Compliance & AssuranceISO 27001
We build and operate your information security management system, collect evidence continuously from the systems you already use and take you through the audit with an accredited certification body.
01Overview
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires an organisation to assess its security risks, choose and implement controls, monitor and improve them, and be audited by an accredited certification body, which then issues a certificate valid for three years with annual surveillance audits.
The 2022 edition reorganised Annex A into 93 controls across four themes: organisational (37), people (8), physical (14) and technological (34). Organisations certified to the 2013 edition had until 31 October 2025 to transition, so new certificates are issued against the 2022 edition.
Certification is increasingly asked for by customers and tenders in Saudi Arabia and the GCC, and the ISMS also underpins compliance with the NCA ECC and other frameworks.
Key facts
02What we do
From scoping to the certificate and beyond.
Set the scope, context and interested parties, and assess current controls against the standard.
What you receive
A clear picture and a plan.
Identify risks, rate them and decide treatment, producing the Statement of Applicability.
What you receive
Risk-driven control selection.
A right-sized documentation set people will follow.
What you receive
Documentation that matches reality.
Technical and organisational controls built with your IT teams.
What you receive
Controls operating, with evidence.
Collect evidence from cloud, identity, HR and ticketing systems and monitor control health year-round.
What you receive
Always ready for audit.
Internal audit, management review and support through external audits.
What you receive
A certificate, and an ISMS that runs.
03How we work
Typical timeline for a mid-size organisation.
Assess and define the ISMS.
Risk assessment, SoA and policies.
Controls and evidence.
Test the ISMS and management review.
Documentation review by the certification body.
Implementation audit and certificate decision.
04Reference
Control themes and the audit journey at a glance.
| Theme | Controls | Examples |
|---|---|---|
| Organisational | 37 | Policies, roles, asset management, supplier security, incident management, continuity |
| People | 8 | Screening, awareness, remote working, reporting events |
| Physical | 14 | Secure areas, equipment, clear desk, media handling |
| Technological | 34 | Access control, cryptography, secure development, logging, monitoring, vulnerability management |
| Stage | What happens | Who does it |
|---|---|---|
| Readiness | Gap assessment, ISMS build, internal audit | You, with GoAgile |
| Stage 1 | Review of documentation and readiness | Accredited certification body |
| Stage 2 | Audit of implementation and effectiveness | Accredited certification body |
| Certificate | Issued for three years | Certification body |
| Surveillance | Annual audits, then recertification | Certification body |
05Evidence sources
Where systems support it, evidence is collected automatically and kept for the auditor.
Logos are trademarks of their respective owners and are shown to indicate platforms we work with.
06Saudi Arabia and the GCC
A recognised certificate shortens sales cycles and supports regulation.
Government and enterprise buyers increasingly ask for ISO 27001 as a condition of doing business.
An ISMS provides governance, risk management and evidence that map to ECC and SAMA control areas.
We work with accredited certification bodies recognised in the Kingdom and the GCC, and help you choose.
07Why GoAgile
We hold ISO 27001 ourselves.
We run our own ISMS and know what auditors look for.
Controls built, not only documented.
Less spreadsheet, more automation.
Policies people use.
We stay with you through both stages.
Both languages.
Credentials
08Clients
Organisations in regulated sectors choose GoAgile because security is delivered by the team that also builds and runs their infrastructure.
Tier-1 Saudi bank
Banking
National energy operator
Oil, gas and power
Government authority
Public sector
Regional telecom operator
Telecommunications
Healthcare group
Hospitals and clinics
Retail and e-commerce group
Retail
Ports and logistics operator
Logistics
Insurance company
Insurance
Fintech and payments provider
Financial technology
Industrial manufacturer
Manufacturing
Enterprise customers were asking for a SOC 2 report the company did not yet have.
Result: The audit completed with the report customers had asked for.
The insurer needed certified information security management to win larger corporate accounts.
Result: Certification achieved first time, with an ISMS the team now runs itself.
The bank needed evidence that its people, processes and detection would hold up against a realistic attacker, in line with SAMA expectations.
Result: Detection gaps were fixed, playbooks were updated and the board received a plain-language report.
Client names are withheld for confidentiality.
09Related services
Each service stands alone and works better with the others.
Tell us your size and timeline. We will propose a plan to certification.
Start ISO 2700110Questions answered
Tell us about your environment and what you need. We will respond with a scoped proposal, not a brochure.
Specialists who do this work every week, reporting in Arabic and English.