01
SaaS and technology
Demonstrable security for B2B customers, cloud providers, MSPs, and product teams.
ISO 27001:2022 Consulting
ISO 27001 consulting to implement a useful and defensible ISMS.
We accompany companies that need to be certified, respond to customer demands or convert information security into a maintainable and proportionate system.
Gap analysisgaps, scope and prioritiesISMSpolicies, processes and recordsRisksmatrix and treatment planSoAStatement of ApplicabilityAuditevidence and continuous improvement
for whom
When ISO 27001 stops being “someday” and becomes necessary.
Especially useful if an enterprise client requires it, you want to sell more trust, you handle sensitive information or you need to organize controls before growing.
02
Professional services
Protection of customer information, contracts, confidential data and continuity.
03
Regulated providers
Companies that combine ISO 27001 with ENS, NIS2, DORA or contractual requirements.
04
Growing SMEs
A system tailored to the organisation, with documentation and controls suited to its scope and resources.
What's included
From the initial gap to a defensible audit.
We build the system around the client’s context, with justified decisions, evidence and clear ownership.
- Initial diagnosis and scope of the ISMS
- Asset inventory and critical information
- Risk analysis and treatment
- Statement of Applicability
- Policies, procedures and records
- Internal audit and improvement plan
Deliverables
Documentation that the team can maintain.
We design documentation to support operations, with clear ownership and follow-through.
- Roadmap prioritized by risk
- Risk and treatment matrix
- Evidence folder
- Training and awareness plan
- Record of incidents and actions
- Support for external audit
Method
ISO 27001 implementation route in five phases.
A simple roadmap for management, IT and audit to understand what is being done and why.
Diagnosis
Context, scope, gaps and quick wins.
Initial reportRisks
Assets, threats, impact and treatment.
MatrixControls
Technical and organizational measures.
SoAEvidence
Records, training, incidents and audit.
ISMS FolderImprovement
Corrective actions, internal audit and monitoring.
Continuous · Annual planEFFORT AND SCOPE
Effort is determined after assessment.
Scope, maturity, existing controls, evidence and internal availability shape the work. We agree phases and deliverables; timing depends on scope, maturity, internal availability and third parties.
Connected compliance
ISO 27001 does not live isolated from the rest of the requirements.
We define a coherent route when there are public contracts, regulatory requirements or the need to validate technical controls.
ENS
ENS and public providers
If you provide services to the Administration, we review what controls and evidence can be coordinated.
See ENS adaptation →NIS2
NIS2 and government
Risk, supplier, incident and continuity management may require a common roadmap.
See NIS2 preparation →TEST
Actual technical validation
Authorised testing of applications, APIs or infrastructure can complement the ISMS with technical evidence and an executive report, subject to the agreed scope.
See pentesting →ROLE
Blue Moon Role
We prepare the ISMS, its evidence and the internal audit; certification is carried out by an independent body.
Forms of work
Three entry points, depending on where you are.
The price depends on the actual scope: headquarters, systems, people and maturity. After the diagnosis we give you a final written figure.
01
Diagnosis
Gap analysis, ISMS scope, gaps and prioritized roadmap. The honest starting point before committing to an entire project.
Price closed after initial call
Request diagnosis →02
Complete implementation
From diagnosis to audit: risks, SoA, policies, evidence, training and support before the certifying entity.
Budget by scope
Request proposal →03
Continuous support
Maintenance of the ISMS, annual internal audits, continuous improvement and support in certificate renewals.
Fee according to support level
Talk about maintenance →FAQ ISO 27001
Common questions before implanting.
Answers designed to decide scope, times and internal effort.
How long does it take to implement ISO 27001?
The schedule is agreed after assessment and depends on scope, maturity, internal availability and third parties.
Does Blue Moon certify directly?
We support ISMS implementation and evidence preparation. Certification is performed by an independent certification body.
Do I need ISO 27001 if I already comply with ENS?
It depends on the objective. ENS and ISO 27001 share controls and evidence, but respond to different frameworks. They can work together to avoid duplication.
What does the client need to contribute?
Information on processes, assets, suppliers, managers, incidents, existing controls and availability to validate decisions.