A tender clause or a board decision means ISO 27001:2022. The gap assessment says how far away you are.
Sorami runs a clause-by-clause gap assessment against ISO 27001:2022 and produces three things: a findings report, a draft Statement of Applicability and an evidence plan. Certification itself is issued by a JAS-ANZ accredited certification body, which Sorami is not. Readiness is the work that shortens that audit.
ISO/IEC 27001:2022. Annex A is a reference set of 93 controls you may exclude with justification. Clauses 4 to 10 are the management system and cannot be excluded, which is where most readiness projects are actually behind.
| Reference | What it requires | What readiness produces |
|---|---|---|
| Clause 4.3 | Determining the scope of the ISMS | A scope statement that matches the product, not the whole company. |
| Clause 6.1.2 | Information security risk assessment | A method with criteria and thresholds, run rather than documented. |
| Clause 6.1.3 d | Statement of Applicability | All 93 Annex A controls, each with applicability, justification and what implements it. |
| Clause 9.2 | Internal audit | An audit programme with competent auditors and retained results. |
| Clause 9.3 | Management review | Minuted reviews with the required inputs, at planned intervals. |
| Clause 10.2 | Nonconformity and corrective action | A corrective action record that closes the loop. |
| Reference | What it requires | What readiness produces |
|---|---|---|
| A.5.15 | Access control | Rules that match what production actually enforces. |
| A.5.23 | Information security for use of cloud services | New in the 2022 revision. Usually the largest gap for a cloud team. |
| A.5.24 | Information security incident management planning and preparation | A plan that has been exercised, not only written. |
| A.8.2 | Privileged access rights | Time-bound privilege with a revalidation record. |
| A.8.5 | Secure authentication | Multi-factor authentication on every administrative path. |
| A.8.8 | Management of technical vulnerabilities | A scan cadence, an owner and a due date per finding. |
| A.8.9 | Configuration management | New in 2022. Baselines, and drift you can detect. |
| A.8.15 | Logging | Logs the people being logged cannot alter. |
| A.8.16 | Monitoring activities | Alerts that reach someone accountable. |
| A.8.28 | Secure coding | New in 2022. Review and dependency handling in the pipeline. |
Source. ISO/IEC 27001:2022. Identifiers verified against the primary source, not quoted from a summary.
A certification body reads the Statement of Applicability first, because it is the map between your risk assessment and everything they are about to test. Sorami prepares that document. The certificate is issued by an accredited certification body, not by us.
No. Sorami is not ISO 27001 certified and is not a certification body. We prepare your organisation for an accredited body to audit.
The gap assessment is two to three weeks and tells you the distance. Readiness closes it and takes three to six months for most teams starting without an ISMS.
ISO 27001 for tenders, government and international buyers. SOC 2 for US enterprise buyers. The control sets overlap heavily, so do the work once.
ISO 27001:2022, including the restructured Annex A control set.
Requesters often name the wrong standard. If the wording actually points at an American customer or a software buyer, SOC 2 readiness is the closer fit, and privacy obligations sit with GDPR and Privacy Act readiness. Annex A control A.8.8 usually needs a test behind it, which is penetration testing, and running the controls afterwards is what the vCISO retainer covers.
Send the requester wording and your deadline. We will confirm scope and fee before any work starts.
Last reviewed: