ISO 27001 certification, run end to end
From gap assessment to certificate: we scope and build your ISMS, run the internal audit, and sit with you through Stage 1 and Stage 2 with your certification body. Fixed fee agreed up front, delivered by certified ISO/IEC 27001:2022 Lead Implementers and Lead Auditors.
What is ISO 27001 certification?
ISO 27001 certification is independent confirmation by an accredited certification body that your information security management system (ISMS) meets ISO/IEC 27001:2022. The body audits the ISMS in two stages, Stage 1 (documentation) and Stage 2 (implementation), and the certificate is valid for three years with annual surveillance audits.
Who this is for
When ISO 27001 certification is the ask
Certification is usually a commercial requirement before it is a security one. If any of these sound familiar, this is the engagement.
An enterprise customer has made ISO 27001 certification a condition of signing.
A government tender or panel arrangement requires certification from suppliers.
Customer security questionnaires keep landing, and each one takes days to answer.
An investor, acquirer or insurer wants independent assurance of your security.
You are in financial services and want one ISMS that also covers much of what APRA CPS 234 asks for.
What you receive
What the engagement includes
Everything your certification body will ask for, built and evidenced before they arrive.
ISMS scope & design
A defensible ISMS scope (clause 4.3), the information security policy and the risk methodology, matched to how your organisation actually operates. Scope is the decision that most affects cost, and a narrow, defensible one certifies faster.
Risk assessment & Statement of Applicability
A facilitated risk assessment, a treatment plan and the Statement of Applicability covering the 93 Annex A controls, with a justification for every inclusion and exclusion.
Policy & control implementation
Policies written for your environment rather than a template, controls implemented with named owners, and evidence collection set up so it survives the audit, not just the project.
Staff awareness
Awareness training so the ISMS keeps running outside audit week. Auditors interview your staff, and prepared staff are the difference between a smooth Stage 2 and a painful one.
Pre-certification internal audit
The clause 9.2 internal audit your certification body expects to see, run the way they run theirs, with findings closed before Stage 1.
Stage 1 & Stage 2 audit support
We shortlist and brief the certification body, sit in both audits with you, and manage any nonconformities through to the certificate.
The process
How the engagement runs
Typical elapsed time from kick off to certificate is three to six months for an organisation of about 50 staff. Certification body booking lead times affect the end date, so we shortlist early.
Weeks 1–2
Gap assessment
We benchmark your current state against ISO/IEC 27001:2022 and rank what blocks certification, what carries real risk, and what is merely tidy. The fixed-fee quote for the build follows from this.
Weeks 3–6
Design & risk
ISMS scope, security policy, risk methodology, the facilitated risk assessment and the Statement of Applicability.
Months 2–4
Implementation
Controls, policies, evidence collection and staff awareness, implemented with your team and your IT provider rather than around them.
Before Stage 1
Internal audit & management review
The clause 9.2 internal audit and the management review, with findings closed while they are still cheap to close.
Certification
Stage 1 & Stage 2
Your certification body audits the ISMS in two stages. We attend both, and manage any nonconformities through to the certificate.
Already certified to the 2013 edition? That transition window closed in October 2025, so certificates to ISO/IEC 27001:2013 are no longer valid. The path back is a fresh certification audit against the 2022 standard, and existing controls still count towards it.
Pricing
What ISO 27001 certification costs
One fixed consulting fee, quoted in writing after the gap assessment. No hourly billing.
The total cost of certification has three lines, and only one of them is ours: our fixed consulting fee, the certification body's audit fees (paid to them, varying by body and scope), and your own team's time. Our ISO 27001 certification cost guide sets out real figures for each line before you budget.
The consulting fee is fixed by scope, which is why every engagement starts with a cybersecurity gap analysis: you get a ranked remediation plan and a fixed quote for the build. If you want a read on where you stand first, the free ISO 27001 gap assessment takes a few minutes.
Independence
You choose the certification body. We do the rest.
Consultants prepare you; certification bodies certify you. The two roles are kept separate so the certificate means something, and we never issue certificates ourselves. In Australia, choose a body accredited by JAS-ANZ, the government-appointed accreditation body, so the certificate carries weight with enterprise and government buyers.
We help you shortlist bodies by sector experience, scope fit and booking availability against your deadline, brief the one you pick, and sit with you through Stage 1 and Stage 2. Our guide on choosing an ISO 27001 certification body covers the questions worth asking them.
Why CyberNinja
Why organisations choose us
Auditors build your ISMS
Our consultants hold ISO/IEC 27001:2022 Lead Implementer and Lead Auditor certifications, so the ISMS is built the way it will be audited.
Proven outcomes
More than 20 ISO 27001 certifications delivered for Australian and New Zealand organisations, across fintech, SaaS, allied health and e-commerce.
Independent advice
We hold no reseller agreements and take no vendor margin, and we never issue certificates. The advice you get is the advice that fits you.
Fixed scope, fixed fee
The engagement is scoped with you after the gap assessment and quoted as a fixed fee in writing. No hourly billing, no surprise extras.
Want the standard itself first? Our ISO 27001 framework guide explains the clause structure and what an ISMS must show, and the knowledge base goes clause by clause.
FAQ
ISO 27001 certification FAQs
Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.
Ready to get certified?
Tell us who is asking for certification and when they need it. We will scope the work and give you a fixed price, so you know the cost before you commit.