Legal name, sites, scope of activities, headcount and shift pattern, outsourced processes, any existing certificate, and whether you received consultancy on the system and from whom.
GLOBAL
Loading
Global Energy Up is an independent certification body for management systems and a validation and verification body for greenhouse-gas information. We audit and decide; we do not consult.
ISO/IEC 27001:2022
Information security management
A control that nobody tested is an assumption, not a control.
ISO/IEC 27001 certification demonstrates that an organization assesses its information-security risks and treats them through selected controls, justified in a Statement of Applicability.
Who it is for. Technology and cloud providers, financial services, healthcare, government contractors and any organization holding sensitive information.
- Scope of the ISMS and its interfaces and dependencies
- Information-security risk assessment and risk treatment
- Statement of Applicability against the Annex A controls
- Organizational, people, physical and technological controls in operation
- Monitoring, internal audit and management review
- Nonconformity, corrective action and improvement
Each area above is assessed on objective evidence — records, interviews and direct observation of work.
How the audit runs
Audit time is determined under ISO/IEC 27006-1:2024, based on the number of persons doing work under the organization’s control and the complexity of the ISMS. Remote auditing never reduces the required audit time.
01.
Stage 1
Review of documentation, readiness and scope, and planning of Stage 2.
02.
Stage 2
On-site evaluation of implementation and effectiveness; findings are recorded.
03.
Decision & surveillance
An independent decision, then annual surveillance through the three-year cycle.
Why organizations seek it
01
Confidentiality, integrity and availability of information
02
Systematic identification and treatment of security risk
03
Protection against cyber threats and breaches
04
Trust from customers and regulators
Certification gives independent confidence in the system; it does not by itself guarantee any commercial outcome.
Edition and transition
Audits are conducted against ISO/IEC 27001:2022, the current edition.
Auditing with other standards
Where the system is integrated with others, the standards can be audited together in one visit; duration is calculated for each standard and then adjusted for the actual degree of integration.
- What do I need to apply?
- Why do you ask about consultancy?Because we do not certify a system on which a body related to us provided consultancy, and every application is screened for conflicts of interest before it is accepted.
