ISO 27001 readiness
ISO 27001 readiness before an assessor arrives
ISO 27001 readiness is the work of making the operation match the record before an assessor arrives. REKKY Sec Ops Consulting does not issue an ISO/IEC 27001 certificate. An external assessor does that, if a certificate is issued. Engagements are remote-first across the U.S., and on-site travel is available. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
Before an assessment
The review asks whether evidence can be produced on request, whether each control has an owner who can explain the duty, and whether a known gap is already assigned. Policies that operators do not use, and records that describe a control the facility does not run, are both findings.
A control that fails under test is not marked ready because a document says it exists. Penetration testing with retest is what shows the correction held.
Related control work is included when it shows up in the same operation, because a gap in one record usually appears in another. The written account lists the evidence that could be produced that day and the evidence that could not.
We need access to the control owners, the operators, and the leadership that accepts residual risk. The fee for the facility assessment is paid in full before the visit is scheduled. Implementation that follows the findings is agreed separately.
Evidence, owners, and gaps
Evidence that can be produced. Leadership, an assessor, and the operators receive the same account.
Owners who understand their duties. A control with no current person is not ready.
Gaps addressed before assessment, so the record matches the protection in place. A known gap with no owner stays open in the account.
The same review covers the setting the control has to survive: medical devices under FDA and ISO requirements, energy and telecommunications networks, or the platforms you already run. We do not paste a control list onto a different operation.
The same account
Operations, security operations, and infrastructure are one practice here, because a weakness in any one of them appears in the others. Compliance work without the operation produces records without protection.
Leadership and assessors receive the same account the operators use. You receive what needs attention and what must change for the operation to keep running.
The engagement establishes procedures, ownership, and operating habits. We work around your normal operations, and we'll need access to the right areas and the right people while we do. Once you approve it, we'll need access to the right areas and people.
The sequence after the review is on the method page: assess, plan, implement and verify, then a later cycle if you want one.
What this is not
We do not issue an ISO/IEC 27001 certificate. We do not tell you that an assessor will pass you.
We do not treat a policy binder as readiness. If the operators do not use it, the finding says that.
A facility assessment is a fixed engagement. The amount is not published on this site. It is part of the reply. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
Questions
Does REKKY issue an ISO/IEC 27001 certificate?
No. The work is ISO 27001 readiness: evidence that can be produced, owners who understand their duties, and gaps addressed before an assessment. An external assessor issues a certificate, if one is issued. Penetration testing with retest is a separate record of what failed, what was corrected, and what held when the same paths were tested again.
What happens on site for ISO readiness?
We review the operation as it is actually run. The review covers the systems we can reach, the people who operate them, and the leadership that owns the decisions. You receive a written account of what needs attention. We work around your normal operations, and we'll need access to the right areas and the right people while we do.
Contact
Task us with the assessment date, or the lack of one.
Tell us which products and processes are out of alignment. We work around your normal operations, and we'll need access to the right areas and the right people while we do.