Find out exactly how far you are from ISO/IEC 27001 certification, and what to fix first.
Customers, enterprise clients and tenders increasingly ask for ISO 27001. Many small and mid-sized businesses don’t know where they stand or where to start. A readiness assessment gives you a clear, honest picture of your current information security practices measured against ISO/IEC 27001:2022, plus a practical plan to close the gaps before you book a certification audit.
Who this is for
- SMBs and startups whose customers or partners are asking for ISO 27001
- IT/ITeS companies, SaaS providers and agencies bidding for enterprise or government contracts
- Organisations that started an ISMS but stalled, or want an independent check before the Stage 1 audit
- Companies moving from ISO 27001:2013 thinking to the 2022 version of the standard
What’s included
- Scoping workshop: agree the ISMS scope, locations, systems and teams in scope
- Clause 4–10 review: context, leadership, risk management, support, operation, performance evaluation and improvement
- Annex A control review: assessment against the 93 controls of ISO/IEC 27001:2022 (organisational, people, physical and technological)
- Document review: existing policies, procedures, asset inventory, risk register and records
- Interviews and walkthroughs with key staff (IT, HR, management)
- Technical spot checks of key controls such as access management, backups, patching, logging and endpoint security
What you get
- Gap analysis report: control-by-control status (in place / partial / missing) with evidence notes
- Prioritised remediation roadmap: quick wins, medium-term work and items needing budget or tooling
- Draft Statement of Applicability (SoA) outline, based on your scope
- List of mandatory documents and records still needed for certification
- Management debrief call to walk through findings and answer questions
How it works
- Discovery call: a free call to understand your business, drivers and timeline
- Scope and quote: a fixed-price proposal based on company size, locations and scope
- Assessment: document review, interviews and technical checks, done remotely or on-site
- Report and debrief: findings, roadmap and next steps
A typical readiness assessment for a small organisation takes 1–3 weeks from kickoff to report, depending on scope and how quickly documents and people are available.
Why work with us
Every engagement is delivered personally by Bhaskar Soni, a hands-on Linux, DevOps and security practitioner based in Ahmedabad. The work is not outsourced to a junior team. We work with small and mid-sized businesses, startups, agencies and IT teams across India and internationally, both remotely and on-site in Gujarat.
Frequently asked questions
Is this a certification audit?
No. Certification can only be granted by an accredited certification body. This is an independent pre-assessment that tells you what needs to be in place before you engage one, so the actual audit goes smoothly.
Can you help implement the fixes as well?
Yes. After the assessment, we can help write policies and procedures, set up the risk register and SoA, and implement technical controls on Linux servers, networks and cloud. This is quoted separately.
How much does it cost?
It depends on the number of employees, locations, systems in scope and how mature your current practices are. Share a few details in the form below and we will send a fixed quote.
Do you sign an NDA?
Yes. We are happy to sign your NDA before any documents or system access are shared.
Request a quote
Tell us a little about your environment and goals. Choose ISO 27001 Readiness Assessment in the form below, and we will reply within 1–2 business days with questions about scope and a fixed quote. There is no obligation.
Prefer email? Write to contact@youngstercompany.com.