ISO 27001 consulting · BSI certified

ISO 27001 from a team that's actually certified.

We don't consult on ISO 27001 from a textbook. We run an ISO 27001-certified ISMS ourselves, so we guide you with lived experience of what auditors look for, what implementations actually work, and what trips businesses up.

Book a Discovery Call What's included

BSI ISO/IEC 27001 certified ourselves Three-year cycle, maintained between audits Delivered by our own team

We've done it ourselves. We'll guide you through it.

InterIntra holds BSI ISO/IEC 27001 certification, independently audited, not self-declared. That changes the quality of the advice we give. We know exactly where the hard parts are, what auditors scrutinise, and how to build controls that actually work in practice rather than just on paper.

We also know how to keep documentation proportionate. Certification shouldn't require a wall of paperwork that nobody reads. We've guided Adelaide businesses through BSI certification from a standing start.

Back to Information Security →

The path from gap analysis to your first certificate.

ISO 27001 protects the three dimensions of information security: confidentiality, information is only accessible to those authorised; integrity, information is protected from unauthorised modification; availability, systems and data are accessible when needed.

Certification is not a single event. It's a programme you maintain. We work alongside your team from the first assessment through to the BSI audit, and stay with you through the three-year certification cycle if you need us to.

Assess & scope

Gap analysis: where you stand against ISO 27001 controls today
ISMS scope: scope definition and Statement of Applicability (SoA)
Risk assessment: methodology, risk register and treatment plans

Document

Policy library: proportionate to your size and complexity
Asset inventory: information classification and data mapping

Implement & review

Control implementation: support across all Annex A domains
Internal audits: programme design, scheduling and delivery
Management review: executive facilitation and board reporting

Certify & maintain

BSI audit prep: certification audit preparation and support
ISMS maintenance: ongoing management and surveillance readiness

How we work

Five phases, from first assessment to continual improvement.

Every ISO 27001 engagement follows the same structured path, with regular checkpoints so you always know where you are and what comes next. Certification is the milestone, not the finish line.

Phase 01
Gap analysis
We assess your current controls against ISO 27001 and produce a gap report with a prioritised remediation plan, before any implementation begins.
Phase 02
ISMS design
Scope, risk methodology, policy framework, asset inventory and Statement of Applicability. Built to pass audit, not just to tick a box.
Phase 03
Implementation
We work alongside your team on controls, policies, the risk register, the evidence library and your internal audit. As much or as little as you need.
Phase 04
Audit support
Document review, a pre-audit walkthrough, answering auditor questions, and being present throughout the BSI certification audit itself.
Phase 05
Continual improvement
Annual surveillance audits, a current risk register, internal audits and nonconformities managed. The certificate stays credible because it is maintained.

We've sat in the audit rooms ourselves.

Our own ISMS is certified by BSI, one of the world's most recognised certification bodies. When we tell clients what BSI auditors look for, it's because we've sat in those rooms ourselves.

ISO 27001 works best as part of a broader security programme. Our vCISO service provides the ongoing leadership to keep your ISMS alive between audits.

What you receive

Gap analysis report with prioritised remediation plan
Risk register with methodology and risk treatment plans
Statement of Applicability (SoA) covering all Annex A controls
Policy and procedure library, proportionate to your scope
Annex A control documentation and evidence library
Security awareness training materials tailored to your team
Internal audit reports and management review records
Surveillance readiness summary for each annual audit

Certified ourselves, not certified adjacent.

We run an ISO 27001 certified ISMS, independently audited by BSI. That changes what we can tell you about the parts that are hard.

With the exception of the certification audit itself, everything is delivered by our own team: no subcontractors, no outsourced delivery.

01
Lived experienceWe have been through the audit, which means we know where implementations actually fail rather than what the standard says in theory.
02
Proportionate documentationBuilt to pass audit and be maintained. Certification should not require a wall of paperwork nobody opens after the certificate arrives.
03
Our own teamDelivered by us, with the exception of the certification audit itself, which must be independent.
04
A three-year cycle, maintainedAnnual surveillance audits, a live risk register and internal audits, so the certificate stays credible after year one.

Questions

Got questions? We have answers.

Something else? Call 1300 080 000.

How long does ISO 27001 certification take?

For most small to medium businesses, the path from a standing start to initial BSI certification takes nine to fifteen months. Larger or more complex organisations may take longer. The timeline is driven by three things: the size of your scope, the maturity of your existing controls, and how quickly your team can implement changes and build evidence. A realistic gap analysis at the start tells you where you are on that spectrum.

Do we need to certify the whole business?

No. ISO 27001 lets you define your certification scope: it might be a specific business unit, a specific product or service, or the whole organisation. Scoping decisions affect the cost and timeline of certification significantly. We help you make the right scoping call early, because changing scope later is expensive.

What does the ongoing maintenance look like after we achieve certification?

ISO 27001 is a three-year certification cycle with annual surveillance audits. Maintenance involves keeping your ISMS documentation current, running internal audits, reviewing and updating your risk register, managing nonconformities, and preparing for each surveillance visit. We offer ongoing ISMS management as a retained service so you never arrive at an audit unprepared.

Do you outsource the ISO 27001 engagement to a third party?

No. With the exception of the certification audit itself, everything is delivered by InterIntra's own team. The certification audit is conducted by BSI, the independent body that issues the certificate, that's standard for all ISO 27001 engagements regardless of who consults on them. The gap assessment, ISMS design, policy documentation, internal audits, and pre-audit preparation are all done in-house. We don't subcontract any of the consulting or implementation work.

Real results. Real businesses.

We hold ISO 27001 certification ourselves, and we've helped others build security postures that stand up to independent scrutiny.

Essential Eight · Greenfield build

Sports College SA

Essential Eight and security framework implementation for a 500-student college, controls designed to scale from day one.

Healthcare · Live clinical environment

Sunshine Coast University Hospital

Independent ICT audit delivering assurance across life-critical health IT systems in partnership with Downer at a major Queensland facility.

See all our work →

Ready to start the path to ISO 27001 certification?

Thirty minutes, free, no commitment. We'll assess where you currently stand and give you an honest view of what certification realistically involves for your scope.

Prefer to talk? Call 1300 080 000, Monday to Friday, 8:30 am to 5:00 pm in Adelaide and Brisbane.

Book your ISO 27001 discovery call

Share your details and our team will be in touch within one business day.

First name *

Last name *

Business email *

Company *

How many staff use a computer?