Scope and risk
Define the ISMS boundary and assess risks affecting the confidentiality, integrity and availability of information.
ISO/IEC 27001:2022 / Information Security Management
Make information security a managed system.
Connect information assets, risk treatment, people and controls in a working ISMS. Explore ISO/IEC 27001 certification readiness and support in Nepal, alongside Innomerc’s security audit and GRC services.
Nepal-based coordinationIndependent certification
ISMS / IN PRACTICEIllustrative process
SERVICE NEEDS CHECK
Start the quick check Is ISO 27001 right for us?
A short, specific check to help you choose your next step. No contact details required.
The business question
Can we demonstrate a structured approach to protecting information?
Why consider this service?
Connect information risks with clear ownership, safeguards and evidence for management review.
What to bring to the first conversation
List sensitive information, important systems and customer security requirements.
ISMS / THE BUSINESS PURPOSE
Are information risks understood, owned and treated?
Confidentiality. Integrity. Availability. Managed through evidence and review.
Treatment and controls
Connect risk decisions, the Statement of Applicability and selected controls to accountable owners.
Operational evidence
Maintain records, monitor performance and use incidents, internal audits and management review to improve.
Who can benefit?
Software companies, financial organisations, outsourcing providers, managed service providers, healthcare and organisations handling sensitive information.
ILLUSTRATIVE EXAMPLE
An employee leaves. Access should not remain.
When an analyst leaves, HR informs the responsible teams. Corporate accounts, VPN, repositories and customer access are reviewed and removed as appropriate. Equipment is returned and actions are recorded. This connects people and procedures to technical controls rather than relying on security software alone.
Hypothetical scenario to explain the management approach; not a client case study.READINESS IS MORE THAN DOCUMENTATION
A management system needs operating evidence.
A functioning ISMS can improve information-risk decisions, supplier assurance, incident preparedness and the clarity of customer security discussions.
Discuss which assessment, implementation guidance, training, internal review and coordination activities your organisation needs. The proposal defines what Innomerc delivers, what involves specialists and what remains with the certification body.
ISO/IEC 27001 certification does not guarantee that a cyberattack cannot occur. VAPT is a technical assessment; it does not replace an ISMS or an independent certification audit.
Typical evidence to discuss
- ISMS scope and information risk assessment
- Risk treatment plan and Statement of Applicability
- Control ownership and operating evidence
- Internal audit, incident and review records
Illustrative topics, not an exhaustive checklist or a promise that every item is included in an engagement.
YOUR CERTIFICATION JOURNEY
Build readiness. Preserve independence.
Define the scope
Start with your business activities, locations, objectives and current certification status.
Plan readiness
Agree the support needed for gaps, implementation, evidence, training and internal review.
Independent assessment
The certification body assesses the management system and makes the certification decision.
Keep improving
Maintain the system and prepare for applicable surveillance, changes and recertification.
Readiness support and certification are distinct activities. The engagement defines Innomerc’s responsibilities and any specialist involvement. ISO develops standards; independent certification bodies conduct certification.
EDITION & SCOPE
Start from the applicable requirements.
This overview covers ISO/IEC 27001:2022. Applicable amendments, the ISMS scope and the certification route are confirmed as part of engagement planning.
Read the official ISO standard overview ↗QUESTIONS BEFORE YOU START
Make an informed next move.
Does passing a penetration test mean we meet ISO 27001?
No. Penetration testing can inform security risk management, but an ISMS also addresses scope, governance, people, processes, controls, evidence and continual improvement. Certification is a separate independent assessment.
What affects the price and timescale?
The organisational scope, locations, people, operational complexity, existing evidence and certification-body assessment requirements all matter. We discuss these before defining support. Certification is not guaranteed by a deadline or a consultancy engagement.
Who conducts the certification audit?
An independent certification body conducts its certification assessment and makes the certification decision. Innomerc’s support and coordination responsibilities are defined in the engagement scope.
Can this standard work alongside other management systems?
Yes. Organisations can share suitable management processes while retaining the distinct requirements of each standard. The appropriate combination follows business needs and must be scoped carefully.
CONNECTED CAPABILITIES
Keep the wider business context in view.
LET’S DEFINE YOUR NEXT STEP
A clearer scope starts with a conversation.
Share your organisation, sector, locations, existing certification and target timeframe. We’ll discuss the relevant standard, support and next steps.
Based in Kathmandu, supporting organisations in Nepal. Onsite, remote and specialist needs are agreed for each engagement.