ISO 27001 certification support for businesses and organizations
From the first gap analysis to the certification audit. We build an information security management system with you that works day to day, not a binder of procedures left on a shelf.
Elad personally guides every engagement, from the first conversation to the certification audit.
What is ISO 27001, and who is it for?
ISO/IEC 27001 is the leading international standard for information security management. It does not prescribe a specific product or technology. It defines how an organization identifies the risks to its information, decides which controls to apply, and makes sure over time that they actually work. This framework is called an Information Security Management System (ISMS). The current version of the standard, from 2022, lists 93 controls in Annex A across four themes: organizational, people, physical and technological.
Certification itself is granted by an external, accredited certification body, not by the consultant, and the certification body's fee is separate from the cost of our support. Our role is to bring you to the audit ready: with a management system that fits the size of your organization, documentation that reflects what really happens, and a team that understands what is expected of it. The need usually comes from outside, from a large customer, a tender or a supplier questionnaire. An organization that does the process right also gains internal order that lasts long after the certificate is on the wall.
When does an organization need ISO 27001?
If one of these situations sounds familiar, it is time to look into it seriously.
A customer or tender requires it
A strategic customer, an international company or a tender sets ISO 27001 as a requirement, and suddenly there is a deadline.
Security questionnaires keep coming
Every new customer sends a long supplier questionnaire. A recognized certification answers many of the questions up front and saves time on every deal.
You want order, not just a certificate
The organization is growing, and security runs on people's memory. The standard gives a clear framework for managing risks, access, suppliers and incidents.
Full support, from the gaps to the audit
Take the whole process, or only the stages you are missing.
Gap analysis
Reviewing the current state against the standard's requirements and the Annex A controls, so you know exactly what exists and what is missing.
Deliverable: gap report and work planScope and risk management
Defining the ISMS boundaries, mapping information assets, assessing risks and building a prioritized treatment plan.
Deliverable: risk register and treatment planPolicies, procedures and Statement of Applicability
Writing the documents the standard requires, matched to the way your organization actually works, including the Statement of Applicability (SoA).
Deliverable: complete documentation setImplementing the controls
Hands-on help with implementation: access rights, backups, supplier management, physical security, incident response and system hardening.
Deliverable: working, documented controlsEmployee and management training
Awareness training for employees, and preparing management for the role the standard gives it, including the management review.
Deliverable: documented trainingInternal audit and certification audit support
Running the internal audit the standard requires, closing findings, and supporting you with the certification body through both audit stages.
Deliverable: full audit readinessWhat the process looks like
Four stages, with milestones you can see all the way.
1. Introduction and gap analysis
We learn the organization, the business requirement and the timeline, and measure the current state against the standard.
2. Planning and building the ISMS
We define the scope, assess risks, and write policies and procedures that fit your organization.
3. Implementation
We implement the controls, train employees, and collect evidence that things work.
4. Internal and certification audits
Internal audit, management review, closing findings, and then the certification audit with the certification body.
What stays with you at the end
All deliverables belong to your organization, are written in Hebrew or English as needed, and can be maintained independently.
- A documented Information Security Management System (ISMS) with a defined scope and clear roles.
- An up-to-date risk register, risk treatment plan and Statement of Applicability (SoA).
- A set of policies and procedures written for you, not a generic template with your name in the header.
- An internal audit report, a management review summary, and an annual plan for keeping the certification.
ISO support from security people, not just paperwork people
Elad Elimelech, founder of Marom Cyber, brings 20 years of technology experience, most of them in management roles. He has led organizations through ISO 27001 certification and continues to support them through the annual surveillance audits. In recent years he led technology strategy in information security and management at companies serving hundreds of organizations in high tech, finance and healthcare. He defined information security standards at the highest level and was the go-to authority for the most complex technology challenges across those organizations. When standard solutions were not enough, he led the solution.
Personal support all the way
You work directly with Elad, from the first conversation to the certification audit and beyond. One person who knows your organization in depth, not a rotating account manager.
We write it and we implement it
When a control calls for hardening, MFA or backups, we know how to implement it in practice, not just describe it in a document.
Sized to your organization
A 30-person company does not need a bank's set of procedures. We build a system that meets the standard and that you can really maintain.
We stay after the certificate
Certification requires annual surveillance audits. You can continue with us for ongoing support: internal audits, risk updates and audit preparation.
Frequently asked questions about ISO 27001
If anything is unclear, you can always ask us directly.
Completing the picture
Articles that connect naturally to the certification process.
ISO 27001 is more than a certificate on the wall
Why the standard is first of all a management system, and what happens after the certificate arrives.
Read the article →Cyber risk assessment
The gaps a professional risk assessment reveals, and how it fits into the first stage of certification.
Read the article →Is your vendor secure?
Supplier management is part of the standard. This is how a third party can become part of your cyber risk.
Read the article →Need to show ISO 27001, or thinking about starting?
In a short introductory call with Elad we will understand the requirement, the current state and a realistic timeline. Free and with no obligation.
Book a call →