ISO 27001 services

ISO 27001 consulting and information security services

Scoped, outcome-oriented services to understand gaps, prepare for an audit, close findings, build the ISMS foundation, or keep follow-up in motion.

Start with the problem you need to solve

Not every organization needs to start with a full implementation. Identify your situation and go straight to the service that fits.

You do not yet have a clear view of your ISO 27001 gaps or where to start.Assessment You already have an ISMS and an audit coming up, but you do not know whether the evidence and controls are actually prepared.Audit preparation You have specific findings, but not a bounded plan to close them in an orderly, verifiable way.Remediation You want to start a serious ISMS, but you do not yet have a coherent document and governance structure to implement it.ISMS foundations You already have an ISMS and an action list, but you need to keep pace and priorities without hiring continuous operations.Monthly follow-up

ISO 27001

ISO 27001 services

Each service states its perimeter, its deliverables, and its limit. The price applies to the standard scope.

01Assessment 02Audit preparation 03Remediation 04ISMS foundations 05Monthly follow-up

Recommended starting point

ISO 27001

ISO 27001 assessment + action plan

One-time

From2.400USD

Understand the relevant gaps and leave with a clear, prioritized, executable action plan.

What problem it solvesYou do not yet have a clear view of your ISO 27001 gaps or where to start.

Standard scope1 legal entity + 1 primary service

A structured view of your current situation and a prioritized action plan.

3interviewsup to 60 min
15documentssubstantive
25evidence itemsorganized
5critical third partiessample

Delivery: 15 business days

about 3 weeks

Price for the standard scope

What’s included

Structured review against ISO 27001 on the agreed perimeter.
Document and evidence review.
Up to 3 interviews with key owners.
Assessment of clauses 4–10 and review of Annex A.
Prioritization of gaps and actions.

What you receive

Executive report.
Assessment matrix.
Prioritized action list.
90–180 day plan.
Readout session.

Not included

Audit or certification.
Implementation or technical remediation.
Penetration testing.
Rebuilding inventories or evidence from scratch.

Entry conditions

Scope and counterpart confirmed.
Minimum information available.
Access to the agreed repository or channel.

The calendar begins when scope, counterpart, and minimum information are available. Delays attributable to the client pause the timeline.

Before a specific audit

ISO 27001

ISO 27001 audit preparation

One-time

From3.250USD

Review evidence, detect blockers, and arrive at the audit with a realistic view of how prepared you are.

What problem it solvesYou already have an ISMS and an audit coming up, but you do not know whether the evidence and controls are actually prepared.

Standard scope1 entity + 1 scope + 1 standard

An assessment of the preparation level, the blockers, and the actions still needed before the audit.

4ownersmaximum
30evidence itemsorganized
1drillup to 90 min
1final reviewconsolidated

Delivery: Timing to be confirmed

according to the audit date and scope

Price for the standard scope

What’s included

Confirmation of the audit scope and context.
Review of mandatory documentation, risks, treatment, and SoA.
Contrast of up to 30 evidence items with up to 4 owners.
Identification of blockers and evidence weaknesses.
Audit drill of up to 90 minutes.

What you receive

Evidence index with status.
Matrix of preparation blockers and gaps.
Drill record.
Audit preparation level report.
Recommendation: proceed / proceed with conditions / postpone.
Pre-audit action plan.

Not included

Creating or rewriting the ISMS.
Generating historical evidence.
Independent internal audit.
Full accompaniment during the audit.
Certification guarantee.

Entry conditions

Existing ISMS and stable scope.
A specific audit identified.
Current risks and SoA.
Controls operating.
Evidence organized.

This service assesses preparation and helps organize pending items. It does not replace the audit or rebuild the ISMS.

To close specific findings

ISO 27001

Compliance remediation sprint

One-time

From2.650USD

Turn a small set of related findings into clear, verifiable actions.

What problem it solvesYou have specific findings, but not a bounded plan to close them in an orderly, verifiable way.

Standard scope1 domain + up to 3 related findings

Clear actions, owners, and closure criteria for a small set of related findings.

3findingsmaximum
2workshopsmaximum
4deliverablessmall
1verificationincluded

Delivery: Bounded project

timing according to the validated finding

Price for the standard scope

What’s included

Confirmation of cause, impact, and closure criterion.
Response design and action prioritization.
Up to 2 workshops with owners.
Creation or adjustment of up to 4 small deliverables or 1 main deliverable.
Verification on the agreed sample.

What you receive

Finding analysis.
Remediation plan.
Documents or records included in scope.
Instructions for owners.
Closure or blocker note.

Not included

Technical configuration, development, or migrations.
Penetration testing or technical tests.
New findings discovered during the sprint.
Open-ended support.

Entry conditions

Finding understood and accepted.
Technical owner available.
Closure criterion defined.

