ISO 27001 readiness in Australia.
ISMS scoping, an Annex A gap analysis, a Statement of Applicability, and the policies, risk register and records a stage two auditor samples.
ISO/IEC 27001 certifies that an information security management system exists, operates, and is independently audited. Stage one of the audit reviews the documentation; stage two samples the records of the system in operation.
How readiness work starts
Readiness work starts with the current environment. The management system is scoped, risk is assessed against that scope, each Annex A control is identified as met, partial or missing, the gaps are prioritised against the audit date, and the management machinery is started early enough to have generated records by the time the auditor samples them.
What ISO 27001 certifies
ISO/IEC 27001 is the international standard for information security management systems. The clauses that carry the certification are the management ones: you define the scope of the ISMS, establish a risk assessment and treatment method, set objectives, assign roles, run internal audits, and hold management reviews.
Annex A and the 2022 revision
Annex A supplies the reference control set; the certificate attaches to the management system that selects, operates and reviews those controls.
The 2022 revision reorganised Annex A into 93 controls across four themes, organisational, people, physical and technological, down from the 114 of the previous edition, and added eleven that did not previously exist as named controls, among them threat intelligence, information security for use of cloud services, ICT readiness for business continuity, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. The transition window for certificates issued against the older edition closed on 31 October 2025, so any certificate live now is a 2022 certificate.
Stage one, stage two and surveillance
Certification is an audit in two stages. Stage one reviews your documentation and readiness. Stage two audits the system in operation, sampling records to test whether what is documented is what happens. After that, surveillance audits run each year and recertification on a three-year cycle, so the elapsed time is set by the certification body's calendar as much as by how fast gaps close.
What readiness work involves
The first decision is scope. Scope too wide and the whole organisation is committed to machinery it does not need; scope too narrow and the certificate does not answer the question the buyer is asking.
- Scoping of the Information Security Management System, with the boundary defensible under questioning
- A gap analysis against Annex A controls, assessed against each environment as it runs
- A Statement of Applicability that justifies every inclusion and every exclusion
- Core policies and the documentation an auditor expects, written to your organisation
- A risk register and treatment plan maintained after certification, because surveillance audits sample it
Scope, risk assessment and documentation
Scope is set by which information, which systems, which locations and which people sit inside the boundary, and each of those choices has to hold up under an auditor's questioning.
From there the work is risk assessment against the scoped system, control selection justified in the Statement of Applicability, and the gap between what Annex A expects and what the environment does today. That gap is where the engineering sits: access control that is enforced, logging that is retained and reviewed, secure development practices visible in the pipeline, supplier management that reflects who touches your data.
Documentation is produced from the operating system: the information security policy, the risk assessment and treatment methodology, the risk register, the Statement of Applicability, the topic-specific policies the selected controls require, and the records the clauses demand, meaning internal audit results, management review minutes, corrective actions, and competence evidence.
The clauses an auditor certifies against
Certification attaches to Clauses 4 to 10 of the standard, and the readiness program is organised the same way. Clause 4 sets the context: the issues and interested parties that shape the system, and the scope. Clause 5 is leadership: the information security policy, the roles and their authorities.
Clauses 6 to 10, and Annex A
Clause 6 is planning: the risk assessment and treatment method, the security objectives, and the Statement of Applicability. Clause 7 is support: resources, competence, awareness, communication and documented information.
Clause 8 is operation: the risk assessment run at planned intervals and the treatment plan implemented. Clause 9 is performance evaluation: monitoring and measurement, the internal audit programme, and management review. Clause 10 is improvement: nonconformities recorded with corrective action, and continual improvement. Annex A supplies the 93 reference controls in four themes; the Statement of Applicability is where the two halves meet.
The evidence problem, and why timing decides it
Stage two is an evidence audit. The auditor samples: the last internal audit, the management review that considered it, an access review from this quarter, a change that went through the process, the risk register moving.
Sequencing backwards from the audit date
A management system switched on three weeks before the audit has no records to sample, and records cannot be backdated.
That is the most common reason a readiness program runs late. The controls close on an engineering schedule. The management cycle does not compress: an internal audit and a management review have to have happened, and the operating records have to have accumulated, before anyone can audit them.
So the program is sequenced backwards from the audit date. The machinery that needs elapsed time starts first, while gaps are still open, so the records build while remediation runs. Everything else is scheduled against that spine.
