ISO/IEC 27001 Information Security Management System Consulting
We help you scope, build and operate an ISMS that fits your organisation and prepare for an independent certification audit.
ISO/IEC 27001 is the international standard for establishing, operating and continually improving an information security management system (ISMS) that protects the confidentiality, integrity and availability of information. It does not prescribe products; it asks organisations to identify their own risks, select suitable controls and run everything through a documented, auditable management cycle.
Scope of our consulting
- Context and scope: internal and external issues, interested parties and a clear scope statement.
- Asset inventory and risk assessment: a fit-for-purpose methodology, risk owners, acceptance criteria and treatment options.
- Annex A and SoA: reference controls grouped into organisational, people, physical and technological themes, documented in a Statement of Applicability linked to risk treatment.
- Policies and procedures: concise documents people actually follow.
- Technical controls: MFA, endpoint security, logging, backups, vulnerability scanning and segmentation, delivered through Racurity solution partners where needed.
- Awareness, internal audit and management review before the certification audit.
Certification
Certificates are issued by independent accredited certification bodies, usually after a two-stage audit, followed by surveillance audits and recertification. We prepare you for these audits; the certification decision belongs entirely to the certification body and no consultant can guarantee it.
Records that keep the ISMS alive
Auditors judge a management system by its records: access reviews, change logs, backup restore tests, vulnerability scan follow-ups, incident reports, supplier assessments and training attendance. We plan these from day one, using data your existing systems already produce.
Why us
Our management system consultants work alongside our SIEM, SOC, penetration testing and infrastructure teams, so risk treatment actions are implemented rather than left on paper. KVKK compliance and the ISMS can share one asset inventory and risk structure.
Frequently asked questions
Do you issue the ISO 27001 certificate?
No. Certificates are issued by independent accredited certification bodies. We provide consulting for implementation and audit readiness.
Can a small company implement ISO 27001?
Yes. The standard scales; smaller organisations work with a narrower scope, simpler documents and fewer complex controls.
Contact
Head office: Ataşehir, Istanbul. We work in person across Istanbul and online with clients all over Türkiye and abroad. Message us on WhatsApp (+90 551 044 08 69) or email ekip@racoun.com.
