Information security. For real.
ISO 27001 certification
ISO/IEC 27001 is the international standard for information security. Getting certified does not mean signing forms: it means designing and running the right controls. AtWorkStudio is the technical implementer that sets up the management system — on-prem and in the cloud — alongside your consultants, sized to the real context of your company. We know it because we are certified ISO/IEC 27001, 27017, 27018 and ISO 9001.
Where do you stand on information security?
Find out in 15 minutes with our assessment based on the NIST Cybersecurity Framework 2.0. It is a concrete starting point to see how close you are to the requirements of an ISO 27001 management system and where the gaps are.
106 questions · Instant report · No commitment
The standard, in plain words
A management system (ISMS)
Risk, scope and Annex A
Compliance vs certification
Who really needs it
The 27017 and 27018 family
An asset, not a cost
The certification process, step by step
1. Gap analysis and scope
2. Implementing the controls
3. ISMS in operation and evidence
4. Stage 1 and Stage 2 audits
5. Certificate and surveillance
What drives the cost
Our role
Technical compliance, not bureaucratic
The compliance consultant tells you what is needed. We design and build the how: the controls that satisfy that requirement in a sensible, sustainable way, suited to your structure, your processes, your infrastructure and your budget — both on-prem at your premises and by delivering cloud services. We work alongside your consultants, turning requirements into solutions that actually work.
From requirement to a solution that holds
A security requirement can be met well or badly. «Strong authentication is needed» is not solved by forcing a password change every day: it is solved with MFA and Conditional Access proportionate to the risk, that people use without fighting the tool.
Backups that actually restore
«Backups are needed» is not a USB drive carried to a safe: it is an immutable backup, with the 3-2-1 rule, tested restore and measured recovery times. The difference shows on the day of the incident, not on paper.
On-prem and cloud, as needed
We implement the controls where it makes sense for you: at your premises, in the cloud, or in a hybrid model. It is the technical solution that follows the requirements and the context — not the other way round.
An excellent starting point, not the finish line
Where ISO 27001 covers
Where NIS2 asks for more
How we support you
We practise what we implement
AtWorkStudio is certified ISO/IEC 27001, 27017, 27018 and ISO 9001 (body CSQA). We do not make you sign forms: we build the infrastructure and the evidence that certification requires, because it is the same work we do on ourselves every day.
Frequently asked questions about ISO 27001 certification
The answers to the most common questions about what it is, how to get it and what it really takes.
ISO/IEC 27001 is the international standard for information security management systems (ISMS). Certification is the recognition, issued by an accredited body after an audit, that the organisation has defined a scope, assessed its risks, implemented the applicable Annex A controls and manages them continuously. The current version is ISO/IEC 27001:2022.
Compliance means operating according to the requirements of the standard; certification is the independent verification by an accredited third party that attests it with a certificate. You can be compliant without being certified, but it is certification that provides the proof you can use with clients, tenders and authorities. In both cases the real work is the same: designing and running the controls.
The typical path is: gap analysis, definition of scope and risk assessment, Statement of Applicability, implementation of the controls, a period of ISMS operation collecting evidence, then the two-stage certification audit (Stage 1 documentary, Stage 2 on site) and the annual surveillance audits. The duration depends on the starting maturity: for an already structured organisation it is months, starting from scratch takes longer.
The cost depends on objective factors: the breadth of the scope, the number of sites and people, the complexity of the infrastructure, the maturity of the controls already in place. Two items should be distinguished: the cost of the certification body (which issues the certificate) and the cost of the technical and organisational implementation needed to be ready for the audit. We work on the latter, sizing it to the real context of the company.
No. The certificate is issued by an accredited, independent body — not by whoever implements the controls, for impartiality. We are the technical implementer: we design and set up the ISMS and the controls, on-prem and in the cloud, and prepare the evidence for the audit. AtWorkStudio is itself certified ISO/IEC 27001, 27017, 27018 and ISO 9001 (body CSQA).
No: it is a solid foundation but not sufficient. It covers much of what NIS2 requires, but several obligations of the Italian Legislative Decree 138/2024 remain uncovered — personal liability of top management, incident notification timeframes to the CSIRT, registration and categorisation on the ACN platform. We explain it in detail in the deep dive on the seven gaps between ISO 27001 and NIS2.
Want ISO 27001 certification? Let’s start from the facts
Contact us for a dedicated consultation: gap analysis, an implementation plan with priorities and timelines, and the controls set up on the ground — on-prem and in the cloud — to arrive ready for the audit.