Management System Implementation
ISO 27001 and other management systems, built so your team can run them. Building one is less about writing documents than about making decisions: what is in scope, which risks matter and which controls are proportionate. I help you make those decisions and put the supporting structure in place.
Led by Levent Şakar, IRCA-certified ISO 27001 and ISO 9001 Lead Auditor.
ISO 27001 implementation
The work runs in phases with clear outputs at each stage, so you can see progress and control cost. I work alongside your team rather than handing over a finished set of documents. A management system that nobody in the organisation understands tends to fail its first surveillance audit.
| Standards | ISO/IEC 27001:2022, ISO/IEC 27701, ISO 9001, ISO/IEC 20000-1, or an integrated system |
|---|---|
| Typical timescale | Three to six months to certification readiness, depending on size, scope and what is already in place. |
| Fee | Fixed by organisation size and paid in stages against agreed outputs. Certification body fees are separate. |
What it covers
| Scope and context | What the management system covers and why. |
|---|---|
| Risk assessment | A method your team can maintain, and an initial assessment carried out with you. |
| Risk treatment and Statement of Applicability | Which controls apply and how they are met. |
| Policies and procedures | Only those you need, written to reflect how you actually work. |
| Awareness | Making sure staff know the policy and their own responsibilities. |
| Audit readiness | Preparing for internal audit, management review and the certification audit. |
Two ways to work
Full implementation
I lead the work with your project owner, from scope and risk assessment to the first management review and readiness for the certification audit.
Documentation support
Your team runs the project. I provide the documentation framework, review your drafts and check that the result meets the standard. Suits organisations with internal capacity but no prior experience of ISO 27001.
Other management systems
ISO/IEC 27701
Requirements for a privacy information management system. It can be added to an ISO 27001 system or, since the 2025 edition, implemented and certified on its own. I support implementation and the move from the 2019 edition for organisations already certified.
ISO 9001
For IT and technology service providers, ISO 9001 covers much of the same ground as ISO 27001: defined processes, documented responsibilities, supplier management and continual improvement. Usually scoped to IT and service delivery.
ISO/IEC 20000-1
The IT service management standard, most relevant to managed service providers and internal IT functions that deliver services to the wider business.
Integrated management systems. Where you need more than one standard, a single system with shared processes for risk, documentation, internal audit and management review is usually simpler to run than several separate ones.
Where it ends. The certification audit is carried out by an accredited certification body, not by me. Internal audit and ongoing maintenance are separate services: see Internal Audit and Management System Maintenance.
Not sure where to start?
Most organisations begin with a gap analysis. A short call is usually enough to confirm whether that is the right place to begin.