Services / ISO 27001 on your platform

You pay for a compliance platform. Who is filling it in?

We do the ISO 27001 implementation work inside the platform you already have, then a written readiness assessment before Stage 1. Your team answers questions; it does not become the compliance team.

Reach Stage 1 with the evidence already in place.

You get

• Scope and gap assessment against ISO 27001:2022
• Risk assessment, risk treatment plan and Statement of Applicability
• Policies and procedures, written for how your company actually works
• Controls and evidence set up in your platform, for the scope agreed in the proposal
• Management review, then a written readiness assessment before Stage 1

Timeline

Typically 8 to 10 weeks. Not guaranteed: it depends on your team's availability and how much already exists.

You provide

• A named owner with authority to decide and sign
• Admin access to your compliance platform and read access to the systems in scope
• A few hours a week from the owner, and time from the staff who run the controls
• Management sign-off on the policies, risks and scope

Price

$10,000. Fixed price. Scope and platform fit are agreed in the proposal before work starts. Prices exclude VAT and other taxes.

What is not included

Who does the work

Questions

Which compliance platforms do you work on?

Most compliance platforms, including Drata and Vanta. We check that yours fits when we write the proposal. We need an account with enough access to edit controls, policies and evidence.

What if we do not pass the certification audit?

The certification body decides, and nobody can promise its decision. If the audit raises nonconformities, its report says what to fix and by when. If you want our help closing them, we scope it in a short proposal with the price stated up front.

Can you do the implementation and the internal audit?

Not in the same certification cycle. An internal auditor has to be independent of the work being audited, so if we implement your ISMS, someone else does your internal audit. If we audit you, we did not build it.

Remote or on-site?

Remote by default, in English. On-site days are possible when we agree them in the proposal.

What currency do you invoice in?

US dollars. Better ISMS EURL, a French company, invoices you. Prices exclude VAT and other taxes, and payment terms are set in the proposal.

How is this related to ISMS Copilot?

Better ISMS makes ISMS Copilot, the AI assistant for ISO 27001 and GRC work. We use our own tools to do the drafting and checking faster; a person decides and signs off. You do not need an ISMS Copilot plan to hire us.