ISO/IEC 27001

Information security with accountable risk ownership.

Scope, risk, controls, suppliers, incidents and assurance evidence for an effective ISMS.

Discuss ISO support

Who this helps

Built around a buying situation.

Technology and professional-service SMEs
Organisations facing customer security requirements
Information security and risk owners

Useful when

The trigger is already visible.

Customers request an ISMS or certification
Security controls exist without coherent risk ownership
Scope, assets and supplier dependencies are unclear

The position

An ISMS built around accountable risk.

Pegasus connects scope, information, people, technology, suppliers and obligations to a repeatable risk process. Selected controls are justified and operated as part of the business rather than assembled as a certification evidence pack alone.

A defined scope and accountable decision owners

Controls matched to the real operating context

Evidence that can be reviewed, tested and improved

Scope

What the work includes.

Every engagement is scoped around authority, operating context, available evidence and the decision that must be made.

ISMS scope and risk

Define ISMS scope, context, interested parties, information and technology dependencies, criteria and risk ownership.

Control implementation

Develop treatment decisions, selected controls, policies, supplier, incident, access, resilience and assurance processes.

Internal audit and readiness

Run internal audit, management review and corrective-action verification before independent assessment.

Method

A controlled route from exposure to evidence.

Decision points, responsibilities and verification stay visible from the start.

Discover

Define the exposure, context, evidence, owners and decision that matters.

Design

Select proportionate controls and make responsibilities and hold points visible.

Implement

Embed the agreed system into the real operating workflow.

Verify

Test whether controls work and whether the evidence supports the conclusion.

Improve

Close actions, learn from exceptions and strengthen the system over time.

Outputs

Evidence designed for use.

Scope and evidence map

Prioritised findings and action ownership

Practical control or implementation pack

Verification record and next-step roadmap

Questions answered

Before you scope the work.

Does Pegasus provide ISO/IEC 27001 certification?

No. Pegasus supports implementation and internal assurance. An independent certification body makes any certification decision.

Do we need to implement every Annex A control?

Controls are selected and justified through risk treatment and applicable requirements. Exclusions need a defensible basis; the Statement of Applicability records the decision.

Start the conversation

Bring the exposure. Leave with a controlled route forward.

A first conversation is used to understand context, authority and the decision required—not to force a predetermined package.