently and decides on certification; we do not certify organisations or guarantee the outcome.
What is priced separately?
Certification body audit fees are quoted and charged by the certification body you appoint. Remedial work is quoted per job. Minor, straightforward fixes may be completed without charge at Cloud Agile's discretion. For third-party costs we publish, see our pricing sources page.
How a Project Works
- 1
Scope
Define the ISMS boundary, leadership responsibilities and objectives.
- 2
Assess risk
Run the risk assessment, agree treatments and build the Statement of Applicability.
- 3
Implement
Put policies, processes and technical controls in place and start generating evidence.
- 4
Audit internally
Run internal audits and management review, then correct what they find.
- 5
Certify and improve
Prepare for the certification audit and keep the system running afterwards.
The Outcomes You'll Actually See
Sized to your organisation
A management system proportionate to the business, which is the only kind that survives contact with daily work.
Built by a certified organisation
We run our own independently certified ISO/IEC 27001 ISMS, so the advice is grounded in doing it, not just reading it.
Evidence as a by-product
Controls are implemented so routine operation produces the records auditors ask for.
What Success Looks Like
- A defined ISMS scope with real leadership ownership
- A working risk assessment, treatment plan and Statement of Applicability
- Policies, controls and evidence aligned to how you operate
- Readiness for an independent certification audit, and support afterwards
Related services
Cyber Security Risk Assessments
A structured risk assessment that feeds directly into ISMS risk treatment and prioritisation.
Governance, Risk & Compliance
The wider governance programme, supplier assurance and ongoing evidence management.
Cyber Essentials Consultancy
A technical baseline that supports several ISO 27001 controls and is often done alongside.
Frequently Asked Questions
Can ISO 27001 cover multiple locations or countries?+
Yes, an ISMS can be scoped across defined locations and activities. The scope, responsibilities and evidence must reflect how those operations work, and certification is assessed by the independent body.
Can one ISMS cover several legal entities?+
Yes, if the scope statement defines them. We agree which entities, locations, activities and interfaces are included, and record any exclusions with a justification, before implementation begins.
Who does what between Cloud Agile and our internal team?+
We agree it in writing. Typically we provide the consultancy, templates and technical control implementation; your team owns the ISMS day to day, provides evidence and approves risk decisions; leadership signs off scope, policy and risk acceptance.
Does ISO 27001 replace local regulation?+
No. Certification concerns the defined management system. Applicable legal, regulatory and contractual obligations still need to be identified and addressed.
Does Cloud Agile award ISO 27001 certification?+
No. Certification is awarded by an independent accredited certification body following a formal audit. We provide consultancy, implementation and readiness support, and we support you through the audit process.
Is Cloud Agile itself certified?+
Yes. We operate our own independently certified ISO/IEC 27001 information security management system, which is one reason our advice is practical rather than theoretical.
How long does ISO 27001 take?+
For an SME starting from a reasonable security baseline it is typically several months of implementation before the certification audit, depending on scope, resource availability and how much needs building from scratch.
We already have Cyber Essentials. Does that help?+
It helps with several technical controls and shows a baseline is in place, but ISO 27001 is a management system covering risk, governance and process as well. The existing work is reused wherever it applies.
Our Other Services
IT Support & Managed IT
Keep your people productive and your IT reliable with practical helpdesk support, proactive maintenance and expert technical assistance. Choose fully managed support or additional capability alongside your internal team.
Cyber Security
Layered cyber defence that protects revenue, reputation and the contracts that require it.
Governance, Risk & Compliance
Governance, risk and compliance built into how you work, turning assurance into a commercial advantage.
Backup & Disaster Recovery
Business continuity by design, tested resilience your board, customers and insurers can rely on.
Cloud & Infrastructure
A cloud platform engineered around your business, secure, scalable and aligned to your growth plan.
AI Consultancy & Automation
AI governance, security, implementation and maintenance alongside your IT and compliance teams.
Strategic IT Consultancy (vCIO)
Senior technology leadership on tap, the roadmap, budget and boardroom voice IT deserves.
Make your next decision with a clearer view
Discuss your technology risk, assurance requirement or internal IT priorities with Cloud Agile.
Or call 0333 344 2141