Scope
Agree the ISMS scope, including the systems your customer or tender cares about.
Security / ISO 27001 readiness
ISO 27001 gap assessment and readiness.
A tender clause or a board decision means ISO 27001:2022. The gap assessment says how far away you are.
Sorami runs a clause-by-clause gap assessment against ISO 27001:2022 and produces three things: a findings report, a draft Statement of Applicability and an evidence plan. Certification itself is issued by a JAS-ANZ accredited certification body, which Sorami is not. Readiness is the work that shortens that audit.
Step one
What the ISO 27001 gap assessment covers
The gap assessment is the first two to three weeks. It measures your current practice against ISO 27001:2022 and says how far you are from a certification audit. To budget the audit and the work around it, see what ISO 27001 certification costs in Australia.
Clauses 4 to 10
Review the management system clauses that cannot be excluded.
Annex A
Review the 93 Annex A controls and the evidence each one needs.
Outputs
A findings report, a draft Statement of Applicability and an evidence plan.
Readiness then closes the gaps, which takes three to six months for most teams starting without an ISMS. Budgeting for the certification audit as well? Read what SOC 2 and ISO 27001 cost in Australia.
What the work covers
- Clause 4 to 10 gap assessment against ISO 27001:2022.
- Annex A control review with the evidence each one needs.
- Statement of Applicability draft with justified exclusions.
- Risk assessment method your team can repeat.
- Internal audit plan and certification body liaison.
What we do not do
- The certification audit. That is an accredited certification body.
- Running the ISMS after certification.
- Writing policies nobody will follow.
The clauses this work touches
Named, so you can check us.
ISO/IEC 27001:2022. Annex A is a reference set of 93 controls you may exclude with justification. Clauses 4 to 10 are the management system and cannot be excluded, which is where most readiness projects are actually behind.
| Reference | What it requires | What readiness produces |
|---|---|---|
| Clause 4.3 | Determining the scope of the ISMS | A scope statement that matches the product, not the whole company. |
| Clause 6.1.2 | Information security risk assessment | A method with criteria and thresholds, run rather than documented. |
| Clause 6.1.3 d | Statement of Applicability | All 93 Annex A controls, each with applicability, justification and what implements it. |
| Clause 9.2 | Internal audit | An audit programme with competent auditors and retained results. |
| Clause 9.3 | Management review | Minuted reviews with the required inputs, at planned intervals. |
| Clause 10.2 | Nonconformity and corrective action | A corrective action record that closes the loop. |
| Reference | What it requires | What readiness produces |
|---|---|---|
| A.5.15 | Access control | Rules that match what production actually enforces. |
| A.5.23 | Information security for use of cloud services | New in the 2022 revision. Usually the largest gap for a cloud team. |
| A.5.24 | Information security incident management planning and preparation | A plan that has been exercised, not only written. |
| A.8.2 | Privileged access rights | Time-bound privilege with a revalidation record. |
| A.8.5 | Secure authentication | Multi-factor authentication on every administrative path. |
| A.8.8 | Management of technical vulnerabilities | A scan cadence, an owner and a due date per finding. |
| A.8.9 | Configuration management | New in 2022. Baselines, and drift you can detect. |
| A.8.15 | Logging | Logs the people being logged cannot alter. |
| A.8.16 | Monitoring activities | Alerts that reach someone accountable. |
| A.8.28 | Secure coding | New in 2022. Review and dependency handling in the pipeline. |
Source. ISO/IEC 27001:2022. Identifiers verified against the primary source, not quoted from a summary.
A certification body reads the Statement of Applicability first, because it is the map between your risk assessment and everything they are about to test. Sorami prepares that document. The certificate is issued by an accredited certification body, not by us.
Failure modes
What usually goes wrong.
- A scope statement that excludes the system the customer cares about.
- Risk assessment done once for the certificate, then never again.
- Policies describing a company that does not exist.
- Evidence gathered by hand in the fortnight before the audit.
Questions before you book
Practical answers.
Is Sorami ISO 27001 certified?
No. Sorami is not ISO 27001 certified and is not a certification body. We prepare your organisation for an accredited body to audit.
What does an ISO 27001 gap assessment include?
A clause 4 to 10 review, an Annex A control review and the evidence each control needs. You receive a findings report, a draft Statement of Applicability and an evidence plan. The fee is confirmed in writing once scope is agreed.
Gap assessment or full readiness?
The gap assessment is two to three weeks and tells you the distance. Readiness closes it and takes three to six months for most teams starting without an ISMS.
ISO 27001 or SOC 2?
ISO 27001 for tenders, government and international buyers. SOC 2 for US enterprise buyers. The control sets overlap heavily, so do the work once.
Which version?
ISO 27001:2022, including the restructured Annex A control set.
Budgeting the first step? Read what an ISO 27001 gap assessment costs in Australia. Compare the required assurance format in SOC 2 vs ISO 27001 for Australian teams. Customer geography alone does not decide whether SOC 2 readiness is needed. Privacy obligations are a separate question for GDPR and Privacy Act readiness. Where the agreed risk treatment calls for technical testing, scope penetration testing deliberately. A vCISO retainer can support ongoing control ownership.
Let’s scope it
Send an enquiry Ready to scope iso 27001 readiness?
Send the requester wording and your deadline. We will confirm scope and fee before any work starts.
Last reviewed: