ISO 27001 readiness service
Limaz helps organizations define, implement, test, and evidence an ISO/IEC 27001 information security management system before independent certification assessment.
ISO/IEC 27001 defines requirements for an information security management system.
Our role is to help build the management system behind the assessment: scope, governance, risk method, risk treatment, Statement of Applicability, implemented controls, internal audit, management review, corrective action, and evidence of operation.
Define the ISMS boundary and business outcomes.
Find gaps in requirements, controls, and evidence.
Set the risk method, governance, documents, and treatment plan.
Put processes and technical controls into operation.
Run internal audit, management review, and corrective action.
Organize evidence for the independent certification body.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current edition, ISO/IEC 27001:2022, was published on 25 October 2022. Amendment 1, published in February 2024, adds climate action changes: the organisation now decides whether climate change is a relevant issue for its ISMS.
Any organisation can certify, whatever its size or sector. In Saudi Arabia, banks, fintechs, payment companies, insurers and technology suppliers use the certificate to show customers, partners and regulators that information security runs as a managed system, with accountable leadership, a risk method and evidence of operation.
The 2013 edition is finished. Under IAF MD 26, the International Accreditation Forum's transition rules, every accredited ISO/IEC 27001:2013 certificate expired or was withdrawn when the transition period ended on 31 October 2025. An organisation that missed the date starts again with a new initial certification against the 2022 edition.
Two related standards complete the picture. ISO/IEC 27002:2022 gives implementation guidance for each Annex A control. ISO/IEC 27701:2025, published in October 2025, is now a standalone standard for a privacy information management system (PIMS), built to align with an existing ISO 27001 ISMS.
Annex A of ISO 27001:2022 lists 93 controls, down from 114 controls in 14 clauses in the 2013 edition. Of the 93, 11 are new, 24 merge earlier controls and 58 are updated. ISO/IEC 27002:2022 explains each control and tags it with attributes such as control type, security property and cybersecurity concept.
37 controls
Policies, roles, asset inventory, classification, access rules, supplier security, incident management, continuity and legal and privacy requirements. New in 2022: threat intelligence, security for cloud services, and ICT readiness for business continuity.
8 controls
Screening, terms of employment, awareness and training, the disciplinary process, duties after termination, confidentiality agreements, remote working and security event reporting.
14 controls
Perimeters and entry, secure offices and areas, clear desk, equipment siting and maintenance, storage media, utilities, cabling and secure disposal. New in 2022: physical security monitoring.
34 controls
Endpoints, privileged access, authentication, malware protection, vulnerability management, backup, logging, network security, cryptography and secure development. New in 2022: configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
Accredited certification follows ISO/IEC 17021-1, with ISMS-specific rules in ISO/IEC 27006-1. One cycle lasts three years and holds five audits.
At Stage 1 the certification body checks that internal audits and management reviews are planned and being performed. Complete one full cycle of both, with records, before Stage 1.
The auditor reviews documented information, scope, the risk method and the Statement of Applicability, and judges readiness for Stage 2. Findings at this point are the cheapest to fix.
The auditor tests implementation and effectiveness through interviews, system walkthroughs and samples of records across the whole scope. Major nonconformities must be corrected before the certification decision.
The certification body issues a certificate for the stated scope, valid for three years.
At least once every calendar year, with the first no more than 12 months after the certification decision. Each one samples the ISMS and checks internal audit, management review and corrective action.
In the third year, before the certificate expires, a recertification audit reviews the whole ISMS and opens a new three-year cycle.
Saudi regulated organisations answer to more than one framework. Banks, finance companies and insurers follow the Saudi Central Bank (SAMA) Cyber Security Framework (SAMA CSF). Government entities and operators of critical national infrastructure follow the NCA Essential Cybersecurity Controls (ECC). ISO 27001 is the management system that holds them together.