If a finding becomes a technical project, it leaves the standard sprint and is re-estimated before continuing.

To build the ISMS foundation

ISO 27001

ISO 27001 ISMS foundations

One-time

From7.200USD

Define the governance, risk, and control base you need before developing a complete ISMS.

What problem it solvesYou want to start a serious ISMS, but you do not yet have a coherent document and governance structure to implement it.

Standard scope1 legal entity + 1 primary service

A recognizable, usable document base to start implementation with clear order and priorities.

1ISMS manualbase
3procedureskey
30assetsinitial inventory
93controlsinitial SoA

Delivery: Delivery by milestones

agreed planning

Price for the standard scope

What’s included

ISMS manual: context, scope, interested parties, governance, roles, objectives, document architecture, evaluation, and improvement.
Information Security Policy aligned with the manual.
Risk management procedure, methodology, and an initial register of up to 15 scenarios with treatment.
Two additional priority operating procedures, chosen at the start from: assets/classification, access, incidents, suppliers, or backup/continuity.
Initial inventory of up to 30 assets and classification criteria.
Initial SoA of the 93 controls with applicability and an initial justification.
Initial map of evidence and records.
Prioritized action list and a 180-day implementation plan.

What you receive

ISMS manual.
Information Security Policy.
3 key procedures: risks + 2 priority procedures.
Initial asset inventory.
Risk and treatment matrix.
Initial SoA.
Initial evidence map.
Prioritized list and 180-day plan.

Not included

Complete operating procedures for IAM, incidents, vulnerabilities, change, continuity, suppliers, or SDLC.
Control operation.
Technical implementation.
Internal audit or certification.
Maintenance.

Entry conditions

Executive owner and scope defined.
Up to 4 owners available.
Architecture and suppliers that can be explained.
Internal capacity to implement afterwards.

The risk procedure is fixed. The other two procedures are chosen from a closed catalog. A broad document library is quoted separately.

Continuity for known clients

ISO 27001

Monthly ISMS follow-up

Monthly service

From1.320USD / mo

Keep priorities, evidence, and the action list under control without turning the service into an open hour bank.

What problem it solvesYou already have an ISMS and an action list, but you need to keep pace and priorities without hiring continuous operations.

Standard scope1 scope + 1 standard already known

Monthly visibility of actions, evidence, blockers, and pending decisions.

90minutesmonthly meeting
12evidence itemsmaximum
8actionsin follow-up
1change or supplierrelevant

Delivery: Monthly

initial commitment of 3 months

Price for the standard scope

What’s included

Monthly follow-up meeting.
Selective evidence review.
Follow-up of up to 8 actions.
Review of one relevant change or supplier.
Monthly update.

What you receive

Action list status.
Priorities for the month.
Blockers and pending decisions.
Next-step recommendations.

Not included

Creating evidence.
Daily operation of controls.
Incident management.
Extraordinary audit preparation.
A second standard or scope.
SLA or hour bank.

Entry conditions

Client and scope already known.
Third-party onboarding is quoted separately.
Monthly follow-up scheduled in advance.

Designed as continuity of previous work, not as an acquisition service and not as a vCISO.

Reference prices for the standard scope. The final scope is confirmed before a proposal is issued. Certification and conformity are not guaranteed.

Scope

Clear scope before you start

The proposal confirms in writing what is reviewed, what is delivered, and what stays out before any technical work is committed.

What you buy

Entity, service or scope, concrete limits, and entry conditions.

What you receive

Named, traceable deliverables, not an open consulting retainer.

Where it ends

Exclusions are part of the scope. No service implies a certification guarantee.

Frequently asked questions

The questions that most often decide which service fits.

What does “1 legal entity + 1 primary service” mean?

The assessment or project is scoped to one company and one coherent primary service, product, or line, for example a SaaS platform or a cloud service. If there are several companies or materially different environments, the scope is re-estimated.

Does OPS certify ISO 27001?

No. These services help assess, prepare, structure, or improve the ISMS. Certification belongs to an independent certification body.

What happens if my case exceeds the standard service limits?

It is identified before work starts, and we propose a re-estimate, an additional service, or a tailored project. The scope is not expanded silently.

What is the difference between Assessment and Audit preparation?

The assessment shows where you are and what to prioritize. Audit preparation starts from an existing ISMS and checks whether documentation, controls, and evidence are sufficiently prepared for a specific audit.

Not sure which service fits?

The first qualification confirms the starting point, the scope, and the next step before any technical work is committed.

Talk to OPS

Start with the problem you need to solve

ISO 27001 services

ISO 27001 assessment + action plan

ISO 27001 audit preparation

Compliance remediation sprint

ISO 27001 ISMS foundations

Monthly ISMS follow-up

Clear scope before you start

What you buy

What you receive

Where it ends

Frequently asked questions

Not sure which service fits?

Let’s design and operate the infrastructure your business needs.