ISO 27001 Certification
ISO 27001.Built by your team. Owned by your team.
Whether you decided this was the right time or a customer made the decision for you, the process is the same. The Askara Solutions agent works through the full program with you, so the certificate reflects work your team genuinely did.
Last updated:
Where you are now
Two reasons organisations come to ISO 27001.
You decided it was time
Your security posture should be something you can actually account for. Something that holds up when an enterprise customer asks to see it.
A customer asked first
There is a deal on the line. The timeline is not yours to set.
Either way, the standard is the same. So is the work.
Risk register, control mapping, policy documentation, internal audit, management review, external certification. It requires understanding what your actual risks are, not just which controls the standard recommends, and being able to explain every decision to an auditor who has seen organisations that filed the right paperwork without doing the real work.
Most organisations that go through this process get the certificate. Not all of them end up with a team that understands what is behind it.
The certificate is the straightforward part. Building something you can stand behind is not.
The standard routes produce documentation. Not capability.
Route A
The Consultant
Navigates the standard for you. Maps your risks, designs your controls, writes your policies. The documentation is polished and the audit goes smoothly.
Then they leave, and everything they knew about your risk profile leaves with them. When something changes, you call them again.
Route B
The Compliance Tool
Gives you structure: Annex A controls, policy templates, evidence trackers. The same structure for every company that uses it.
Does not ask what your actual risks are. Does not quantify what those risks cost the business. Does not help your team understand what they are building or why.
Both produce documentation. Neither produces a team that owns the risk program.
When the auditor leaves and something changes, the organisations that handle it well are the ones where the team understood what they built. Not the ones that watched someone else build it for them.
The certification journey
The actual journey. And where the agent carries the load.
ISO 27001 is not a checklist you clear once. It is a system you stand up, prove to an auditor, and then keep current. The path is the same for every organisation, whether you chose the timeline or a customer chose it for you.
Risk management
What could actually go wrong here, and what it would cost. Get this right and the controls, the Statement of Applicability and the policies all follow from it.
≈ 80% of what the auditor reviews derives from this stage
You bring
The knowledge of your business, captured as the risk register: the one part only you can fill.
The agent
Asks by role, quantifies every risk in financial terms with FAIR, and builds the register with you.
The documents that derive from it
Statement of Applicability, risk treatment plan, control mapping across the 93 Annex A controls, policies and procedures.
You bring
Confirm the decisions.
The agent
Generates each document on demand, in your house style, version-controlled and current as your risks change.
Internal audit
An independent party reviews the whole system before the certifier ever sees it, and produces findings you act on.
You bring
Act on the findings.
The agent
Holds the schedule and tracks every finding, so nothing drifts into a non-conformity that costs you the certificate.
Deep dive
How to choose and book your auditorManagement review
The findings go to the people who can decide on them: the board. The official place where the organisation owns its risk decisions.
You bring
Own the decisions.
The agent
Assembles the agenda and documents from the most current data. No report to prepare, no meeting to stage.
The external audit
Two meetings with the auditor. First a document review: is everything there. Then content and interviews: does the substance hold up.
You bring
Answer for your area, with the right people in the room.
The agent
Nothing missing, everything demonstrable, because the work was already real and already documented.
Deep dive
Working with your auditorCertified
The certificate reflects work your team genuinely did, and can explain, defend, and adapt when the business changes.
Keeping it, not rebuilding it
Certification runs on a three-year cycle: a surveillance audit each year, full recertification at year three. Every year the risk analysis, the policies, the internal audit and the management review come round again.
You bring
A little time each quarter.
The agent
Re-run it when something changes; the documentation updates with it. Maintenance stays light because the heavy setup is behind you.
Same standard for everyone. The difference is what your team understands when it is done.
The Askara Solutions agent runs inside Claude.
Once you purchase it, the agent is available directly in Claude. No new platform. No login. Open a conversation and start.
You are not following a script. The agent is following your company.
By the time the program is complete, your team owns it. They can explain every finding, defend every decision, and adapt when the business changes. The certificate is the record of work that was genuinely done.
If NIS2 applies to your organisation, it is covered in the same program. Same methodology, no additional project.
Install in one step
Add the agent to your Claude environment. Available immediately after purchase.
Context from your company
It asks for your company name and website. From that alone it builds your sector, risk profile, and probable control gaps.
Adaptive questioning
Not a generic intake form. Targeted questions shaped by what it already knows. Each answer sharpens the picture.
Your team owns it
Your team can explain every finding, defend every decision, and adapt the program when the business changes.
How It Works
A risk program built by your team, not produced for them.
Starts with your company.
Give it your name and website. From that alone, it builds a picture of your sector, your likely risk profile, your probable control gaps. The program begins specific to you before you have answered a single question.
Guides you through the decisions.
Risk identification, Annex A control selection, policy design, internal audit preparation: worked through in conversation. The agent asks before it tells. Each question builds on what came before. The understanding develops as the program progresses.
Quantifies risk in financial terms.
Not a colour matrix. The agent uses FAIR methodology to express what each risk actually costs, and what changes if a given control is in place. Numbers that inform real decisions, not scores that satisfy a checklist.
Builds the documentation as you go.
Risk register, statement of applicability, control mapping, audit trail. Produced as a record of genuine decisions, not assembled for the auditor at the end. There when you need them because the work was real.
NIS2 included. No separate project.
If your organisation falls under NIS2, the agent covers it in the same program. Same methodology, same documentation, no duplication.
Common questions
Terms on this page
Vocabulary at a glance.
ISO 27001
International standard that defines the requirements for an information security management system (ISMS), including risk assessment, control selection, and management review.
Risk Register
The single source of truth recording every identified risk, its assessment, the control treatment chosen, the owner, and the review date.
Control Mapping
The process of aligning a single set of security controls simultaneously against two or more compliance frameworks to eliminate duplicated evidence collection where requirements overlap.
Annex A
The catalogue of 93 information security controls in ISO/IEC 27001:2022, organised into four themes (organisational, people, physical, technological), referenced from the Statement of Applicability.
NIS2
EU directive that extends cybersecurity obligations to a much wider set of organisations than its predecessor, requiring governance, risk management, incident reporting, and supply-chain security.
ISO 27001 certification is achievable.
The question is what your team knows when it is done. The Askara Solutions agent builds a risk program your organisation can own, and the documentation that proves it to anyone who asks.
Not because you hired someone to produce it. Because your team built it.
Your risk program. Your certification. Yours to keep.