For companies that need to get certified
ISO 27001 certification for companies
We work with your team to implement your information security management system (ISMS) under the 2022 version of the standard, and we prepare your company for the certification audit.
Free 30-minute consultation. We reply during business hours.
We have completed projects in which the client achieved ISO 27001 certification. Certification is granted by an accredited certification body; we prepare your company and support you through the process.
Pralogy is a cybersecurity firm headquartered in Miami, with an office in Bogotá, Colombia. We help companies implement their ISMS under the 2022 version of ISO/IEC 27001 and prepare for the certification audit. We work with a designated lead at your company. Certification is granted by an accredited certification body; we prepare your company and support you during that audit.
Which of these situations is your company in?
“A client, a request for proposal or our parent company requires ISO 27001, and we have no one to run the management system.”
“Our certificate was for the 2013 version and is no longer valid.”
“We are already certified, but every audit is a rush to gather evidence.”
“The internal audit left us with nonconformities, and we are not sure how to address them.”
Tell us what you are being asked for and by when. In the free 30-minute consultation we talk about your starting point and where to begin.
Request a free 30-minute consultation
Free 30-minute consultation. We reply during business hours.
ISO/IEC 27001:2013 certificates expired or were withdrawn on October 31, 2025, at the end of the transition, according to the International Accreditation Forum (IAF).
What we have already done
Clients who achieved certification
We have completed projects in which the client achieved ISO 27001 certification.
Companies coming from the 2013 version
We work with companies whose 2013 certificate expired, so they can get certified under the 2022 version.
Audits prepared within the managed security program
In our managed security programs, control reviews and audit preparation are part of the yearly plan.
Specialists in the standard
Our engineering team holds the ISO/IEC 27001 Lead Auditor and ISO/IEC 27001:2022 Lead Implementer certifications.
How we prepare your company, phase by phase
Gap analysis
We compare what you have today with the 2022 standard. You get the list of gaps and where to start.
Scope, risks and statement of applicability
We define what the system covers, analyze your risks and document which controls apply and why.
Implementation with your team
With your designated lead, we put in place policies, procedures and controls that your people actually use.
Internal audit and management review
We audit before the certification body does. You get the report and a plan to address the nonconformities.
Certification audit
The accredited certification body you choose performs it. We support you through it, with the evidence prepared.
After certification
There is a surveillance audit every year. A virtual CISO, who leads your security without being on staff, can prepare it.
In phases, with the scope in writing
Free 30-minute consultation. A conversation with our engineering team to understand your situation and suggest where to start. If you want to continue, we send you a written proposal. The work starts with the gap analysis and the scope, which shape everything else.
- Your company designates a lead. With that person, we handle the technical work and the documentation.
- The proposal states what Pralogy takes on, what your team does, the timeline and the terms.
- You choose the certification body. We prepare your company and support you during the audit.
Do you have a certification deadline?
Tell us where your management system stands and when you need it.
Free 30-minute consultation. We reply during business hours.
The same, on an ongoing basis
The certificate is audited every year. With the managed security program, a virtual CISO maintains the management system and prepares you for each audit.
Frequently asked questions
Do you certify my company for ISO 27001?
Certification is granted by an accredited certification body that you choose. We prepare your company for that audit and support you through it.
Is ISO 27001 mandatory?
In general, no law requires it. It usually comes from a client, a request for proposal, a parent company or a contract. Tell us who is asking for it and what you need to demonstrate.
Our certificate is from the 2013 version. What happens now?
According to the International Accreditation Forum (IAF), ISO/IEC 27001:2013 certificates expired or were withdrawn on October 31, 2025. We help you prepare for certification under the 2022 version; your certification body defines the exact procedure.
Do you perform the ISO 27001 internal audit?
Yes. We audit your management system before the certification audit. You get the report with the nonconformities and a plan to address them, and we support you in that work within the agreed scope.
Can you promise that we will pass the certification audit?
The decision belongs to the certification body. So that you arrive as prepared as possible, we run an internal audit beforehand, support you in addressing what it finds and prepare the evidence with your team.
Do we have to implement every Annex A control?
You implement the ones that apply based on your risks. The statement of applicability explains which ones and why. According to the IAF, the 2022 version has 93 controls; the 2013 version had 114.
Do we need an in-house team for ISO 27001?
You need one designated lead on your side. With that person, we handle the technical work and the documentation. The proposal states what Pralogy takes on and what your team does.
How long does it take to prepare for ISO 27001 certification?
It depends on the scope, your starting point and the time your team can dedicate. If you have a deadline, tell us from the start. The timeline is set in writing in the proposal.
We already have a consultant for the documentation. Can you handle the technical side?
Yes. We work with your consultant and handle the control review and the technical testing for vulnerability management, with a retest, within the agreed scope.
What happens after we get ISO 27001 certified?
There are surveillance audits every year. A virtual CISO can maintain the management system and prepare you for them. See how the virtual CISO works.
How much does it cost to prepare for ISO 27001 certification?
It depends on the size of your company and the scope. First we talk in the free 30-minute consultation; if you want to continue, we send you a written proposal. The gap analysis is the first phase of that work.
Let's talk about your company's certification
Tell us who is asking for the certification, by when and what you already have in place. We will suggest a phased plan. Our engineering team handles your request.
What happens next: we reply during business hours to set a time. If you want to continue, we send you a written proposal.
Sources
- International Accreditation Forum (IAF), IAF MD 26:2023, Transition Requirements for ISO/IEC 27001:2022. See the source
Updated on October 20, 2026.