The frameworks differ in kind. ECC-2:2024 is a prescriptive control set with 4 main domains, 28 subdomains, 108 main controls and 92 subcontrols, covering governance, defense, resilience, and third-party and cloud cybersecurity. SAMA CSF, issued in 2017, has four domains: leadership and governance, risk management and compliance, operations and technology, and third-party cybersecurity. It draws on ISO 27001 and 27002, NIST and PCI DSS, and SAMA measures it by maturity level, with level 3 as the minimum. ISO 27001 supplies the engine: scope, risk method, controls, audit and improvement.
The practical design is one control library, mapped once. Each control carries its Annex A reference, its ECC control number and its SAMA CSF control, with one owner and one evidence set. The ISO risk assessment sets priorities, the internal audit tests all three views, and management review sees one picture. Each regulator assesses against its own framework, so the mapping must be exact and the evidence reusable.
This is how Limaz builds it. We design one ISMS and produce the Statement of Applicability, the ECC compliance view and the SAMA CSF maturity view from the same controls and records. Your team runs one programme, prepares for certification once, and answers NCA and SAMA from the same evidence. The same structure extends to ISO/IEC 27701 and the Personal Data Protection Law (PDPL) for personal data.
Build a risk method and treatment cycle that supports the ISMS.
Connect ISO work with NCA, SAMA, and internal requirements.
Implement technical remediation instead of stopping at the gap report.
Build secure-development controls and evidence into delivery.
ISO/IEC 27001 sets the requirements for an information security management system (ISMS), and it is the standard you certify against. ISO/IEC 27002 is guidance: it explains how to implement each of the 93 controls listed in Annex A of ISO 27001, with purpose, guidance and attributes for each. You cannot certify to ISO 27002. Organisations use it to design controls and to write the justifications in their Statement of Applicability.
No. The transition period set by the International Accreditation Forum in IAF MD 26 ended on 31 October 2025. Every accredited certificate issued against ISO/IEC 27001:2013 expired or was withdrawn on that date, whatever expiry date was printed on it. An organisation that missed the transition starts a new initial certification, with Stage 1 and Stage 2 audits, against ISO/IEC 27001:2022.
The Statement of Applicability (SoA) is a required document under clause 6.1.3. It lists the controls your risk treatment needs, the justification for including them, whether each one is implemented, and the justification for excluding any of the 93 Annex A controls. Auditors use the SoA as their map of your control environment and sample it line by line, so each entry needs an owner and evidence.
An accredited ISO 27001 certificate runs on a three-year cycle. After the initial Stage 1 and Stage 2 audits, the certification body performs surveillance audits at least once every calendar year, with the first no more than 12 months after the certification decision. In the third year, a recertification audit before expiry reviews the whole ISMS and starts a new three-year cycle.
The pacing item is operating evidence, not documents. Before Stage 1, the certification body expects internal audits and management reviews to be planned and performed, so the ISMS must run long enough to produce real records. Stage 1 and Stage 2 are separate audits, and major nonconformities from Stage 2 must be corrected before the certification decision. Limaz plans backwards from the target audit date and builds evidence from the first month.
No. ISO 27001 certifies a management system. The NCA Essential Cybersecurity Controls (ECC) and the SAMA Cyber Security Framework (CSF) are regulatory frameworks with their own controls and their own assessments. The overlap is large, so a well-built ISMS carries most of the work: one control library mapped to Annex A, ECC and SAMA CSF, with one evidence set that answers all three.
ISO 27001 manages information security risk across all information. ISO/IEC 27701 manages privacy: it sets requirements for a privacy information management system (PIMS) covering personal data as controller or processor. The 2025 edition, published in October 2025, is a standalone management system standard that aligns with an existing ISO 27001 ISMS. Saudi organisations use it to structure Personal Data Protection Law (PDPL) compliance inside the same management system.
Clauses 4 to 10 require documented information for: ISMS scope, information security policy, risk assessment and risk treatment processes, the Statement of Applicability, security objectives, evidence of competence, operational planning, risk assessment and treatment results, monitoring and measurement results, the internal audit programme and results, management review results, and nonconformities with corrective actions. Annex A controls add documented procedures where your SoA includes them.
Tell us which system, control, or requirement you are working on. We’ll come back with a clear next step.
