%20(16).png)
Are your customers, tenders, or regulatory authorities requiring a certified information security management system according to ISO/IEC 27001?
Certinova supports you from the initial assessment to certification readiness: through gap analysis, the development and implementation of your ISMS, the mandatory internal audits, and preparation for the certification audit.
Important distinction: We do not issue certifications. Certification is granted by an independent, accredited certification body of your choice. We prepare you for this process, conduct the required internal audits, and support you during the certification audit.
Start now with a realistic view of your current maturity level.
Digital workflows and reusable evidence reduce manual effort – especially during re-certification.
Numerous completed audit and assessment projects form the basis of our methodology.
SaaS providers, cloud platforms, IT service providers, and regulated companies rely on Certinova
Regardless of where you are starting from, we provide the right service for your current maturity level—without detours and without overhead. The certificate itself is issued by your chosen certification body.
We assess your current security level against the requirements of ISO/IEC 27001 (Chapters 4 to 10 and Annex A), identify gaps, and prioritize measures. You start with a realistic picture, a clearly defined scope, and an actionable roadmap.
.svg)
We support you with risk assessment, the risk treatment plan, the Statement of Applicability (SoA), policies, and processes. You retain responsibility, while we provide structure, momentum, and audit-ready documentation.
.svg)
ISO 27001 requires internal audits at planned intervals as well as a management review. We handle the internal audits, document findings, and track follow-up actions. This ensures you meet mandatory requirements and enter the certification process well-prepared.
.svg)
We prepare you for the certification body's audits (Stage 1 and Stage 2), assist with selecting the body, and serve as your point of contact during the audit. Afterward, we support you through surveillance audits and re-certification.
We combine professional assessment by experienced auditors with technology-driven processes.
The result: shorter audit cycles, less internal effort for you, and reports that meet your customers' requirements.
Evidence is collected in a structured manner and automatically validated – the professional assessment remains with our auditors.
Submit documents, answer questionnaires, track status—transparent instead of endless email chains.
A clear audit pattern from scope to report—fewer follow-up questions, predictable effort.
An experienced team supports you beyond the individual report—including follow-up audits and related frameworks.
From the distinction between consulting and certification to timelines and mandatory audits: find the most important answers here.
Can't find your question? Contact us directly.
No. Certificates are issued exclusively by accredited certification bodies. We do not provide certification; instead, we prepare you for certification readiness and support you during the certification audit. This separation ensures the independence and recognition of your certificate.
The standard requires internal audits at planned intervals (Chapter 9.2) and a management review (Chapter 9.3). We conduct the internal audits for you, including documenting findings and tracking follow-up actions. We prepare the management review with you, while the execution remains the responsibility of your management team.
This depends on the scope, company size, and existing maturity level. Following the readiness assessment, you will receive a concrete timeline and action plan. Furthermore, an ISMS must have been in operation for a certain period before the certification audit to ensure that internal audits and management reviews can be demonstrably performed.
Yes. The requirements overlap significantly. Through a common control mapping, you can leverage controls, responsibilities, and evidence for multiple frameworks, such as SOC 2, BSI C5, as well as requirements from NIS2 and DORA. During the scoping phase, we clarify which content can be adopted.
Let's get in touch to discuss your requirements.
