Size and sites
The more employees, sites and systems belong to the ISMS, the more has to be recorded and checked.
·ISO/IEC 27001:2022
ISO 27001 consulting from gap analysis to audit
We build the information security management system with your team, prepare you for the audit by the certification body and accompany you through it. From Frankfurt, across Germany, on site or remote.
·WHAT CONSULTING DELIVERS
What ISO 27001 consulting delivers
An ISMS (information security management system) is a set of fixed roles, rules and procedures a company uses to manage its information risks. The standard ISO/IEC 27001:2022 defines what belongs to it. We build and prepare, an independent body issues the certificate.
- 01
Building the ISMS
We set up the management system with your team: scope, risk assessment, policies, controls and evidence.
- 02
Rehearsal before the audit
Internal audit and management review show where work is still needed before the certification body audits.
- 03
Consulting and certificate kept separate
An accredited certification body issues the certificate after its own audit. You choose the body yourself, we accompany the audit of any accredited body.
ISO 27001 is voluntary. The trigger is usually customer requirements, tenders or the obligations under NIS 2.
·DURATION AND EFFORT
What duration and effort depend on
A reliable schedule only exists after the gap analysis. Four factors determine it.
Scope
You define which sites, departments and systems the ISMS covers. A narrow scope shortens the path, but it has to match what your customers require.
Starting point
Existing policies, processes and technical safeguards count. The gap analysis shows what already holds and what is missing.
Your team's time
An ISMS cannot be imposed from outside. How much time your specialists and management contribute sets the pace.
·SERVICES
What we take on in detail
Six building blocks from the first comparison to operation after the certificate.
- 01
Gap analysis
Your status compared with the standard, with an order of implementation and a schedule.
- 02
Risk assessment and statement of applicability
Assess risks, select controls from Annex A and justify which apply and which do not.
- 03
Policies and measures
Information security policy and topic policies for approval by management, plus implementation of the controls with your team.
- 04
Internal audit
The rehearsal before the real audit, with report and follow-up. Plus the management review.
- 05
Support in the certification audit
Preparation for both stages of the audit and support on the audit days.
- 06
Operation after the certificate
Preparation of the annual surveillance audits, ongoing care of the ISMS and, on request, the role of external information security officer.
·PROCESS
Six steps to the certificate
From the first comparison to the audit by the certification body.
- 01
Gap analysis
Compare the current state with the standard
- 02
Scope
Define sites, departments and systems
- 03
Risk assessment
Assess risks, select controls
- 04
Measures
Implement controls, approve policies, train staff
- 05
Internal audit
Rehearsal and management review
- 06
Certification
Audit in two stages: first the documents, then the practice
Start: gap analysisResult: certificate, valid for three years
On request we also take on technical controls such as penetration testing and round-the-clock SOC monitoring.
See cybersecurity →·ISO 27001, NIS 2 AND IT-GRUNDSCHUTZ
Three frameworks, three roles
ISO 27001 is an international standard, voluntary, with a certificate from an accredited body. NIS 2 is law and mandatory for affected entities. According to the BSI, the German Federal Office for Information Security, an ISO certificate does not replace evidence under NIS 2, but it is a good foundation.
BSI IT-Grundschutz is the German federal methodology with ready-made modules, common in public authorities. The certificate “ISO 27001 on the basis of IT-Grundschutz” is issued by the BSI. Which path fits depends on who requires the evidence from you.
We live what we advise GermanAI Defense has itself been certified to ISO/IEC 27001:2022 since May 2026, audited by the accredited certification body A-Mark Ratings Limited (certificate no. 26052601, valid until 25 May 2029). More on Security & Compliance →
As of 13 October 2026. Standard reference: ISO/IEC 27001:2022. The certificate is valid for three years, with an annual surveillance audit.
Questions about ISO 27001? Answers
What does ISO 27001 consulting do?
It builds the information security management system (ISMS) with your team: roles, rules and evidence. The result is a company that is ready for the audit by the certification body. The consultant does not issue the certificate.
How long does ISO 27001 certification take?
That depends on the scope, the size of the company and the starting point. A reliable schedule only exists after the gap analysis, because it shows what is already in place and what is missing.
What does ISO 27001 consulting cost?
The cost depends on the same factors as the duration. In addition there are the fees of the certification body, which you commission separately. You receive a quote from us once you have named framework, status and goal.
Is ISO 27001 mandatory?
No, the standard is voluntary. Customers and tenders often require the certificate, though, and it makes providing evidence to business partners easier.
Does an ISO 27001 certificate fulfil the NIS 2 obligations?
Not automatically. According to the BSI, the certificate is not evidence of NIS 2 compliance, but a good foundation. NIS 2 additionally requires, among other things, registration with the BSI, fixed reporting deadlines and training for management.
ISO 27001 or BSI IT-Grundschutz?
ISO 27001 is recognized internationally and leaves more room in implementation. IT-Grundschutz sets more concrete requirements and is mainly common in German public authorities. Which path fits depends on who requires the evidence from you.
Do you issue the certificate?
No. Consulting and certification are separate, an accredited certification body issues the certificate after its own audit. We prepare you for it and accompany you in the audit.