Information security | ISO/IEC 27001
ISO 27001 consultants for Australian businesses
Build a credible information security management system with a defined scope, traceable risk decisions and evidence that controls operate in practice.
What ISO/IEC 27001 certification preparation involves
ISO/IEC 27001:2022 specifies requirements for an information security management system. The approach should be driven by the organisation’s information security risks and business context.
ISMS scope and risk methodology
Define boundaries, information assets and dependencies, then assess and treat information security risks.
Statement of Applicability
Document the applicability of Annex A controls and retain the rationale for inclusion or exclusion.
Operational assurance
Establish security objectives, performance evaluation, internal audit, management review and corrective action records.
How Tenbray can assist
Tenbray supports ISO 27001 gap assessments, ISMS development, risk and control documentation, internal auditing and Stage 1/Stage 2 certification preparation.
Frequently asked questions
Does ISO 27001 require every Annex A control?
No. Control selection follows the organisation’s risk treatment process and other applicable requirements. Applicability decisions should be justified in the Statement of Applicability.
Can a smaller business implement ISO 27001?
Yes. The ISMS can be proportionate to the organisation’s size, activities, information risks and contractual obligations.
ISO/IEC 27001:2022 certification starts with an effective ISMS
An information security management system is not simply a list of cybersecurity technologies. ISO/IEC 27001:2022 requires the organisation to establish a defined scope, understand information security risks and treat those risks through justified controls. Its Statement of Applicability should explain which Annex A controls are relevant and why controls are included or excluded.
Tenbray can support Australian organisations with ISMS scoping, risk assessment, risk treatment planning, documented processes, internal audits and certification readiness. The objective is a management system that provides a defensible line of sight from business risk to selected controls, owners, implementation evidence and review.
Practical ISMS evidence to prepare
- ISMS scope and the information assets, services, people and suppliers within it.
- Information security risk criteria, assessment results and risk treatment decisions.
- A Statement of Applicability and evidence of selected control implementation.
- Access governance, supplier assurance, incident response and continuity arrangements where relevant.
- Security objectives, performance monitoring, internal audit, management review and corrective actions.
Questions to resolve early
- Does the scope include the systems and business activities customers rely upon?
- Who accepts residual information security risks and approves treatment decisions?
- Can responsible personnel show the controls operating—not just documents naming them?
- How are cloud providers, software suppliers and outsourced services governed?
- Are internal audit and management review planned before independent certification?
From gap assessment to independent ISO 27001 certification
The sequence normally includes scope definition, gap assessment, risk assessment and treatment, control implementation, internal audit, management review and correction of identified issues. A certification body then carries out its independent Stage 1 and Stage 2 assessments. The schedule depends on scope, existing controls, organisation size and the time required to produce objective evidence.
Where ISO 9001 is already established, document control, management review, corrective action and other shared governance processes may be reused or integrated, provided the information security requirements are met.
Prepare with an auditor's perspective
Tell Tenbray what standard applies to your organisation, whether you are building a new system or preparing for your next independent audit, and what support you need.
Contact Tenbray