ISO 27001 certification support, from the scope call to the surveillance audit
Trusted by
ISO 27001 certification, three pillars, one operator.
One Canadian team does the ISO 27001 consulting, builds the management system, decides every control, and stays through the audits.
The management system
An information security management system (ISMS) with scope, risk method, policies, and management review, sized to your business rather than to a template.
Statement of Applicability
All 93 Annex A controls, each carrying a written include or exclude decision and the evidence behind it. An exclusion needs a reason a stage 2 auditor accepts, not one that sounds good internally.
Audit and after
The ISO 27001 internal audit, stage 1 and stage 2 preparation, then the surveillance audits at month 12 and month 24 that nobody plans for.
Does ISO 27001 Certification Support work the same way in every industry?
No. The ISO 27001 Certification Support work is the same craft in every sector, but the conditions around it are not. In financial services that means OSFI's technology and cyber risk rules; in government, Protected A, B and C data handling; and in defence and aerospace, controlled goods rules, CMMC and the flow-down from your prime. We keep the service and change the part that bends.
Where an international counterparty prefers the ISO route.
OSFI B-13. Technology and cyber risk across three domains: governance, technology operations and resilience, and cyber security. It binds federally regulated institutions, and only those.
Protected A, B and C data handling decides where the work can run and who can touch it.
Protected A, B and C. Each level changes where the data can physically live, who can reach it, and what you have to prove about both. Most files turn on Protected B, and most disagreements turn on what counts as reaching it.
Controlled goods rules, CMMC and the flow-down from your prime set what a supplier can do.
ITAR and the Controlled Goods Program. Registration under the Defence Production Act is mandatory before anyone examines, possesses or transfers controlled goods in Canada. Technical data counts, so a drawing sitting on a laptop is in scope.
Health information sits under provincial privacy law, and your IT provider is usually the custodian's agent.
PHIPA. Ontario's health privacy act, with its own definition of a custodian and its own duties for the agents acting on a custodian's behalf. Your IT provider is usually an agent.
Solicitor-client privilege decides how a firm can handle its data.
Law Society obligations. Confidentiality and competence duties reach the technology you practise with, and the vendors who touch client information. The firm is expected to have assessed the provider, which means the provider should arrive with the answers.
What do you need from ISO 27001 Certification Support?
Tell us who you are and what you're working on. A senior engineer reads your message before replying, so the first answer is a real read on scope, risk and timing, within an hour, 24/7. Nothing here is a commitment, and we'll tell you plainly if we're not the right fit.
Your request
- Service
- ISO 27001 Certification Support
What happens next
- A senior engineer replies within an hour, 24/7, never an SDR.
- We book a 30-minute call to listen, sketch options, and flag risks.
- You get a scoped statement of work within 3 business days.
Call the 24/7 line
+1 514-465-1584ISO 27001 certification in Canada, made real.
Most of what's written about this standard is written by people selling either software or a certificate. This is written by the engineer who'll sit in your stage 2 audit.
Scope is the decision that sets the price of everything else.
Draw the boundary around the whole company and you've committed to evidencing 93 controls across every team, every site, and every system. Draw it around the platform your customers actually ask about and the work halves without weakening the certificate. Buyers read the scope statement printed on the certificate, so a narrow scope has to be an honest one. Getting that line right in week one is the highest-value hour of the engagement, and it's the hour most providers skip.
The Statement of Applicability, and the evidence under it.
The middle of the work is the Statement of Applicability and what sits behind it. Every one of the 93 Annex A controls needs a written decision, and an exclusion needs a reason an auditor accepts rather than one that reads well internally. Risk hides in three places: a risk method nobody follows after month two, an ISO 27001 internal audit run by the same people who built the thing, and a management review that exists as a calendar invite instead of a record.
Two dates that matter in Canada right now.
Every ISO 27001:2013 certificate expired on 2025-10-31, so an organisation still holding one is uncertified rather than late (source: ISO transition period, ISO/IEC 27001:2022). And Amendment 1:2024 added climate change to clauses 4.1 and 4.2, so you have to determine and document whether it's a relevant issue, even where the answer is no (source: ISO/IEC 27001:2022/Amd 1:2024). Your certificate itself has to come from a body accredited by the Standards Council of Canada, the only internationally recognised ISMS accreditation body here.
Want a Senior IT Consultant's Read on Your Setup?
Tell us what you run today and what keeps breaking. A senior SMEnode engineer replies within an hour with a first read on scope, risk and timing. No sales handoff.
Request a consultHow our ISO 27001 consulting and gap analysis work runs.
Four steps, and step 01 decides the cost of the other three. We've seen the same failure twice: an organisation scopes the entire company because it sounds more impressive, then spends eleven months evidencing controls for a warehouse nobody asked about. We'd rather argue about scope in week one than find the problem at stage 2.
Engagement phases
Phases 01 to 04
Set the scope
The boundary, the interested parties, the risk method, and the exclusions, written down and defended. This is also where we tell you if certification is the wrong instrument for what your buyer is actually asking for.
Close the gaps
An ISO 27001 gap analysis against all 93 Annex A controls, ranked by what stage 2 looks at hardest, with our engineers doing the technical remediation rather than handing you a spreadsheet of findings.
Build the evidence
Policies people can follow, records that generate themselves where possible, and a management review that produces minutes rather than a meeting.
Audit, then stay
Internal audit, stage 1 readiness, stage 2 support in the room, then the surveillance audits at month 12 and month 24, which is where most certificates quietly fall over.
ISO 27001 certification questions, answered straight.
Answers first, including the one thing we're not allowed to do for you. An architect takes the call, not a salesperson.
Where this work connects.
These disciplines share the same senior team and tend to land together. Follow the thread to the next one.
- RegulatedISO 22301 Business ContinuityISO 22301 business continuity for Canadian organisations, built so the business impact analysis and the infrastructure agree.
- RegulatedCPCSC Certification SupportCPCSC certification support for Canadian defence suppliers, from the Level 1 self-assessment through to ITSP.10.171 gap closure.
- RegulatedSOC 2 Compliance ServicesSOC 2 compliance for Canadian companies, scoped down to what your customers actually asked for, then evidenced.
Not sure where you stand? Take the free ISO 27001 readiness assessment
