Skip to content
Book a consultation
МКEN

ISO 27001 implementation

ISO 27001 implementation: from risk assessment to certification

We help you build an information security management system (ISMS) to ISO/IEC 27001:2022 that fits how your organization actually works. We define the scope, run the risk assessment, select and implement Annex A controls, and prepare you for the certification audit. An accredited certification body issues the certificate; our job is to make sure you are ready and to stay with you through the audit.

Book a consultationHow it works
  1. 01PlanContext, scope, risk assessment and objectives.
  2. 02DoAnnex A controls, processes and training.
  3. 03CheckMeasurement, internal audit and management review.
  4. 04ActCorrective actions and continual improvement.
Continual improvement of the information security management system (ISMS)

ISO 27001 implementation

What you get

01

An ISMS that fits

Scope, policies and controls match your business and its risks, so the system is used every day rather than kept for the auditor.

02

Risk-based decisions

A documented risk assessment and treatment plan show management where to invest and why each control is there.

03

Ready for the audit

Internal audit, management review and the required records are in place before the certification body arrives.

04

One effort, several obligations

Controls are mapped to North Macedonia’s NIS2-aligned law and, where relevant, to DORA, so the same evidence serves more than one requirement.

What's included

  • ISMS scope, boundaries and interfaces, agreed with management
  • Risk assessment methodology, risk register and risk treatment plan
  • Statement of Applicability covering the 93 Annex A controls in four themes
  • Policies and procedures written for your organization, not copied from a template
  • Implementation support for organizational, people, physical and technological controls
  • Internal audit and management review
  • Readiness review before certification and support during the external audit
  • Surveillance and recertification support, plus mapping to the NIS2-aligned law

How we work

  1. 01

    Scope and gap analysis

    We agree the ISMS scope with management and compare your current practices with the requirements in clauses 4 to 10 of ISO/IEC 27001:2022 and with Annex A.

  2. 02

    Risk assessment and treatment

    We set a risk methodology, assess risks with the owners of your information assets and decide how to treat them. The result drives the Statement of Applicability.

  3. 03

    Build and implement

    We write the policies and procedures, help your teams put the selected controls in place and set up the records the standard requires.

  4. 04

    Internal audit and management review

    We plan and run the internal audit objectively and impartially, as the standard requires, with auditors who did not build your ISMS, support management through the management review and help close nonconformities before certification.

  5. 05

    Certification and beyond

    We accompany you through the external audit by an accredited certification body, then support corrective actions, surveillance audits and recertification.

Who it's for

  • Organizations preparing for ISO 27001 certification for the first time
  • Companies whose clients, parent groups or tenders ask for an ISO 27001 certificate
  • Essential and important entities that want one management system for ISO 27001 and the NIS2-aligned law
  • Certified organizations that need support with surveillance audits, recertification or the 2022 controls

Frameworks and standards

  • ISO/IEC 27001:2022
  • ISO/IEC 27002:2022
  • NIS2-aligned law of North Macedonia
  • DORA

Frequently asked questions

Does Diverto issue the ISO 27001 certificate?
No. Certification is carried out by an independent certification body, ideally an accredited one, and Diverto is not a certification body. We help you build and run the system, prepare for the audit and accompany you through it. The audit and the certification decision belong to the certification body.
How long does implementation take?
It depends on the scope, the size of your organization and how much is already in place. A single site with mature IT practices moves faster than several locations with many suppliers. After the gap analysis we give you a realistic plan with milestones, and you agree the audit dates with your certification body.
What changed in ISO/IEC 27001:2022?
Annex A was restructured into 93 controls grouped in four themes: organizational, people, physical and technological. It is aligned with ISO/IEC 27002:2022, which gives guidance on each control. The transition from the 2013 version ended on 31 October 2025, so certification is now against the 2022 edition.
Does ISO 27001 make us compliant with the NIS2-aligned law?
Not on its own, but it covers much of the ground. The law’s ten risk-management measures, from risk analysis and incident handling to supply-chain security, access control and cryptography, map well to ISO/IEC 27001 controls. The law also has its own duties, such as registration on the cybersecurity portal, the three-hour first incident notice and specific management responsibilities, so we map both and close the differences.
What happens after certification?
The certification body checks that the ISMS is maintained through regular surveillance audits and a recertification audit at the end of the certification cycle. We help you keep the system running between audits: internal audits, management reviews, risk updates and corrective actions.

Related services

NIS2 complianceScoping, gap assessment and readiness for North Macedonia’s NIS2-aligned law, from portal registration to incident reporting.Learn moreDORA complianceDORA readiness for local subsidiaries of EU financial groups and for ICT providers that serve EU financial entities.Learn moreSecurity awareness & phishing simulationRole-based training and ethical phishing simulations that build a reporting culture, in Macedonian and English.Learn more

Let’s talk about your security

Tell us what you need: 24/7 monitoring, testing or readiness for the NIS2-aligned law. In a short call we will agree on scope and next steps.

Book a consultation+389 75 340 034

Mon–Fri 09:00–17:00 · SOC 24/7 · info@diverto.mk