01 · Gap analysis
We compare your current posture against each requirement in clauses 4 to 10 and the Annex A controls, producing a prioritized report that shows exactly what is missing for conformity and the estimated effort per workstream.
Compliance · Governance
ISO 27001 consulting and ISMS certification
Berghem's ISO 27001 consulting takes your organization from diagnosis to certification of the Information Security Management System (ISMS): gap analysis against ISO/IEC 27001:2022, risk assessment and treatment, implementation of Annex A controls, and preparation for the audit by an accredited certification body.
What is ISO 27001 certification?
ISO/IEC 27001 is the international standard that sets the requirements to establish, operate and continually improve an Information Security Management System (ISMS). Certification, issued by an accredited certification body, proves to third parties — customers, regulators and partners — that information security is managed through formal, auditable processes rather than isolated controls.
The current edition, ISO/IEC 27001:2022, includes an Annex A with 93 controls grouped into four themes: organizational, people, physical and technological. Berghem structures the ISMS around your real business context and risks, so certification becomes the consequence of a secure operation — not a paper exercise for the auditor.
What's included
•Gap analysis against ISO/IEC 27001:2022
•ISMS scope and context definition
•Risk assessment and treatment + Statement of Applicability
•Implementation of Annex A controls
•Auditable policies, procedures and evidence
•Internal audit and Stage 1 / Stage 2 preparation
Roadmap
How does the path to ISO 27001 certification work?
Certification follows a predictable path: diagnosis, risk treatment, implementation, internal audit and the two-stage certification audit. Berghem guides each phase and prepares the evidence the certification body will require.
02 · ISMS context and scope
We define the system boundaries — units, processes, assets and interested parties —, the security objectives and leadership responsibilities, the foundation on which the whole ISMS and the certification rest.
03 · Risk assessment and treatment
We structure the risk methodology, identify and evaluate information security risks, and define the treatment of each, consolidated in the Statement of Applicability (SoA) that justifies the inclusion or exclusion of every control.
04 · Control implementation
We put the applicable Annex A controls into operation — policies, access management, cryptography, operations security and incident response —, with procedures and records that produce real evidence, not just documentation.
05 · Internal audit and management review
We run the internal ISMS audit and support the management review, correcting nonconformities before the certification body finds them — the point where most certifications stall.
06 · Certification audit
We prepare the organization for Stage 1 (documentation review) and Stage 2 (implementation audit) conducted by the accredited body, and support the treatment of any findings until the certificate is issued.
Annex A
Which controls does ISO/IEC 27001:2022 require?
The 2022 edition organizes the 93 Annex A controls into four themes. The Statement of Applicability defines which apply to your context — Berghem implements and evidences each selected control.
Organizational controls
Security policies, roles and responsibilities, supplier management, information classification, continuity management and compliance — the governance backbone of the ISMS.
People controls
Screening at hiring, awareness and training, disciplinary responsibilities and remote work — the human factor, a recurring target of social engineering.
Physical controls
Secure perimeters, entry control, protection of equipment, media and sensitive areas — the physical-world security that underpins the logical layer.
Technological controls
Access management, cryptography, network and endpoint security, secure development, logging and monitoring — the technical layer validated with real testing.
What are the certification stages and timeline?
The certification audit happens in two stages run by the accredited body. From gap analysis to certificate issuance, the typical timeline runs 4 to 9 months, depending on the organization's maturity and scope.
Stage 1 — documentation audit
The accredited body reviews the ISMS documentation — scope, policy, risk assessment and Statement of Applicability — to confirm the system is formalized and ready for the implementation audit.
Stage 2 — implementation audit
The auditor verifies on site that the Annex A controls are operating and producing evidence, interviewing owners and examining records. Once Stage 2 is passed, the certificate is issued.
Typical timeline (4–9 months)
From diagnosis to certification, most projects take 4 to 9 months. Annual surveillance audits and a full recertification every three years follow.
What is the difference between the internal and certification audits?
They are two distinct, both-mandatory audits. The internal audit is yours; the certification audit belongs to the accredited body.
Internal audit (management review)
An ISMS requirement in its own right: your organization audits the controls and takes the results to management review, correcting nonconformities before certification. Berghem runs this audit as preparation.
Certification audit
Conducted by an accredited, independent certification body in two stages (documentation and implementation). This is what results in the ISO/IEC 27001 certificate.
How much does ISO 27001 certification cost?
There is no single price: the investment depends on factors we define in the initial gap analysis. Add to the consulting project the fee charged separately by the certification body.
Scope
How many units, processes and assets fall inside the ISMS. A lean scope certifies faster and cheaper; a broad scope demands more controls and evidence.
Current maturity
Organizations with controls and policies already running start ahead; those beginning from scratch must build much of the ISMS before the audit.
Team and availability
Team size, owner availability and technological complexity drive the implementation effort and therefore the total cost.
For a tailored quote, talk to a specialist: Talk to a specialist.
Is ISO 27001 the same as LGPD compliance?
No. ISO 27001 is an international information-security management standard; the LGPD is Brazil's data-protection law. The ISO 27001 ISMS provides much of the technical and governance controls the LGPD requires, but it does not cover the legal obligations — legal bases, data-subject rights and impact reports. Integrated, the two programs greatly reduce the compliance effort.
How does ISO 27001 apply by sector?
The ISMS adapts to each sector's context and risks. A few examples of how we structure scope and controls:
Financial
Banks, fintechs and payment providers use the ISMS as a foundation for the BACEN/CMN resolutions and PCI DSS, reusing controls across frameworks.
Healthcare
Providers, clinics and healthtechs align the protection of sensitive patient data with the LGPD on top of the ISO 27001 control structure.
Technology
SaaS and software providers use certification as a commercial prerequisite, proving to customers and partners that security is managed through processes.
Public sector and others
Agencies and regulated companies build auditable security governance, connecting the ISMS to the other compliance requirements of their sector.
Why Berghem
Why run ISO 27001 with an offensive security firm?
Most ISO 27001 consultancies stop at paper. Berghem validates the technological Annex A controls with real penetration testing, turning certification into evidence of security — not just of compliance.
Controls validated in practice
The technological Annex A controls gain proof of effectiveness when confronted with our penetration testing. The auditor receives evidence that the controls work, and your organization gains a real security posture.
Integration with your security program
We connect the ISMS to the rest of your program — pentest, DevSecOps and incident response — so certification reinforces the security operation instead of competing with it for resources.
Preparation for multiple frameworks
The ISO 27001 ISMS is a foundation for PCI DSS, LGPD and the BACEN/CMN cybersecurity resolutions, including 4.893. We structure the controls so the same effort satisfies several requirements.
FAQ
Frequently asked questions about ISO 27001 certification
How long does ISO 27001 certification take?
It depends on current maturity, scope and team availability. Organizations that already have informal controls move faster; those starting from scratch must build the ISMS before the audit. The initial gap analysis defines a realistic timeline for your case.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the certifiable ISMS requirements and Annex A with the list of controls. ISO 27002 is the implementation guide detailing each control. You certify against ISO 27001 and use ISO 27002 as a practical implementation reference.
Does Berghem issue the ISO 27001 certificate?
No. The certificate is issued by an accredited, independent certification body that audits the ISMS in Stages 1 and 2. Berghem acts as the consultancy: it structures the system, implements the controls and prepares the organization to pass that audit.
What is the Statement of Applicability (SoA)?
It is the document listing every Annex A control and justifying which apply to your context, which were excluded and why, plus the implementation status of each. It is one of the central artifacts examined by the auditor during certification.
Does ISO 27001 help with LGPD compliance?
Yes. The ISO 27001 ISMS provides the governance structure and technical controls that support much of the LGPD's security requirements. It does not replace legal adequacy, but it greatly reduces the compliance effort when the programs are integrated.
Let's start
Ready to certify your ISMS to ISO 27001?
In a 30-minute conversation we map your current maturity and design the path to certification — from gap analysis to the accredited body's audit.