No. Certification comes only from an accredited certification body, and the same firm cannot both consult and certify. We prepare you and support you through the audit.

How long does certification take?

It depends on scope and starting maturity, and the system must operate long enough to generate evidence. We give a realistic range after the gap analysis.

What happens after we are certified?

Certification is maintained through surveillance audits and a three-year recertification cycle, so the management system has to keep running. We design it to be operated by your own people, and can provide internal audit and management review support in the years between if you prefer.

How does a iso 27001 consulting & implementation engagement start?

With a short discovery conversation and a written view of scope, risk and the decisions to be made. That view is useful to you whether or not the work continues.

How is a iso 27001 consulting & implementation engagement priced?

Scope and, where relevant, rules of engagement are agreed in writing before any work begins, and the engagement is a fixed fee for that scope or phased with a cost envelope per phase — so you know the cost and the boundaries up front. Larger pieces of work are broken into phases with findings delivered early rather than a single invoice at the end.

Governance, Risk & Compliance · Govern

ISO 27001 Consulting & Implementation

A previous ISO 27001 attempt often leaves an organisation with documents but no working system, which is exactly what fails certification. We implement the standard end to end — a defensible scope, a risk method that produces decisions, applicable controls, documentation, internal audit and management review. The management system is operated for long enough to generate real evidence before the external audit, because certification rests on the system working, not on it existing. We prepare you and support you through the audit, but the certificate itself comes from an accredited certification body — we cannot both consult and certify.

In short

ISO 27001 consulting and implementation builds and operates an information security management system ready for certification. It produces a system that runs and generates evidence, not a folder of documents that satisfies nobody at the audit.

Start a conversation

What we do

The work inside iso 27001 consulting & implementation.

Scope and gap analysis

We define a scope that is defensible to an auditor and honest about what it includes, then measure the distance to certification. Scope set too wide inflates cost and effort; set too narrow it undermines the value of the certificate to customers. The gap analysis gives a realistic view of the work and timeline before any commitment is made.

Risk assessment and treatment

We implement a risk method that actually produces decisions and a treatment plan, not a scoring exercise filed and forgotten. The method is kept repeatable so your own people can run it in subsequent years without us. The treatment plan links each decision to the controls that follow from it, which is what the auditor traces.

Controls and statement of applicability

We select and implement the applicable Annex A controls and justify any exclusions in the statement of applicability. Exclusions have to be defensible, because unexplained gaps are among the first things an auditor probes. Controls are implemented to fit your operations, so they keep running after certification rather than lapsing.

Internal audit and management review

We operate the system, audit it internally and run a genuine management review before the external audit. These are mandatory parts of the standard and also the dry run that surfaces weak evidence while there is still time to fix it. Running them properly is usually the difference between a clean certification and a list of findings.

What you receive

Deliverables, in writing.

Documented output your teams keep and can act on without us in the room.

Scope statement and gap analysis
Risk assessment method, results and treatment plan
Statement of applicability and control documentation
Internal audit report and certification readiness assessment

When this work helps

You may be facing this.

Tenders or customers require certification
A certification audit is booked and readiness is unclear
A previous attempt produced documents but no operating system

How an engagement runs

Discover, assess, design, deliver.

01
Discover
Establish the obligations, decision rights, and risks that genuinely matter to this organisation. We separate the requirements that truly apply from those assumed to, so effort is not spent governing risks you do not carry.
02
Assess
Review existing controls, policy, evidence, and how the work is actually performed. We compare the control on paper with the control in practice, because the gap between the two is usually where the real risk sits.
03
Design
Design a proportionate control set with named ownership, evidence, and review cadence. Every control has an owner who can operate it and a defined source of evidence, so nothing depends on memory or heroics.
04
Deliver
Embed the changes with the teams doing the work, and test that the controls operate. We hand over controls the process owners can run themselves, rather than a framework only we understand.

Where we work

Delhi, India — and wherever the work is.

Fidova provides governance, risk and compliance consulting from Delhi, India, and works with organisations operating in several jurisdictions at once, mapping obligations across regions to one coherent control set.

Engagements run in English, are scheduled around your time zone, and can be delivered remotely end to end, with on-site time planned where a phase genuinely benefits from being in the room.

Related services

Often needed alongside this.

SOC 2 Readiness & Compliance

SOC 2 readiness prepares your controls and evidence for a service auditor's Type I or Type II examination. It focuses on building evidence that accrues continuously, since a Type II report rests on how controls operated across a period rather than on a single point in time.

PCI DSS Compliance

PCI DSS compliance work establishes cardholder data scope and the controls needed to meet the standard at your level. The cheapest and safest path is almost always to reduce scope first, so that fewer systems fall within the standard at all.

GDPR Compliance

GDPR compliance work establishes lawful basis, records, rights handling and transfer arrangements for personal data. It is built to operate in the systems and teams that handle the data, rather than to sit as a policy nobody consults.

All governance, risk & compliance services

Questions