ISO/IEC 27001:2022
Compliance Readiness

CRS's structured engagement typically achieves certification readiness in approximately 12 weeks — from initial gap analysis through Stage 1 and Stage 2 certification audit support. The CRS ACTION-Field template system, which pre-drafts all 17 mandatory ISMS artefacts with organisation-specific fields left open, compresses the documentation phase from weeks to hours. Timeline may vary depending on organisation size and existing security control maturity.

The ACTION-Field system is CRS's proprietary approach to ISMS documentation. All 17 mandatory ISMS artefacts (policies, procedures, risk register, statement of applicability, and more) are pre-structured with full clause-compliant content — only the organisation-specific fields (names, dates, asset inventories, risk owners) need to be populated. This eliminates the 'blank page' problem and ensures no mandatory clauses are missed, which is one of the most common reasons for Stage 1 audit failure.

Yes. A complimentary penetration test is included in Week 1 of the CRS engagement. This generates real threat evidence — confirmed vulnerabilities, attack paths, and risk findings — that populate the ISMS risk register with objective data from day one, rather than relying on a theoretical risk assessment. This approach satisfies ISO 27001 Clause 6.1.2 (information security risk assessment) with evidence that certification bodies regard favourably.

Yes. CRS provides a pre-certification readiness check before Stage 1, facilitates the Stage 1 documentation review, supports nonconformity remediation between Stage 1 and Stage 2, and accompanies the client through the Stage 2 on-site audit. CRS also manages the certification body relationship throughout the engagement, handling scheduling, documentation submission, and auditor queries.

Yes. CRS delivers recertification engagements for organisations whose ISO 27001:2013 certification has lapsed or expired, and transition engagements for organisations certified to the 2013 standard who need to upgrade to ISO/IEC 27001:2022. The 2022 standard introduced 11 new controls and restructured Annex A significantly — CRS's ACTION-Field templates reflect the current 2022 requirements throughout.

Each engagement is project-dependent and scoped before it is priced. VAPT is priced once the scoping form is in, ISO 27001 once the gap assessment is done, and Security Advisory (vCISO) is a retainer priced on the size of the organisation.

The kick-off session is held, and the delivery timelines agreed, within 24 to 48 hours of all parties agreeing the terms.

About 12 weeks from gap analysis to certification-ready. The engagement runs the gap analysis, produces the 17 mandatory ISMS artefacts, includes a penetration test and an internal audit, and supports the organisation through the Stage 1 and Stage 2 certification audits. The certification body's audit dates set the day the certificate is issued.

Yes, sample reports are shared on request. Ask through the enquiry form and the CRS team will send one for the service.

Yes. On deals registered with CRS, a CRS specialist can join the client meetings, including the first one, at no cost to the partner.

Not from CRS. In a white-label engagement the work is delivered under the partner's brand: reports, deliverables and client communication carry the partner's name, and the partner faces the client. CRS never contracts with, invoices or approaches the partner's client.