ISO 27001 / 27701 / 42001: Gap Assessment, Implementation & Audit Readiness
Structured gap assessment and implementation support for ISO 27001 (ISMS), ISO 27701 (PIMS), and ISO 42001 (AIMS). We build control frameworks, evidence trails, and audit-ready documentation — not template decks that fail under scrutiny.
We map controls to your operating reality — not a generic template imported from another organisation. Certification is the outcome of control maturity your auditors can verify.
For regulator-mandated information security audits under NRB or NIA — rather than ISO certification — see Information Security Audit — NRB & NIA Regulatory Compliance.
Who this is for
Methodology
Gap Assessment
Baseline your current controls against the applicable standard clauses and Annex A controls, with evidence review and stakeholder interviews.
Remediation Roadmap
Prioritised plan mapping gaps to owners, timelines, and resource needs — sequenced for certification readiness, not checkbox closure.
Implementation Support
Hands-on support building policies, procedures, risk treatment, and operational controls aligned to how your organisation actually works.
Internal audit readiness
An internal audit against the standard, performed by consultants who did not implement the controls being audited, so findings are objective before the certification body arrives.
External Audit Coordination
Support through stage 1 and stage 2 certification audits, including evidence preparation and auditor response.
What you get
- Gap assessment report with clause-level findings and maturity ratings
- Remediation roadmap with prioritised actions and ownership
- ISMS / PIMS / AIMS documentation pack (policies, procedures, SoA)
- Risk assessment and risk treatment plan
- Internal audit report and corrective action tracker
- Certification readiness brief for leadership and the certification body
Engagement FAQ
A fixed fee based on the agreed scope, quoted after a scoping call.
Implementation of ISO/IEC 27001, 27701 or 42001 typically takes 6–12 months. We guide you through every step, including the policies and documentation the management system requires. For a full programme, we typically support you for 3 years. We can also contract per year, with a minimum of 1 year.
No. Certificates are issued by an accredited certification body. We prepare you for certification and support you through the stage 1 and stage 2 audits.
Yes. You choose the certification body. We support you through its stage 1 and stage 2 audits, including evidence preparation and responses to the auditor.
Yes. We sign a mutual NDA before scoping. We can sign yours or provide ours.
We store client data and evidence in Microsoft 365, encrypted at rest (AES-256), with access limited to the engagement team. We delete them 90 days after the engagement closes and confirm the deletion in writing.
Every engagement is led by one of our three co-founders, from scoping through remediation. ISO work is led by a co-founder who is a PECB-certified ISO/IEC 27001 Lead Auditor.
The full list of deliverables is under What you get above.
Or email contact@trinitytech.com.np