Build an information security programme your business can actually run.

ISO 27001 is often introduced through a customer requirement, a procurement questionnaire, an investor conversation, a board decision, or the need to demonstrate that security is managed systematically. But certification is not the real objective on its own.

A useful information security management system—an ISMS—helps your organisation understand risk, assign accountability, make informed decisions, protect information, manage suppliers, prepare for incidents, and demonstrate continuous improvement. When it is designed well, ISO 27001 provides a structure that supports trust and growth rather than a collection of documents created only for an audit.

Boxfish Labs helps growing organisations build security programmes that are proportionate to their product, customers, technology, data, people, and stage of maturity. Whether you are starting from scratch, strengthening fragmented practices, upgrading to ISO 27001:2022, preparing for certification, or maintaining an existing ISMS, we focus on controls and routines your organisation can use and sustain.

ISO 27001 support is particularly valuable when:

• An enterprise customer, public-sector buyer, or strategic partner requests certification or equivalent security evidence
• You are preparing for a funding round, acquisition, partnership, or entry into a regulated market
• Your current security documents, responsibilities, and controls are fragmented or inconsistent
• You need to move from informal founder-led security decisions to a more accountable operating model
• You are handling more sensitive information, adding employees, expanding internationally, or relying on more suppliers
• You need a credible, repeatable answer to customer security questionnaires and due diligence
• You hold an older ISO 27001 certification and need to align your ISMS with ISO 27001:2022

An ISO 27001-aligned ISMS is not just a policy pack. It connects the key components of information security into a system your organisation can manage over time:

• Leadership commitment, scope, responsibilities, and security objectives
• A structured understanding of information assets, context, risks, and opportunities
• Proportionate policies, standards, procedures, and technical or organisational controls
• Risk treatment decisions that are documented, owned, and reviewed
• Supplier, cloud, and third-party security management
• Incident management, business continuity, and operational resilience
• Security awareness and competence for people who handle information
• Internal audit, management review, corrective action, evidence, and continuous improvement

The exact implementation should fit your organisation. A 20-person SaaS company, an international IT provider, and a regulated financial-technology vendor will not need the same depth, structure, or set of controls.

You need a starting point

We assess current practices, identify the gaps that matter, define ISMS scope, and create a realistic roadmap so your team knows where to begin.

Your documentation exists, but it is fragmented or unused

We help simplify policies, standards, procedures, document control, ownership, applicability, and evidence so the ISMS reflects real operations rather than an unmaintained library.

You need to prepare for certification

We support the build-up to a certification audit: ISMS design, risk assessment, Statement of Applicability, policy and control implementation, evidence, internal audit, management review, and audit readiness.

You need to transition to ISO 27001:2022

We review existing practices against the current standard, identify gaps, update the ISMS, and strengthen the operational evidence needed for successful re-certification.

Customers are slowing sales with security reviews

We help connect ISO 27001 work to customer due diligence, evidence requests, security questionnaires, supplier assurance, and the clear security narrative enterprise buyers expect.

Security has no sustained leadership or ownership

A Fractional CISO engagement provides ongoing direction, programme ownership, risk oversight, reporting, and continuous improvement beyond a one-off certification project.

People need to practise secure behaviour

We combine ISMS requirements with human-centred awareness, role-relevant learning, simulations, and security champions so competence becomes part of the operating model.

01 — Define context and scope

Clarify the organisation, products, locations, people, systems, information assets, interested parties, customer expectations, and boundaries of the ISMS. Strong scope decisions prevent unnecessary complexity later.

02 — Assess maturity and risk

Review existing controls, documents, roles, suppliers, evidence, incident readiness, continuity, and awareness. Identify material risks, current gaps, and the controls or changes that deserve priority.

03 — Design the ISMS

Establish the governance, risk-assessment method, treatment approach, policies, Statement of Applicability, control ownership, document governance, objectives, and reporting routines needed for a coherent programme.

04 — Implement and evidence

Put controls into practice and create usable evidence. This may include access management, supplier reviews, incident management, backups, continuity planning, asset handling, secure development, awareness activities, internal audit, and management review.

05 — Audit and improve

Prepare for certification or surveillance audits, resolve findings, perform corrective actions, review management decisions, and keep the ISMS current as the business, technology, suppliers, and risks change.

Information security risk management

A repeatable process for identifying risks to confidentiality, integrity, and availability; assessing likelihood and impact; selecting treatments; assigning owners; and reviewing remaining risk over time.

Statement of Applicability

A documented view of which ISO 27001 controls apply to your ISMS, how they are implemented, why controls may not apply, and where evidence or supporting documentation can be found.

Policies, procedures, and document control

A usable structure for policies, standards, procedures, approval, review, versioning, ownership, retention, and communication. Documentation should guide work, not become an unread archive.

Supplier and cloud security

A structured approach to selecting, assessing, contracting with, monitoring, and reviewing service providers, cloud platforms, subprocessors, and other third parties that affect information security.

Incident management and business continuity

Plans, responsibilities, escalation routes, communication practices, recovery priorities, and lessons-learned routines that help your organisation respond to disruption and improve after an event.

Awareness and competence

Role-appropriate learning and evidence that employees, contractors, and relevant stakeholders understand the information-security responsibilities that apply to their work.

Internal audit and management review

Independent checks that the ISMS is functioning as intended, together with leadership review of performance, risk, objectives, resources, findings, and improvement actions.

• A proportionate ISO 27001-aligned ISMS designed around your actual business and risk profile
• Clearer security governance, ownership, decision-making, policies, and control evidence
• A practical roadmap toward certification, re-certification, customer assurance, or stronger internal maturity
• Better preparedness for customer security questionnaires, procurement reviews, audits, and stakeholder scrutiny
• More reliable risk management, supplier oversight, incident readiness, and business-continuity practices
• A security programme that can evolve as your company grows rather than needing to be rebuilt at every stage
• Stronger security awareness and clearer shared responsibility across teams