ISO 27001 consultancy · Manchester & the North West
ISO 27001 consultancy that fits how your business actually works.
Consultancy, not certification. We provide consultancy and implementation support. Certification is undertaken independently by an appropriately accredited certification body. We are not a certification body and cannot guarantee certification.
Why ISO 27001
When a customer, tender or supply chain asks for ISO 27001.
Customer requirements
Larger customers increasingly ask suppliers to evidence information security, and ISO 27001 is the most widely recognised answer.
Tenders and frameworks
Public-sector and corporate tenders often score, or require, ISO 27001 certification.
Supply-chain expectations
If you handle customer data, designs or systems access, your customers' auditors will want to know how you protect it.
Stronger governance
A well-run ISMS gives directors a structured, repeatable way to manage information risk, whether or not you certify.
What we do
End-to-end ISO 27001 support, or just the parts you need.
ISO 27001 gap assessments
A clear view of where you are today against ISO/IEC 27001:2022, what is missing and how much effort closing the gap will take.
ISO 27001 compliance reviews
An independent assessment of whether your ISMS meets the requirements of the standard in practice, based on your documents, records and evidence.
Information security control reviews
Testing whether your Annex A controls are designed properly and operating as intended, with clear findings and recommendations.
Risk assessment and treatment
A practical risk methodology, a completed risk assessment and a risk treatment plan your team can maintain.
Statement of Applicability
Developing your SoA: justifying which Annex A controls apply, how they are implemented and why any are excluded.
ISMS and control implementation
Designing the ISMS, writing usable policies and procedures, and implementing technical and organisational controls alongside your IT provider.
Internal audit support
Planning and supporting internal audits of your ISMS, delivered by appropriately qualified people, so you can demonstrate it is operating effectively.
Certification readiness
Preparing your team and evidence for the certification body's Stage 1 and Stage 2 audits.
Ongoing compliance support
Management reviews, risk updates, periodic compliance checks and continual improvement after certification.
The journey
From gap assessment to certification readiness.
- 1
Gap assessment
Understand your starting point, scope and the effort required.
- 2
Scope and plan
Agree what the ISMS covers and a realistic timetable.
- 3
Risk assessment
Identify information risks and decide how to treat them.
- 4
Build the ISMS
Policies, procedures, Statement of Applicability and controls.
- 5
Operate and audit
Run the ISMS, gather evidence and complete an internal audit and management review.
- 6
Certification readiness
Prepare for the independent Stage 1 and Stage 2 audits.
Then: independent certification. Your chosen accredited certification body carries out the Stage 1 and Stage 2 audits and makes the certification decision. We can help you prepare, respond to findings and maintain the ISMS afterwards.
Our approach
An ISMS that strengthens the business, not just a certificate on the wall.
Because Ledger & Lock combines specialist information security expertise with senior finance and governance experience, we treat ISO 27001 as a business management system, not a documentation exercise.
Your risk assessment will reflect the real commercial impact of information risks, including payment fraud, operational disruption and supplier dependency. And your controls will be implemented, not just written down.
What that means in practice
- Proportionate documentation for a 10–50 person business
- Risk assessment grounded in commercial impact
- Controls implemented alongside your IT provider
- Your team trained to run the ISMS themselves
- Fixed fees agreed before each phase
Where we work
Based in Manchester. Working across the North West.
- Manchester
- Salford
- Trafford
- Stockport
- Bolton
- Wigan
- Oldham
- Rochdale
- Bury
- Tameside
- Warrington
- Cheshire
- Lancashire
- Merseyside
FAQs
ISO 27001 questions, answered plainly.
Do you certify businesses to ISO 27001?
No. We provide consultancy and implementation support. Certification is carried out independently by a certification body. In the UK, we recommend choosing one accredited by UKAS. Keeping the consultant and the certifier separate is an important part of the standard's credibility.
Can you guarantee we will achieve certification?
No consultancy can honestly guarantee certification. The decision rests with the independent certification body. What we can do is make sure your ISMS is well designed, operating as intended and supported by the evidence auditors expect to see.
How long does ISO 27001 take for a smaller business?
It depends on your starting point, scope and how much time your team can give it. For an established business of 10–50 people, implementation typically takes several months, as the ISMS needs to operate for a period before certification. Our gap assessment gives you a realistic timetable for your business.
How much does ISO 27001 consultancy cost?
We start with a fixed-fee gap assessment. From there, we quote a fixed fee for implementation based on your scope and how much you want to do in-house. Certification body fees are separate and paid directly to the certification body.
Which version of the standard do you work to?
We work to ISO/IEC 27001:2022, the current version of the standard, including its updated Annex A controls.
What is the difference between ISO 27001 and Cyber Essentials?
Cyber Essentials is a UK government-backed scheme focused on a set of core technical controls. ISO 27001 is an international standard for managing information security across the whole organisation, including risk management, governance and continual improvement. Many businesses benefit from both. We can help you prepare for either, but we do not issue certificates for either scheme.
Will ISO 27001 bury us in paperwork?
It should not. We design ISMS documentation to be proportionate to a business of your size, written in plain English, and built around how you already work.
Next step
Start with an ISO 27001 gap assessment.
Find out where you stand against ISO/IEC 27001:2022, how much work is involved and a realistic timetable, before you commit to anything more.
30 to 45 minutes, by video or in person
At a time that suits you.
A conversation, not a sales pitch
We want to understand your business first.
A clear proposal
If we can help, you will know what we suggest and what it will cost.