Gap analysis
Compare your current practice with the clauses of ISO/IEC 27001 and its Annex A controls.
ISO 27001 Readiness & Consulting
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS): the policies, risk processes, controls and reviews an organisation uses to protect information. ISO 27001 certification confirms that an independent certification body has audited that system. As an ISO 27001 consultant based in Perth, Umbrella Tech helps Australian organisations scope, build and run an ISMS and prepare for the certification audit.
The problem
The challenge we help you address
A tender or enterprise customer asks for ISO 27001, and the organisation has some good security practice but no management system around it. Risk decisions are informal, policies are out of date, and nobody can show how controls are chosen, checked and improved.
The outcome
What the engagement should deliver
A defined ISMS scope, a working risk assessment and treatment process, a Statement of Applicability, and controls and records that hold up to an external audit. Your team should be able to run the system after we step back, with internal audit and management review in place.
How we can help
ISMS design
Set the scope, roles, risk method and core documents the standard requires.
Control implementation
Deliver the technical and organisational controls your risk treatment selects.
Audit preparation
Run internal audit and management review, and organise evidence for the certification body.
What the standard requires
ISO/IEC 27001 has two parts. Clauses 4 to 10 set the management system requirements: context and scope, leadership, planning and risk assessment, support, operation, performance evaluation and improvement. Annex A lists 93 reference controls grouped into organisational, people, physical and technological themes. You decide which controls apply through risk assessment and record the decision in a Statement of Applicability (SoA).
Preparing for certification
We support readiness and implementation. Certification is assessed separately by an independent certification body, usually through a stage 1 documentation review and a stage 2 audit of how the ISMS operates. Scope, operating evidence and unresolved gaps all affect the path to that audit.
Gap assessmentUmbrella Tech
Remediation and implementationUmbrella Tech with your team
Operate and build evidenceYour organisation
External certification or assessmentIndependent body
Assessment and implementation options
AssessmentISO 27001 Gap Assessment
Get a structured ISO 27001 gap analysis from Umbrella Tech, with clear findings, risk priorities and an…
Explore → ServiceISO 27001 Readiness & ImplementationISO 27001 implementation and readiness: build a working ISMS with risk treatment, controls and records, ready…
Explore →Frequently asked questions
Can't see your question? Ask us directly →
What is ISO 27001 certification?
It is confirmation from an independent certification body that your ISMS meets the requirements of ISO/IEC 27001. The certificate covers a defined scope and is maintained through regular surveillance audits.
Who needs it?
No Australian law requires it, but it is common in tenders, enterprise supply chains and sectors that handle sensitive data. Organisations with a smaller footprint sometimes start with SMB1001 or the Essential Eight and move to ISO/IEC 27001 when customers require it.
What are the main requirements?
A defined scope, leadership commitment, an information security policy, a risk assessment and treatment process, a Statement of Applicability, operating controls, internal audit, management review and continual improvement. Each needs records that show it happens.
How long does implementation take?
It depends on the scope, the size and complexity of the organisation, existing documentation and how quickly controls can be implemented. The ISMS also needs to operate for a period before the certification audit, so we confirm scope and timing in discovery.
How does it relate to other frameworks?
The Essential Eight can supply many technical controls inside an ISMS. ISO/IEC 42001 uses the same management system structure for AI, and RFFR has historically been built on ISO/IEC 27001.
Plan the next improvement
Tell us who is asking for ISO 27001, what you want in scope and what already exists. We will help define a practical path to audit readiness.