Who this is for
Contractors who sell beyond the DoD and are asked for ISO/IEC 27001 certification in commercial or European bids, organizations whose prime or customer requires an ISMS, and companies preparing for EASA Part-IS, where an ISO/IEC 27001 management system is a strong foundation.
What we deliver
Scope & context
ISMS scope, interested parties, and context (clauses 4 and 5), drawn so the certificate means something to the customers who asked for it.
Risk assessment & treatment
A risk method and register (clause 6 and 8) that reuses your CMMC risk work, with a treatment plan tied to Annex A.
Statement of Applicability
All 93 Annex A controls with inclusion, justification, and implementation status, mapped to your NIST SP 800-171 requirements so evidence is shared.
Policies & procedures
The documented information the standard requires, merged with your SSP-era policy set rather than duplicated.
Internal audit & review
Internal audit (9.2) and management review (9.3) run to certification-audit standard, with nonconformities tracked to closure.
Certification support
Certification body selection, Stage 1 and Stage 2 audit preparation and support, and surveillance-year readiness.
How ISO/IEC 27001 maps to your NIST SP 800-171 program
| ISO/IEC 27001:2022 | NIST SP 800-171 overlap | What ISO adds |
|---|---|---|
| Clauses 4–10 (management system) | Policies, SSP, POA&M | Context, objectives, internal audit, management review |
| A.5 Organizational controls (37) | Governance, incident response, supplier and asset management | Threat intelligence, cloud service use, business continuity readiness |
| A.6 People controls (8) | Awareness and training, personnel security | Terms of employment, remote working |
| A.7 Physical controls (14) | Physical protection (3.10.x) | Physical security monitoring, clear desk |
| A.8 Technological controls (34) | Access, audit, configuration, system protection | Data masking, information deletion, secure coding |
Independence matters: we build and run the ISMS and prepare you for audit; an accredited certification body audits and certifies it. We don't certify the systems we implement.
How an engagement runs
- Gap (2–3 weeks): clause and Annex A gap assessment against your existing program, with the 800-171 mapping.
- Build (6–12 weeks): scope, risk treatment, SoA, and the documented information, reusing what exists.
- Prove (4–8 weeks): operate the ISMS, run internal audit and management review, then Stage 1 and Stage 2.
- Sustain: surveillance-year readiness and continual improvement as part of Managed Compliance.
Questions contractors ask us
How much of our CMMC work carries over?
Much of the control substance does: access control, audit logging, configuration management, incident response, and training all map to Annex A controls. What ISO/IEC 27001 adds is the management system around them: context, objectives, internal audit, and management review. We map controls once so both use the same evidence.
Which edition should we certify to?
ISO/IEC 27001:2022. The transition period from the 2013 edition has ended, so new certifications and renewals are to the 2022 edition, which reorganized Annex A into 93 controls across four themes.
How long does certification take?
For an organization with a working CMMC or NIST SP 800-171 program, typically a few months from gap assessment to Stage 2, most of it spent operating the ISMS long enough to audit it. Starting from nothing takes longer.
What's the difference between ISO/IEC 27001 and 27002?
ISO/IEC 27001 is the certifiable requirements standard for the management system. ISO/IEC 27002 is the guidance for implementing the controls. See our ISO/IEC 27002 page.
Turn your federal program into an ISO certificate.
Tell us where your CMMC or NIST SP 800-171 program stands and who is asking for ISO/IEC 27001, and we'll scope the delta. Or email rj@indirectit.com directly.