An ISMS is a claim about how you manage risk. Certification asks you to prove that claim holds in practice. We run manual, exploit driven testing that produces the technical evidence your Statement of Applicability needs, mapped to the Annex A controls your certification body will ask about, so your ISMS reads as something you operate rather than something you documented.
ISMS evidence
We test the controls that turn a policy into a working system, and we prove each result by exploiting it rather than asserting it. What you get is defensible evidence, not a scan you have to interpret.
- Technical vulnerability management under A.12.6, showing exposures are found and handled the way your policy says
- Secure development and change validation under A.14.2, where new code meets the control instead of quietly bypassing it
- Compliance and independent review evidence under A.18.2, produced by testing outside your delivery team
- Findings written to sit directly in your ISMS record as evidence a certification body accepts
Annex A mapping
Every finding is tied to the Annex A control it exercises, so your Statement of Applicability cites real testing rather than an intention. There is nothing left for you to reconcile before an audit.
- Each result mapped to A.12.6, A.14.2 or A.18.2 for direct use in the Statement of Applicability
- Control applicability supported by evidence, so an assessor sees why a control is in scope and how it performs
- A scope and methodology statement your certification body can attach without rework
- Language that reads correctly to an auditor and precisely to the engineer who owns the control
Remediation tracking
A finding is not closed until the fix is proven. We track each result from discovery to verified closure, so your corrective action record shows a control that was tested, failed where it failed, and now holds.
- Remediation guidance your engineers can ship, not a generic reference link
- Free retest and verified closure, recorded for your corrective action log
- A clear audit trail from finding to fix that a certification body can follow
Continuous improvement
ISO 27001 is built on a cycle, not a certificate. We work as a testing hours pool you draw on as the ISMS evolves, so each surveillance period shows measurable improvement rather than a repeat of last year's findings.
- Retest on demand as controls and scope change across the certification cycle
- Trended findings and closures that evidence the improvement your ISMS commits to
- Coverage that keeps pace with your roadmap between surveillance audits
FAQ
Does this satisfy the penetration testing expectation for certification?
Yes. Independent, manual testing mapped to Annex A gives your certification body the technical assurance A.12.6, A.14.2 and A.18.2 call for.
How does it feed the Statement of Applicability?
Each finding is mapped to its Annex A control, so you can cite the testing as evidence of applicability and performance directly in the SoA.
Do you cover surveillance audits, not just certification?
Yes. The hours pool model lets you retest through the cycle, so each surveillance period shows evidence of continuous improvement.