ISO 27001 in four weeks for a healthcare company

The challenge

A large new project required ISO 27001 certification before a fixed start date. The client already had many good security practices but no information security management system, and a typical six-month programme would have cost them the contract.

What we did

• Booked the Stage 1 and Stage 2 audit dates with an accredited certification body before day one.
• Kept the scope tight to the services the new project needed, with a plan to extend it later.
• Ran the gap assessment against clauses 4 to 10 and Annex A, the risk assessment with leadership and the Statement of Applicability in the first week.
• Tailored our policy library to how the client actually works, while the client's team closed gaps in access reviews, asset inventory, supplier reviews, logging and awareness training.
• Generated real operating records, then ran the internal audit and management review before Stage 1.

Timeline

1. Week 1: scope, gap assessment, risk assessment, Statement of Applicability
2. Week 2: policies tailored, control gaps closed by the client's team
3. Week 3: operating records, internal audit, management review, Stage 1 audit
4. Week 4: Stage 1 observations closed, Stage 2 audit

Results

• Stage 2 completed with a recommendation for certification.
• No nonconformities. Two minor observations were raised, and both were already on the client's improvement roadmap for the next year.
• The client met its project start date.

What made it work

A firm deadline with executive backing, a client team assigned full-time for four weeks, existing controls that only needed formalising, and audit dates secured first. Four weeks is the exception: most organisations should plan three to six months.