ISO 27001 Information Security Certification and Maintenance

When enterprise customers ask for ISO 27001, investors raise it in due diligence, or contracts require it, you need the certificate that proves your security posture. Oxford Infosec takes small, fast-moving companies from initial scoping all the way to certification, then maintains the controls and evidence that keep you certified through surveillance and recertification audits, year after year.

Our approach is pragmatic and risk-driven, built for small businesses so that every recommended control is proportionate to real-world risk, ISO 27001 requirements, and ICO expectations. We optionally pair our consultants with a compliance automation platform for continuous evidence collection, real-time dashboards, and automated alerts instead of periodic checklists.

Phase 1 - Implementation (3-6 months): We agree scope and accountability, build your asset inventory and risk register, write core policies, deploy controls (MFA, logging, backup, supplier due diligence), conduct your first internal audit and management review, and prepare you for the certification audit.

Phase 2 - Maintenance (12-month minimum, renewable annually): We operate continuous monitoring, maintain your risk register and policies, execute internal audits, coordinate with the certification body for surveillance and recertification audits, deliver security awareness training, and provide incident and change advisory.

Designed for organisations with 2-250 employees handling sensitive data in the UK or Europe, facing procurement questionnaires, investor due diligence, or contractual certification requirements. Our Lead Consultants hold internationally recognised ISO 27001 implementation and audit qualifications along with data protection credentials (CIPP/E, CIPM), serving as your single point of contact accountable for delivery.

Controls are scoped to how you actually operate. If something genuinely does not apply, we mark it out of scope rather than inventing work. The service combines well with SOC 2, vCISO, DPO as a Service, or Security Foundations for organisations needing broader coverage.