About Us
Oscar System
ISO Standards & Compliance
ISO Standards & Compliance
Advisory Services
Environmental & ESG
Health & Safety Services
Manage information security through a clear, risk-based approach. We help you assess risks, select and document appropriate controls, and develop the policies, processes and internal audit arrangements that support an ISO/IEC 27001 management system.
ISO/IEC 27001:2022 sets requirements for an Information Security Management System. It uses a risk-based approach to support the confidentiality, integrity and availability of information. Certification assesses the management system within its stated scope; it does not guarantee that security incidents will never occur or establish compliance with all data protection law.
Current standard checked 4 November 2026: ISO/IEC 27001:2022, including Amendment 1:2024 on climate action.
We start with a review of your current information security arrangements, risks, controls and documentation. This helps us understand how your organisation protects data and what needs to be improved to align with ISO 27001 requirements.
We support the development of your information security management system, including key policies, risk treatment, controls, roles and supporting evidence. The focus is on creating an ISMS that is clear, proportionate and realistic for your organisation.
Once the ISMS is developed, we help your team embed the right processes and security controls. This may include staff awareness, internal reviews, documentation checks and preparation support before moving towards an external certification audit.
Critical Path provides ISO 27001 consultancy and certification preparation, but we do not audit or certify our own work. Your certification audit must be completed independently, and we can guide you towards suitable UKAS or non-UKAS certification bodies.
ISO 27001 certification can help organisations manage information security risks, protect sensitive information and demonstrate a structured commitment to security. An effective Information Security Management System can also strengthen customer confidence, support contractual requirements and improve organisational resilience.
ISO 27001 provides a structured framework for protecting the confidentiality, integrity and availability of information through proportionate risk assessment, treatment and security controls.
ISO 27001 provides a structured framework for protecting the confidentiality, integrity and availability of information through proportionate risk assessment, treatment and security controls.
Independent ISO 27001 certification can reassure customers that information security risks are managed through a formally assessed Information Security Management System.
Independent ISO 27001 certification can reassure customers that information security risks are managed through a formally assessed Information Security Management System.
An ISMS helps organisations identify, understand and manage applicable information security, privacy and regulatory requirements through documented controls and monitoring arrangements.
An ISMS helps organisations identify, understand and manage applicable information security, privacy and regulatory requirements through documented controls and monitoring arrangements.
ISO 27001 supports a structured approach to identifying legal and contractual obligations relating to information security, data protection and the handling of sensitive information.
ISO 27001 supports a structured approach to identifying legal and contractual obligations relating to information security, data protection and the handling of sensitive information.
ISO 27001 helps identify information assets, threats, vulnerabilities and potential impacts before appropriate risk treatments and information security controls are selected.
ISO 27001 helps identify information assets, threats, vulnerabilities and potential impacts before appropriate risk treatments and information security controls are selected.
ISO 27001 certification can support tenders and supply-chain opportunities where customers expect independent evidence of effective information security management.
ISO 27001 certification can support tenders and supply-chain opportunities where customers expect independent evidence of effective information security management.
Internal audits, management reviews, performance monitoring and corrective actions help organisations continually improve the suitability and effectiveness of their ISMS.
Internal audits, management reviews, performance monitoring and corrective actions help organisations continually improve the suitability and effectiveness of their ISMS.
Effective information security controls and incident management arrangements can help organisations respond to disruption, limit impacts and restore essential operations more effectively.
Effective information security controls and incident management arrangements can help organisations respond to disruption, limit impacts and restore essential operations more effectively.
Structured security requirements and supplier monitoring can strengthen third-party confidence, improve communication and reduce information security risks across business relationships.
Structured security requirements and supplier monitoring can strengthen third-party confidence, improve communication and reduce information security risks across business relationships.
Clear responsibilities, controlled documentation and defined security processes can improve accountability, consistency and decision-making across the organisation.
Clear responsibilities, controlled documentation and defined security processes can improve accountability, consistency and decision-making across the organisation.
ISO/IEC 27001:2022, including its 2024 climate action amendment, is the current information security management system (ISMS) standard. It sets requirements for managing risks to the confidentiality, integrity and availability of information. Organisations of any size can use it, including businesses handling customer information, intellectual property and other business-critical records.
Cybersecurity controls help protect digital systems and information. An ISO 27001 ISMS provides the wider management framework: governance, risk assessment, responsibilities, physical and organisational controls, suppliers, monitoring and continual improvement. Technical security measures remain important, but software or a penetration test alone does not establish conformity with the management system standard.
The Statement of Applicability records the information security controls determined to be necessary, the reasons for including them and whether they are implemented. It also justifies exclusions of Annex A controls. Necessary controls can come from sources beyond Annex A. The document must reflect your organisation’s risk treatment decisions and relevant requirements, rather than a copied checklist.
Critical Path’s ISO 27001 consultancy can cover gap analysis, ISMS scope, information security risk assessment, risk treatment, the Statement of Applicability, policies, training, internal audits and certification preparation. We agree responsibilities and deliverables with you. Certification is undertaken independently and does not guarantee that security incidents will never occur.
