ISO 27001 consulting · Türkiye
ISO 27001 Consulting: Information Security Management System Implementation
I build your ISO/IEC 27001:2022 ISMS on scope, risk assessment and a Statement of Applicability that reflects your real business — from policy set to internal audit, audit-ready. Bilingual (TR/EN) engagements, on-site in Istanbul and Kocaeli, online anywhere.
Who it is for
Which companies benefit from ISO 27001?
Customer and contract security
Banks, corporates and international partners require ISO 27001 from their suppliers. Certification unlocks procurement and tender processes.
Software, cloud and data services
SaaS, fintech, cloud and outsourcing companies processing customer data. Payment ecosystems in Türkiye increasingly require it from partners.
KVKK and trust
Health, finance, education and e-commerce organisations turning personal data protection into a management-level discipline.
What the ISMS covers
What does the Information Security Management System manage?
Scope, assets and risk
- ISMS scope, context and interested parties
- Information asset inventory with ownership
- Risk assessment methodology, treatment plan and acceptance criteria
- Statement of Applicability: the 93 Annex A controls evaluated on your data
Policies and living records
- Information security policy set and topic-specific procedures
- Supplier security, incident management and business continuity
- Awareness programme, internal audit and management review
- Audit-ready records that prove the system is alive
Process
How the engagement works
Gap analysis
Current state reviewed against the 93 controls of ISO 27001:2022; output is a concrete gap list with owners and dates.
Documentation and SoA
Scope, policies, risk treatment plan and Statement of Applicability prepared with your own data — no template copies.
Implementation
Controls operated in daily work, records flowing, awareness raised. Eight-week implementation tracking by default.
Audit readiness
Independent internal audit, findings closed, and accompaniment through the certification audit.
Packages
ISO 27001 engagement models
System Implementation and Certification Support
From 49,000 TRY + VAT. Scope, asset inventory, risk assessment and SoA; eight-week implementation tracking, internal auditor training and accompaniment to the certification audit.
Maintenance Support
By proposal. One day on site per month: risk, incident, access and backup record monitoring; internal audit planning; surveillance audit preparation.
Starting price for a single-standard, single-location small business; certification body fees are not included. Integrated proposals are prepared for multiple standards. Bilingual documentation and audit support (TR/EN) available.
Independence
Consultant, not certifier
What I do and don't do
Certification audits and decisions belong to independent, accredited certification bodies. I prepare your system; I don't guarantee a certificate. Technical hardening (firewalls, backups, identity management) is implemented by your IT team or provider; penetration tests are run by specialised firms.
Written scope, fixed fee
Every engagement starts with a written proposal: deliverables, timeline, meeting count and what is out of scope. No surprise costs.
Let's take the first step on ISO 27001
Share your activity, headcount, locations and target audit date; I'll send a suitable scope and fee in writing. Intro call: 30 minutes, no charge.
FAQ
Common questions about ISO 27001
Do we need to change our technical infrastructure for ISO 27001?
Not always. The risk assessment shows which existing controls already cover your risks. Investment is prioritised only for unacceptable risks; implementation is done by your IT team or provider. Penetration testing is performed by specialised firms.
Is ISO 27001 mandatory in Türkiye?
It is not a legal requirement, but banks, payment institutions and corporate customers often require it contractually. For KVKK-covered organisations it also serves as systematic evidence of the administrative and technical safeguards.
Is ISO 27001 the same as KVKK compliance?
No, but they strongly reinforce each other. KVKK is a legal obligation; ISO 27001 turns data protection controls into an auditable management system. Most clients run both under one framework.
Can we combine ISO 27001 with ISO 9001?
Yes. Both standards share the high-level structure, so documentation is built once and integrated audits are possible; the combined proposal costs less than the sum of separate projects.