Get your security programme ready to be audited, with the evidence in order

ISO/IEC 27001 is a standard for an information security management system, usually called an ISMS. It is less a list of technical settings than a method: define the scope, assess risk, choose controls, operate them, check them and improve them. The clauses describe the management system. Annex A lists reference controls across organisational, people, physical and technological themes, and the 2022 edition reorganised them into 93 controls.

Our work stops at readiness. That means a scope statement, a gap assessment, a risk register, a Statement of Applicability, the policy set, a working internal audit and a management review. Certification is a different activity. It is performed by a certification body that has been accredited to audit against the standard, and you choose and contract that body yourself. We do not issue certificates and we cannot promise an audit result or a date, because the auditor decides. What we can do is make sure that when the auditor arrives, your documents, records and people tell the same story.

A good readiness project is mostly conversation. We start with scope, because a narrow, honest scope (for example one product line and the cloud platform behind it) is cheaper to prepare and easier to defend than a vague company-wide claim. You can widen it later. Then we interview process owners in IT, HR, procurement, legal and operations, and compare what they say with what systems and tickets show.

From there we build the risk register with you, not for you. Risk ratings are your business judgement, so the owners must be in the room. Controls follow from risk, and the Statement of Applicability records which Annex A controls you apply and why you exclude any others. Policies are written last and kept short. Expect 8 to 16 weeks for a mid-sized company with one or two sites, depending on how much evidence already exists and how quickly owners respond. After the audit body is engaged, a first-stage review of documents is followed by a second stage that looks at how controls operate in practice, so operating records matter as much as documents.

Saudi companies rarely face one framework alone. The National Cybersecurity Authority publishes the Essential Cybersecurity Controls, which many government-linked and critical-sector organisations must meet, and the Personal Data Protection Law sets duties for anyone handling personal data. These are separate obligations from ISO 27001, and meeting one does not meet another. They overlap heavily, though: access control, logging, incident response, supplier management and business continuity appear in all of them.

So we map your control set across frameworks once. A single access control procedure, with its evidence, can be shown against the relevant ISO 27001 control, the matching NCA ECC control and the PDPL security duty. This saves months of duplicate documentation and makes later projects cheaper. If your first priority is the NCA requirement or personal data, we pair this work with our NCA ECC readiness and PDPL engineering services, and with secure development practice if you build software. Customers ask for ISO 27001 evidence in tenders and security questionnaires, so having a prepared scope and Statement of Applicability also speeds up sales conversations.