Software vendors and digital providers
- Certification required by customers and tenders
- Endless security questionnaires
- A differentiating sales argument
Cybersecurity & Governance
ISO 27001 consulting
Build an information security management system sized to your organisation, and take it all the way to certification. Available in the Paris region, Lyon, Chambéry, Annecy and Geneva, or remotely anywhere in France and French-speaking Switzerland.
The challenge
A certification that must be useful.
ISO/IEC 27001 is the international reference standard for information security. It is increasingly required by large customers, tenders and partners, and it structures a lasting security approach.
The risk is producing heavy documentation, disconnected from reality. Our approach: a proportionate ISMS, focused on your real risks, that your teams can keep alive after the audit.
Who it is for
Organisations that need to prove they are serious.
SMEs and mid-caps
- Structuring a still informal security approach
- Meeting NIS2 expectations
- A well-chosen scope to start with
Groups
- Extending an existing certification to new entities
- Harmonising practices across subsidiaries
- ISMS maintenance and continual improvement
Missions
Our ISO 27001 support
01
Scope and context
Choosing a relevant scope, interested parties, internal and external issues.
02
Risk assessment
Suitable method (EBIOS RM or equivalent), risk assessment and treatment plan.
03
Statement of Applicability
Selection and justification of Annex A controls against your risks.
04
Policies and procedures
Useful, proportionate documentation, written to be applied.
05
Implementing controls
Support for your teams, including on technical controls.
06
Internal audit and certification
Internal audit, management review and preparation for the certification body's audit.
Method
How the engagement works
Scoping
Objectives, certification target date and intended scope.
Diagnosis
Gap analysis against the standard and risk assessment.
Building the ISMS
Policies, controls, indicators, awareness.
Certification
Internal audit, management review, then support during the audit.
Why Axiomata
An ISMS built by a practitioner.
Over eight years of hands-on experience as CISO and infrastructure architect, in groups of more than 1,000 employees as well as startups, across retail, maritime and defence.
We know what the standard's controls concretely require from technical teams, which avoids policies nobody can apply and gaps discovered on audit day.
FAQ
ISO 27001: your questions
How long does ISO 27001 certification take?
It depends on the scope and starting maturity. The ISMS also needs to run for a few months before the audit, to have indicators, an internal audit and a management review.
Who issues the certification?
An accredited certification body, independent from the firm supporting you. Certification is valid for three years, with annual surveillance audits.
Does the whole company need to be certified?
No. The scope can be limited to an activity, a product or a site. Choosing it well is one of the most important decisions of the project.
Do you work remotely?
Yes. Much of the work is done remotely, anywhere in France and French-speaking Switzerland, with occasional on-site visits for workshops, committees or crisis management. We work on site in the Paris region, Lyon, Chambéry, Annecy and Geneva.
Does ISO 27001 help with NIS2?
Yes. An ISO 27001 ISMS covers a large share of the measures expected by NIS2 and provides the governance framework to demonstrate them.
Related expertise
Go further
Let's talk about your ISO 27001 project.
A first conversation to frame your challenges, with no commitment. We work in the Paris region, Lyon, Chambéry, Annecy and Geneva, and remotely anywhere in France and French-speaking Switzerland, with occasional on-site visits.
Talk to an expert