ISO 27001 consulting services
ISO 27001 Consultants for Certification Readiness
BlueRadius is an ISO 27001 consulting firm for mid-market companies. We build the information security management system the standard requires, implement the Annex A controls that fit your risks, and prepare you for the certification body's Stage 1 and Stage 2 audits. We do not issue certificates; an accredited certification body does, and we work alongside the one you choose.
Usually it starts with a customer. A European prospect sends a security questionnaire that asks for your certificate number. An enterprise deal stalls in procurement. Or your board decides it is time to prove the program instead of describing it. Whatever started it, the work is the same: a real ISMS, evidence that it runs, and an audit you pass the first time.
When companies call us
- A customer requires ISO 27001 before they will sign, renew or move you past procurement.
- You have SOC 2 already and need ISO 27001 for international customers without doing the work twice.
- Your certificate is on the 2013 version, which stopped being valid when the transition period ended on October 31, 2025.
- A previous attempt stalled with a binder of policies and no evidence that anyone follows them.
- Leadership wants an independent standard for the security program, not just a self-assessment.
What an ISO 27001 engagement includes
Gap analysis
We compare what you have today against the ISMS requirements in clauses 4 to 10 and the 93 Annex A controls, and give you a written list of what is missing, in priority order. Most companies have more in place than they think; the gap is usually documentation and evidence, not tools.
Scope, risk assessment and Statement of Applicability
We help you draw a scope the auditor will accept and your customers will recognize, run the information security risk assessment, decide how each risk is treated, and write the Statement of Applicability: which Annex A controls apply, which do not, and why.
Control implementation
Access control, logging and monitoring, supplier security, secure development, backup, incident management and the rest of the controls you selected. Where a control needs engineering or IT time, we write the requirement so your team or MSP builds it once, and we keep the evidence organized as it happens.
Policies people actually follow
An information security policy and the supporting procedures, written to match how your company works rather than copied from a template, with awareness training for the people who have to follow them.
Internal audit and management review
The standard requires both before certification. We run or support the internal audit, help leadership hold a management review that produces real decisions, and track corrective actions to closure.
Certification audit support
We help you choose an accredited certification body, prepare your team for Stage 1 and Stage 2, sit with you through the audits, and close out any findings. After certification, our vCISO service can keep the ISMS running through the surveillance audits, with progress tracked in Radius360.
ISO 27001 alongside your other frameworks
ISO 27001 overlaps heavily with SOC 2, and many of our clients hold both. We map the controls once and reuse the evidence; our ISO 27001 vs SOC 2 comparison explains where they differ. Companies handling health data add HIPAA, and those using AI in their products are increasingly asked about ISO 42001, the AI management system standard, which we cover under AI governance. If you are still researching, start with our ISO 27001 certification guide.
Who we work with
- SaaS and technology companies selling to enterprise and international customers
- Professional and financial services firms asked for certification by their clients
- Healthcare technology companies pairing ISO 27001 with HIPAA
- Manufacturers and suppliers in regulated supply chains
- MSPs and IT providers certifying their own operations
Frequently asked questions
What does an ISO 27001 consultant do?
An ISO 27001 consultant helps you build an information security management system (ISMS) that meets the standard and passes certification. That means defining the scope, running the risk assessment, writing the Statement of Applicability, implementing the Annex A controls you select, setting up internal audit and management review, and preparing your team for the certification body's Stage 1 and Stage 2 audits.
Can BlueRadius certify us?
No, and no consultant should. Certification has to come from an accredited certification body, and accreditation rules prevent a certification body from consulting on the same management system it certifies. We prepare you and work alongside the certification body you choose; they perform the audit and issue the certificate.
How much does ISO 27001 certification cost?
There are two parts. The certification body's fee is driven mostly by audit days, which accreditation rules tie to the number of people in scope and the complexity of the ISMS, plus annual surveillance audits after the first certificate. Preparation cost depends on your scope, how much of the ISMS already exists and how much your team does in house. We scope it on a short call and give you a written, fixed-fee quote before any work starts, and we help you get quotes from certification bodies too.
What are the Stage 1 and Stage 2 audits?
Stage 1 is a documentation and readiness review: the auditor checks your scope, risk assessment, Statement of Applicability and core ISMS documents, and confirms you are ready for the main audit. Stage 2 tests whether the ISMS actually operates as documented, using interviews, records and samples of evidence. A certificate is issued after Stage 2 if there are no unresolved major nonconformities.
How long is an ISO 27001 certificate valid?
Three years, with surveillance audits in the first and second years and a recertification audit before the third year ends. The ISMS has to keep running between audits: risk reviews, internal audits, management reviews and corrective actions all leave evidence the auditor will look for.
We still have an ISO 27001:2013 certificate. Is that a problem?
Yes. The transition period to ISO/IEC 27001:2022 ended on October 31, 2025, so 2013 certificates are no longer valid. If you have not transitioned, you are effectively recertifying against the 2022 version, which reorganized Annex A into 93 controls across four themes and added controls such as threat intelligence, cloud services security and secure coding.
Should we do ISO 27001 or SOC 2?
It usually depends on who is asking. International and European customers tend to ask for ISO 27001; US customers more often ask for a SOC 2 report. Much of the control work overlaps, so many companies do both from one control set and reuse the evidence.
Start with a gap analysis
A gap analysis tells you what certification will take, in writing, before you commit to anything else. It is a fixed-fee engagement, quoted after a short scoping call. If you would rather talk it through first, book a free 30-minute consultation.