ISO 27001 certification support in Canada, from the first scope decision to the audit an accredited body runs.
One Canadian team does the ISO 27001 consulting, builds the management system, decides every control, and stays through the audits.
An information security management system (ISMS) with scope, risk method, policies, and management review, sized to your business rather than to a template.
All 93 Annex A controls, each carrying a written include or exclude decision and the evidence behind it. An exclusion needs a reason a stage 2 auditor accepts, not one that sounds good internally.
The ISO 27001 internal audit, stage 1 and stage 2 preparation, then the surveillance audits at month 12 and month 24 that nobody plans for.
Every ISO 27001:2013 certificate expired on 2025-10-31. The 2022 version is the only one that counts now, and a buyer's procurement team checks the date before it checks anything else.
IN PRODUCTION
We'd been told this was a document exercise. Our first attempt produced 140 pages nobody read and a Statement of Applicability that excluded controls we actually needed. SMEnode rebuilt the scope first, then the evidence, and stage 2 raised no majors.
Most of what's written about this standard is written by people selling either software or a certificate. This is written by the engineer who'll sit in your stage 2 audit.
Draw the boundary around the whole company and you've committed to evidencing 93 controls across every team, every site, and every system. Draw it around the platform your customers actually ask about and the work halves without weakening the certificate. Buyers read the scope statement printed on the certificate, so a narrow scope has to be an honest one. Getting that line right in week one is the highest-value hour of the engagement, and it's the hour most providers skip.
The middle of the work is the Statement of Applicability and what sits behind it. Every one of the 93 Annex A controls needs a written decision, and an exclusion needs a reason an auditor accepts rather than one that reads well internally. Risk hides in three places: a risk method nobody follows after month two, an ISO 27001 internal audit run by the same people who built the thing, and a management review that exists as a calendar invite instead of a record.
Every ISO 27001:2013 certificate expired on 2025-10-31, so an organisation still holding one is uncertified rather than late (source: ISO transition period, ISO/IEC 27001:2022). And Amendment 1:2024 added climate change to clauses 4.1 and 4.2, so you have to determine and document whether it's a relevant issue, even where the answer is no (source: ISO/IEC 27001:2022/Amd 1:2024). Your certificate itself has to come from a body accredited by the Standards Council of Canada, the only internationally recognised ISMS accreditation body here.
Four steps, and step 01 decides the cost of the other three. We've seen the same failure twice: an organisation scopes the entire company because it sounds more impressive, then spends eleven months evidencing controls for a warehouse nobody asked about. We'd rather argue about scope in week one than find the problem at stage 2.
The boundary, the interested parties, the risk method, and the exclusions, written down and defended. This is also where we tell you if certification is the wrong instrument for what your buyer is actually asking for.
An ISO 27001 gap analysis against all 93 Annex A controls, ranked by what stage 2 looks at hardest, with our engineers doing the technical remediation rather than handing you a spreadsheet of findings.
Policies people can follow, records that generate themselves where possible, and a management review that produces minutes rather than a meeting.
Internal audit, stage 1 readiness, stage 2 support in the room, then the surveillance audits at month 12 and month 24, which is where most certificates quietly fall over.
Answers first, including the one thing we're not allowed to do for you. An architect takes the call, not a salesperson.
LET'S CONNECT
A senior engineer replies within an hour, 24/7.