Supporting an Organisation Towards ISO 27001 Certification

Achieving ISO 27001 certification requires strong project management as well as information security expertise. This case study looks at how AJC helped an organisation bring structure, accountability and momentum to its certification journey, from preparation through to successful certification.

The Challenge

Achieving ISO 27001 certification requires more than understanding information security. It involves coordinating people, responsibilities, documentation and actions across an organisation while ensuring progress remains on track towards a defined objective.

AJC supported an organisation working towards ISO 27001 certification that required additional structure and project management support to guide the process from preparation through to successful certification.

With multiple requirements to address, actions to complete and individuals involved, effective coordination was essential to maintain momentum and ensure responsibilities were clearly understood.

Our Approach

AJC provided structured project management support throughout the organisation’s journey towards ISO 27001 certification.

A key part of the approach was establishing clear oversight of the work required. Excel-based tracking tools were used to document actions, responsibilities and progress, providing visibility across the project and helping ensure outstanding tasks could be identified and followed up.

Regular meetings provided an opportunity to review progress, discuss outstanding actions and identify areas requiring further attention.

Tasks were assigned to the appropriate individuals, creating clear accountability and helping ensure everyone understood their responsibilities within the project.

Alongside project coordination, recommendations were provided throughout the process to help the organisation understand what needed to be addressed and determine the appropriate next steps.

This created a structured approach to the certification journey rather than treating ISO 27001 as a collection of individual tasks.

Preparing for External Audit

An important part of the certification journey is ensuring an organisation is prepared for its external certification audit.

AJC can support clients in preparing for this stage by reviewing their readiness, identifying areas that may require further attention and helping ensure the necessary processes and documentation are in place.

Internal audits can also form an important part of this preparation. They provide an opportunity to assess how effectively the Information Security Management System (ISMS) is operating and identify potential gaps before the external audit takes place.

Where required, AJC can also provide support during the external audit itself, helping clients navigate the process and respond to any areas requiring attention.

This means organisations are not left to approach certification alone, with support available throughout both the preparation and audit stages.

Keeping the Project Moving

One of the key elements of successful project management is maintaining momentum.

For a project involving multiple stakeholders and requirements, actions can easily become delayed or overlooked without clear ownership and regular oversight.

Through ongoing meetings, action tracking and clear allocation of responsibilities, progress could be monitored throughout the project and potential issues addressed as they arose.

This provided the organisation with greater visibility over its progress towards certification and ensured there was a clear route from preparation through to assessment.

The Outcome

The organisation successfully achieved ISO 27001 certification.

The project demonstrated the value of combining specialist knowledge with effective project management. While achieving certification was the ultimate objective, the structure surrounding the project played an important role in helping the organisation coordinate its activities, maintain accountability and progress towards that goal.

However, achieving certification is not the end of the journey.

Maintaining the ISMS After Certification

Once ISO 27001 certification has been achieved, organisations need to continue maintaining and improving their ISMS.

Without ongoing attention, processes can become outdated, actions may be overlooked and organisations can find themselves facing additional challenges when their next external audit approaches.

AJC can provide ongoing support following initial certification, helping organisations maintain their ISMS throughout the year rather than only revisiting it when an audit is approaching.

This can include regular reviews, internal audits, monitoring actions and helping organisations prepare for subsequent annual surveillance audits.

Taking an ongoing approach helps make information security management part of normal business operations rather than treating certification as a one-off exercise.

How AJC Can Help

At A Jolly Consulting (AJC), we understand that successful projects require more than a deadline and a list of tasks.

Our Project Management support can help organisations bring structure, oversight and accountability to complex projects, from establishing clear actions and responsibilities to monitoring progress, managing risks and coordinating stakeholders.

For organisations working towards ISO 27001 certification, our support can extend across the journey, from project coordination and audit preparation through to ongoing ISMS maintenance and preparation for future audits.

Whether supporting a compliance programme, transformation project or another important business initiative, AJC can provide practical project management support to help move projects from planning through to delivery.

Have a project that needs additional structure or support? Contact AJC on 020 7101 4861 or email info@ajollyconsulting.co.uk to discuss how we can help.

Image accreditation: Scott Graham (January 2016) from Unsplash.com. Last accessed on 20 October 2026. Available at:
https://unsplash.com/photos/person-holding-pencil-near-laptop-computer-5fNmWej4tAA