Certification Support

Certification Support is the full programme for companies that want a certificate and one partner accountable for getting it. We manage the whole journey: scoping, gap diagnostic, control build, internal audit and the certification audit itself.

We sit with you through Stage 1 and Stage 2 audits and answer the assessor's questions directly, so you are not left to defend the work alone. For ISO 27001 our target is Stage 2 within 75 days of kickoff for a defined scope with an engaged team; final audit dates depend on your certification body's availability.

ISONEX works remotely with clients across the GCC, UK, EU and US, with calls scheduled around your working hours.

Every programme moves through the same six steps, and each one ends with something you can check.

1. We agree scope: which product, systems, offices and people sit inside the certificate, and who owns the programme on your side.
2. A gap diagnostic compares what you do today with the standard and ranks the gaps by effort.
3. You build the missing pieces: policies, a risk assessment, a Statement of Applicability for ISO 27001, and the technical and process controls behind them.
4. The controls run long enough to leave real records, such as access reviews, change tickets, training logs and supplier checks.
5. An internal audit and a management review test the system before an outsider does. ISO 27001 requires both.
6. The certification body audits in two stages. Stage 1 reviews your documentation and readiness. Stage 2 checks that the system works in practice.

A SOC 2 Type II report follows a similar shape. A licensed CPA firm replaces the certification body, and an observation window replaces Stage 2. You can read more about the first step on our gap diagnostic page and about the pre-audit check on our internal audit page.

Certification support only works when your own people take part. They run the systems, so they make the decisions and produce the evidence. Our job is to keep that effort small and pointed at the right things.

Four roles matter most. An executive sponsor approves the scope, the risk appetite and the budget, and signs off the management review. Whoever runs engineering or IT answers questions about access, logging, backups, change control and cloud setup, and makes the technical fixes. HR or people operations covers background checks, security training and leaver processes. One person acts as the day-to-day contact and sends our questions to the right owner.

In a small company one person often holds several of these roles. That is normal, and we plan around the people you actually have.

The busiest stretch is the control build, when decisions and fixes pile up. After that the load drops to keeping records current and attending the audit. We lay out each stage so you can see who needs to do what, and by when.

Many companies end up needing both. Which one to start with depends on who is asking.

Start with ISO 27001 if your buyers are in the UK, the EU or the Middle East, if tenders ask for a certificate, or if you want one management system that covers the whole organisation. An accredited certification body issues the certificate, which is valid for three years with surveillance audits in between.

Start with SOC 2 if your buyers are US companies that send security questionnaires and ask for a report. A licensed CPA firm issues it as an attestation report, in two types. Type I describes your controls at one point in time. Type II tests them over an observation period, usually three to twelve months.

If you need both, build the controls once. Access control, change management, incident response and supplier management appear in both frameworks, so the same evidence can serve two audits. We plan the order around your deal pipeline. Our guides to ISO 27001, SOC 2 and Type I versus Type II go deeper, and fintech teams can start with ISO 27001 for fintech companies.