CNETS · Melbourne & Australia
ISO 27001 certification & consulting
Information Security Management System
ISO/IEC 27001 specifies requirements for an Information Security Management System (ISMS): a risk-based way to protect information, assign responsibility and continually improve security. CNETS helps Australian businesses develop, implement and maintain an ISMS and prepare for independent certification.
Implementation and audit preparation by CNETS. Certification decisions by an independent certification body.
The business case
Why invest in ISO 27001?
A security product protects part of your environment. An ISMS connects your people, processes and technology to the information your business needs to protect. It makes decisions about access, suppliers, incidents and continuity repeatable rather than dependent on individual judgement.
For SaaS providers, managed service providers and businesses handling customer information, certification can support supplier assurance and tender requirements. It does not guarantee that a breach will never occur or automatically establish compliance with every privacy law.
Built for your organisation
SaaS, managed service providers, professional services and businesses handling customer information.
- Make security responsibilities clear
- Prioritise information security risks
- Support customer and tender assurance
- Keep controls and evidence current
Scope & requirements
What does ISO 27001 cover?
Scope comes first. The work should reflect your operations, risks and assurance requirements.
Scope and accountability
Define the services, locations, information and dependencies covered by the ISMS. Identify interested parties, security objectives and accountable owners.
Information security risk
Identify threats and vulnerabilities, evaluate their business impact and decide how risks will be treated, accepted and reviewed.
Controls and the Statement of Applicability
Assess the relevance of Annex A controls and document inclusion, exclusion and implementation status in the Statement of Applicability. Control selection follows risk, legal and contractual needs.
People, suppliers and operations
Connect access management, awareness, supplier assurance, incident response, backup and change management to documented procedures and evidence.
Assurance and improvement
Plan internal audits, management reviews, corrective action and performance monitoring so leadership can see what works and what needs attention.
Practical outputs
What we work on with you
The proposal confirms the deliverables and responsibilities for your engagement.
- ISMS scope, gap assessment and prioritised implementation roadmap
- Risk assessment and treatment plan with accountable owners
- Statement of Applicability and relevant policies and procedures
- Evidence register, awareness plan and control review schedule
- Internal audit findings, management review inputs and corrective-action tracking
- Preparation for certification-body questions and ongoing surveillance
Before we begin
What helps us scope the work
You do not need everything ready to start a conversation. Existing material helps us avoid duplicating work.
- Services, sites and teams you want included in certification
- Customer security requirements and relevant contracts
- Existing policies, asset inventories and architecture information
- Current security tools, incident records and supplier lists
Choose with clarity
ISO 27001 and the Essential Eight: different jobs
- Purpose
- ISO 27001
An organisation-wide, risk-based information security management system.
- Essential Eight
A set of technical mitigation strategies to reduce common cyber threats.
- Coverage
- ISO 27001
Leadership, risk, people, suppliers, operations and continual improvement.
- Essential Eight
Areas such as patching, application control, MFA and backups.
- Relationship
- ISO 27001
Can use Essential Eight measures as part of risk treatment.
- Essential Eight
Implementation alone does not meet every ISMS requirement.
From assessment to action
How CNETS approaches ISO 27001
- 01
Define and assess
Agree the ISMS scope and compare current practices with the applicable requirements.
- 02
Plan and implement
Assign risk owners, select controls and build practical documentation around existing workflows.
- 03
Operate and evidence
Run the processes, brief your people and collect records demonstrating that controls work.
- 04
Review readiness
Complete internal audit, management review and corrective action before external assessment.
- 05
Certification and maintenance
Support preparation for Stage 1 and Stage 2 certification audits, then plan ongoing reviews.
Keep the work effective after delivery
An ISMS needs attention after certification: changes to systems and suppliers, new risks, incidents, staff training and audit findings all feed into regular review. Surveillance and recertification are arranged with your certification body; keeping evidence current is easier than rebuilding it just before an audit.
Our proprietary platform
Checkmate
Connect the work. Keep the evidence.
Checkmate brings policies, risks, control owners and supporting evidence into a connected workspace. Policy reading, acknowledgement and knowledge checks help connect the written ISMS to what employees understand. CNETS sets up your organisation and invites your first administrator, with the workspace aligned to your scope.
Checkmate.
One connected view. From implementation to your next audit.
Policies & evidence
A single source of truth.
People & ownership
Clear responsibilities.
Risks & controls
A connected management system.
How Checkmate supports your ISO 27001 program
Controls and applicability
Track Annex A control owners, status, evidence and justification, with Statement of Applicability export.
Connected risk treatment
Record likelihood and consequence, treatment plans, accountable owners and review dates linked to controls.
Controlled documents
Maintain policy and procedure versions, approval records and an audit trail of changes.
Evidence between audits
Organise auditor evidence packs and review supported AWS, Azure and Entra ID monitoring with CNETS for your environment.
Straight answers
ISO 27001: your questions answered
- What is an Information Security Management System?
An ISMS is the set of policies, responsibilities, risk-management processes and controls an organisation uses to protect information. ISO/IEC 27001 defines requirements for establishing, implementing, maintaining and continually improving that system.
- How do we get ISO 27001 certification in Australia?
Define your scope, assess risks, implement and operate the ISMS, and complete internal audit and management review. An independent certification body then assesses your system through its certification process. CNETS provides consulting and preparation; the certification body makes the certification decision.
- How long does ISO 27001 certification take?
Timing depends on scope, existing controls, staff availability and the certification body's schedule. A gap assessment identifies the work and evidence required before a realistic timeline can be agreed; there is no reliable one-size-fits-all duration.
- What does ISO 27001 consulting cost?
Scope, locations, complexity and your starting point affect consulting effort. Certification-body fees and any security-tool or remediation costs should be considered separately. Share your requirements with CNETS for a scoped proposal.
- What is a Statement of Applicability?
The Statement of Applicability records the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding Annex A controls. It connects your risk treatment decisions to the control framework.
- Is ISO 27001 mandatory in Australia?
It is not a universal legal requirement for every business. A customer, tender or contract may require it. Certification supports assurance but does not replace a separate assessment of applicable laws and contractual obligations.
- Does ISO 27001 require penetration testing?
It requires risk-based security controls and appropriate management of technical vulnerabilities. Whether penetration testing is needed, and its scope and frequency, depends on risk, your selected controls and contractual requirements; certification is not simply a requirement to buy an annual test.
- How do the Essential Eight and ASD cloud guidance fit with ISO 27001?
They are distinct ASD publications that work together. The Essential Eight is a baseline of eight technical mitigation strategies, assessed at maturity levels 0 to 3. The ASD Cloud Security Guidance is separate advice for selecting, configuring and assuring cloud services such as Microsoft 365, Azure and AWS, aligned with the Information Security Manual (ISM). CNETS assesses your environment against both, then maps the results into your ISMS risk treatment and Statement of Applicability, so the management system and the technical baselines reinforce each other.
Connected expertise
ISO 42001
Put responsible AI governance into practice, beyond a standalone policy.
VAPT
Assess exploitable weaknesses in applications, APIs, networks and cloud.
Awareness Training
Turn your workforce into a human firewall with continuous training and phishing simulations.
Standards & further reading
General guidance, not legal advice. Requirements depend on your scope and the applicable standard edition. Confirm certification and assessment arrangements for your organisation.
Next step
Your next step starts
with a conversation.
Tell us where you want to go. We’ll help you understand what it takes to get there.