ISO 27001 certification is the internationally recognised standard for information security management. CyberMark manages the entire ISO 27001 compliance process for NZ businesses with 1 to 50 staff — gap analysis, ISMS documentation, risk assessment, security controls implementation, and certification audit preparation, handled by a NZ-based team, without the enterprise price tag.
Book Your Free ISO 27001 AssessmentEvery ISO 27001 engagement follows the same structured process and produces the same core outputs. You get more than a report; you get a documented, certification-ready ISMS built around your business.
A detailed assessment of your current security controls against the full ISO 27001:2022 requirements. We identify what you already have, what is missing, and what needs to change, with gaps ranked by risk level so you know where to focus first.
We build your Information Security Management System from the ground up. Policies, procedures, risk treatment plans, Statement of Applicability, and all mandatory documented information required to pass a certification audit.
ISO 27001 requires a systematic, documented approach to identifying and treating information security risks. We conduct your risk assessment, build your risk register, and implement the right controls from the Annex A framework.
Your people are part of your ISMS. We provide security awareness training that meets ISO 27001 requirements, ensuring your staff understands their responsibilities and reducing the human-factor risks auditors look at most closely.
Before your external certification audit, we conduct an internal audit to test your ISMS effectiveness, identify non-conformities, and confirm your documentation holds up under scrutiny.
We prepare you for your external audit with a readiness assessment and guidance on what accredited certification bodies will review. The certificate itself is issued by an independent accredited body; we get you there.
ISO 27001 certification requires annual surveillance audits and continuous improvement. Once certified, we provide ongoing monitoring and support to keep your ISMS current and your certification intact.
Achieving ISO 27001 certification follows a consistent process regardless of your starting point.
We review your current security environment against the full ISO 27001:2022 requirements. This surfaces gaps, identifies controls you already have, and gives us an honest baseline. Most gap assessments are completed within one to two weeks.
We design and document your Information Security Management System — policies, risk register, Statement of Applicability, and all supporting documentation. Where your existing CyberMark security tools already satisfy Annex A control requirements, we map them directly.
We implement the controls identified in your risk treatment plan and run security awareness training for your team. Where gaps require new technical controls, we advise on implementation or deploy them through your existing CyberMark managed service.
We conduct an internal audit, address any non-conformities, and prepare you for the external certification audit with an accredited certification body. We manage the process, you stay focused on your business.
Certification is not a one-time event. Annual surveillance audits, management reviews, and evolving regulatory requirements mean your ISMS needs to be maintained, not just built. We handle that too.
ISO 27001:2022 organises all of its security requirements into four control categories. To achieve certification, your Information Security Management System must address every one of them.
Policies, governance structures, roles, and procedures form the backbone of your ISMS. This category covers your Information Security Policy, risk management framework, supplier relationships, and how security responsibilities are assigned across your business. CyberMark develops all required policy documentation, builds your risk management framework, and defines roles and responsibilities in the format ISO 27001 auditors expect to see.
Most breaches involve a human element, which is exactly why auditors scrutinise this category closely. It covers employee security awareness, defined responsibilities, onboarding and offboarding procedures, and disciplinary processes. CyberMark delivers security awareness training that meets ISO 27001 requirements and produces the staff responsibility documentation your ISMS needs.
This is the largest Annex A category and the one most businesses have the most gaps in. It covers access control, encryption, network security, endpoint protection, secure configuration, and monitoring. If you are already a CyberMark client, Bitdefender EDR, Zabbix network monitoring, and Backblaze B2 encrypted backup directly satisfy a significant number of these requirements.
Physical security of your premises, equipment, and storage media protects against unauthorised access, theft, environmental damage, and loss of devices holding sensitive information. CyberMark identifies physical security gaps during your gap assessment and provides prioritised remediation guidance to close them before your certification audit.
This is what the path to ISO 27001 certification looks like. CyberMark manages every step on your behalf.
Establish which parts of your business, systems, and data fall within the certification boundary.
Compare your current controls against ISO 27001 requirements and identify what is missing.
Identify information security risks, assess likelihood and impact, and document risk treatment decisions.
Create all mandatory documented information, including policy, risk register, and Statement of Applicability.