Where we sit, and where we do not
We prepare organisations for certification. We do not certify them: certification is issued by accredited certification bodies, and a firm that did the readiness work cannot audit its own work.
The engineering half
What we bring is the engineering half of the problem, which is where readiness programs usually stall. Control gaps are configuration, code and process changes in live systems, and the firm designs, builds and operates production software. A control is recorded as closed when the evidence exists.
Who leads the work
Readiness work is led by a director who holds the Exemplar Global Certified Lead Auditor credential for ISO/IEC 27001:2022 (certificate C-560291, valid to 25 August 2027). It is an individually held professional credential, and it shapes the work: scope, risk treatment, the Statement of Applicability and the operating records are prepared the way a stage two auditor samples them.
ISO 27001 or SMB1001: which certificate do you need?
Answer the question your buyer is asking. ISO 27001 is what enterprise and government procurement names in contract clauses, and it is the standard recognised offshore.
Cost, SMB1001, and which comes first
It is also the heavier of the two: certification-body fees at the initial audit, surveillance fees annually, and the standing internal cost of operating a management system.
SMB1001 is the Australian tiered standard sized for smaller businesses, certified through CyberCert and listed on a public registry. At Gold a director formally attests against the standard's twenty-seven controls. It answers an Australian buyer quickly and verifiably, and it carries little weight offshore.
The two are not a hierarchy, and the control work overlaps enough that neither is wasted if you later need the other. ISO 27001 for SMBs usually comes second: where no contract names it, SMB1001 certifies first and its controls carry into the Annex A work later.
What does ISO 27001 readiness cost?
Readiness runs as a defined program with milestones toward your audit date, and the quote comes before the work.
- Scope: the systems, environments, locations and people inside the ISMS boundary
- Starting position: documented process, risk management and access governance already in place
- Gap depth: configuration changes, against systems that have to be built
- Runway: whether the audit date leaves time for the management cycle to generate records
- Delivery: hands-on remediation, or a plan your team executes
Certification-body fees, and how to start
Certification-body fees are separate and paid to the certification body directly; they recur, so budget for them early.
Send a brief with your target audit date, the rough shape of the scope you have in mind, and who is asking you for the certificate.
Recent work of this kind
Client confidential
ISO 27001, SOC 2 and SMB1001 audit readiness for a clinical software platform: scoping, gap analysis, control set, assessor documentation.
Questions, answered
How long does ISO 27001 certification take?
The constraint is rarely the gap-closing work. The management system has to operate long enough to produce the evidence stage two samples: an internal audit, a management review, access reviews, a risk register that visibly moves. We sequence that machinery first, and say early if a target date does not leave room for it.
Can Black Shard certify us against ISO 27001?
No. Certification is issued by accredited certification bodies after a stage one documentation review and a stage two audit of the system in operation, and a firm that did the readiness work cannot audit its own work.
Who leads the readiness work?
A director who holds the Exemplar Global Certified Lead Auditor credential for ISO/IEC 27001:2022, certificate C-560291, valid to 25 August 2027. The credential is individually held. Certification itself is issued by an accredited certification body; the credential is what makes the readiness work look like the audit that follows it.
What is the Statement of Applicability?
The document that records which Annex A controls apply to your ISMS, which do not, and the justification for each decision. Auditors read it closely because it is where a scope drawn to avoid work becomes visible. It is written once and maintained thereafter.
Do we need ISO 27001 if we already hold SMB1001?
Only if your buyers ask for it. SMB1001 answers an Australian buyer quickly and is publicly verifiable; ISO 27001 is what enterprise and offshore procurement names in contracts. The underlying control work overlaps substantially, so holding one reduces the work for the other.
What changed in the 2022 revision?
Annex A was reorganised into 93 controls across four themes and eleven new controls were named, including threat intelligence, security for cloud services, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding. The transition window for older certificates closed on 31 October 2025.
Can you do the remediation, or only tell us what is wrong?
Both. The firm builds and operates production software, so control gaps that are configuration, code or pipeline changes can be closed hands-on. Where you have an internal team or a provider, we hand over a plan precise enough to execute and verify the work at each milestone.
Do you work with organisations outside Brisbane?
Yes. An Australian firm, head office in Brisbane, delivering Australia-wide. Readiness work is largely remote by nature: scoping, gap analysis against cloud tenancies and directories, documentation, and the management cycle all run without anyone travelling.
Related reading
The full practice: Compliance & certification readiness.
Tell us the audit date and the scope you have in mind.
Brisbane head office.