WHO WE HELP
Who needs ISO 27001?
ISO 27001 is typically required by, or highly relevant to, businesses that:
Sell into financial services, healthcare, and central government
Handle large volumes of personal data or commercially sensitive client information
Compete in procurement frameworks that include information security requirements
Work with larger enterprise clients that specify ISO 27001 for their supply chain
Have outgrown Cyber Essentials and need a higher level of independently verified assurance
WHAT WE DO
What is involved in ISO 27001 implementation?
A full ISO 27001 implementation typically works through five stages:
Gap analysis
Understanding your current controls against the standard's requirements and identifying what needs to be built, changed or documented. This is where the project scope is established.
Risk assessment
ISO 27001 is built around risk. A formal risk assessment identifies your information assets, the threats and vulnerabilities that affect them, and the controls needed to reduce risk to an acceptable level for your business.
Policy and control development
ISO 27001 requires a documented set of policies and controls. Rybec Group writes these to reflect how your business actually operates, not from a template that could belong to any organisation.
Implementation
Putting controls in place, training staff, and embedding the ISMS into how the business operates on a day-to-day basis.
Internal audit and certification
Before the external certification audit, an internal audit reviews whether the ISMS is functioning as intended. The external auditor then examines the ISMS against the standard and confirms certification, as it is not appropriate for The Rybec Group to externally audit an area we helped build, run or implement. Final UKAS certification is issued independently by an appropriate certification body.
WHAT WE DO
Our relationship with ISOQAR
The Rybec Group is listed in ISOQAR’s consultant network and provides consultancy, implementation, readiness and ongoing support. ISO certification audits and certificates are carried out independently by ISOQAR or another appropriate certification body.
In practice, this means two things for our clients. First, ISOQAR refers businesses that need ISO 27001 implementation support to The Rybec Group directly. Second, when a client is ready for their external certification audit, ISOQAR is our recommended audit partner.
That relationship matters because it removes a common source of friction in the certification process. The implementation consultancy and the certification body are already working from the same understanding. There is no cold handoff, no reassessment of your ISMS by a third party seeing it for the first time, and no disconnect between the work that has been done and the audit that follows.
For clients, it means a more joined-up experience from first gap analysis through to the certificate on the wall.
HOW WE WORK
The Rybec Group's approach
Our team holds ISO 27001 Lead Auditor certification. We have implemented ISO 27001 with businesses at different stages and different scales, from organisations starting with no formal security framework to those with existing controls that need to be formalised and documented.
We write policies that reflect your business, run risk assessments that are practical rather than theoretical, and prepare you for the certification audit in a way that means you understand your own ISMS rather than simply having a folder of documents you have never read.
QUICK ANSWERS
Frequently asked questions
Q: How long does ISO 27001 take?
For most SMEs, implementation takes between four and nine months, depending on the complexity of your operations, the current state of your controls and how much of the business's time can be dedicated to the project. The Rybec Group produces a realistic project plan after an initial gap analysis.
Q: How much does ISO 27001 cost?
Costs vary by business size and complexity. The Rybec Group gives you a transparent cost estimate after the initial assessment, covering both our fees and the likely certification body fees for the external audit. There are no surprises.
Q: Can we do ISO 27001 without an internal IT team?
Yes. Many of our clients are professional services firms or SMEs without in-house IT specialists. ISO 27001 is a management system, not purely a technical exercise. The controls cover people, processes and technology. The Rybec Group guides you through all three.
What is the difference between Cyber Essentials and ISO 27001?
Cyber Essentials covers five technical controls and protects against common cyber threats.
ISO 27001 is a comprehensive information security management standard covering governance, risk management, business continuity, supplier security, incident management and more. Many businesses have both: Cyber Essentials as the baseline, ISO 27001 as the full framework.