Deploy the organisational, people, technological, and physical controls identified in your risk treatment plan.
Ensure all relevant staff understand the ISMS, their individual responsibilities, and why information security matters.
Test your ISMS against the full standard before your external audit and address any non-conformities found.
Your leadership reviews ISMS performance, audit outcomes, and corrective actions taken.
An accredited body conducts Stage 1 documentation review followed by Stage 2 on-site audit.
Certification is issued. Annual surveillance audits maintain your certified status.
This is one of the most common questions we hear. They are not the same thing, and choosing the wrong one costs time and money.
The right choice if your clients or partners are based in New Zealand, Australia, the UK, or Europe, or if you are pursuing government contracts, enterprise procurement, or any process that references international security standards. Globally recognised, independently certified, and covers your entire ISMS.
Primarily a US market requirement. If your business sells into American enterprise accounts or operates in US-regulated sectors, SOC 2 may be what those clients specifically ask for.
For most NZ small businesses, ISO 27001 is the higher-value certification — broader geographic acceptance, stronger alignment with NZ and AU regulatory requirements, and certified status that carries weight with government agencies, enterprise clients, and international partners.
Most ISO 27001 consultants are built for enterprise. CyberMark is built for the way NZ small businesses actually work.
Every person working on your ISO 27001 project operates from New Zealand. We understand the NZ Privacy Act 2020, the NCSC threat landscape, and what information security compliance looks like inside a 20-person Auckland firm, not a 500-person enterprise.
Most ISO 27001 consultants design their process for large organisations and adjust it downward for smaller clients. CyberMark built our service for businesses with 1 to 50 staff.
If you are already running Bitdefender EDR, Zabbix monitoring, or Backblaze B2 backup through CyberMark, those controls directly satisfy Annex A requirements for endpoint protection, network monitoring, and encrypted backup.
Most ISO 27001 consultants hand you a gap report and leave. CyberMark can implement the remediation steps directly through your existing managed security plan, so your controls are running, not just documented.
Every CyberMark engagement is month-to-month. Cancel with 30 days' notice, no exit fees, no penalty conversations. We retain clients by delivering results.
Our existing compliance service covers the NZ Privacy Act 2020, GDPR, HIPAA, and the AU Privacy Act 1988. ISO 27001 overlaps significantly with several of these frameworks, reducing duplication and cost.
Fixed-scope pricing with no surprises. Choose the level of support that matches where you are in your certification journey.
one-time assessment
one-time project
full certification support
Not sure where to start? A free 30-minute consultation gives you a clear picture of where you stand and what certification will take.
Everything you need to know about ISO 27001 compliance
Compliance requires defining your ISMS scope, conducting a documented risk assessment, implementing controls from the Annex A framework, running staff awareness training, completing an internal audit, and passing an external audit conducted by an accredited certification body. CyberMark manages every step of this process on your behalf.
For most NZ small businesses, the process takes three to six months from gap analysis to certification audit. Organisations with existing managed security controls in place — particularly those already using CyberMark's endpoint protection, monitoring, and backup services — typically move faster.
Costs depend on your organisation's size, existing security maturity, and ISMS scope. They include consulting fees for gap analysis, documentation, implementation support, and internal audit, plus certification body audit fees. CyberMark provides transparent, fixed-scope pricing before any work begins.
Compliance means your organisation meets the requirements of the standard. Certification means an independent, accredited body has formally audited and confirmed that compliance. Certification is the version that carries weight with clients, procurement teams, and regulators.
ISO 27001 is not mandated by NZ law, but it is increasingly required by enterprise clients, government agencies, and international partners as a condition of doing business. It also provides strong evidential support for NZ Privacy Act 2020 obligations.
An ISO 27001 compliance checklist is a structured list of requirements an organisation must satisfy to achieve certification, covering ISMS scope, risk assessment, documentation, control implementation, internal audit, and management review.
ISO 27001 certification opens doors to larger contracts, government procurement, and international partnerships. A free ISO 27001 readiness assessment takes 15-30 minutes, costs nothing, and gives you a clear picture of your certification gaps and what it takes to close them, whether you proceed with CyberMark or not.
Book Your Free ISO 27001 AssessmentWe respond within one business day. Email: [email protected] | Phone: 0273510488