ISO 27001 Consultant for Singapore SMEs
Your enterprise customer asked for ISO 27001.
Send the requirement.
For Singapore IT, SaaS, cloud and managed-service companies answering a security questionnaire, tender or contract condition. We build the Information Security Management System, or ISMS, with your team: the certificate scope, risk register, Statement of Applicability, policies and evidence for the certification audit.
Start by sending the customer's requirement or security questionnaire, your business activity, systems and locations in scope, approximate headcount and target date. We reply within one working day. After a short call or site visit, you receive a written quote listing the ISMS work, the documents and people your team must provide, and the project timeline.
PSCMC certified · ISO/IEC 27001:2022 Lead Auditor course (Exemplar Global-certified, 2026)
pre-checkCheck scope and EDGE before a quote
Who ISO 27001 is for
When an enterprise buyer asks how you protect its information.
You may be answering a vendor-security questionnaire, preparing a tender or responding to a contract that asks for ISO 27001 certification. ZES helps Singapore IT and technology companies define what must sit inside the certificate, build the ISMS and prepare for the independent certification body's audit.
IT, software and SaaS companies
For teams asked to show how customer information is managed across the services and systems named in the certificate scope.
Cloud and managed-service providers
For providers asked for a certificate, security policies or control evidence during customer onboarding or contract review.
Firms handling client information
For businesses that need named risk owners, recorded treatment decisions and evidence that agreed controls are being used.
Tender and procurement teams
For teams that need to assess the scope and audit route before giving an enterprise buyer a certification date.
Before we quote. Send the customer's requirement or security questionnaire, your business activity, systems and locations in scope, approximate headcount and target date. We confirm the project scope and what your team needs to provide.
ISO 27001 certification process
Build the evidence before the two audits.
Start by sending the enterprise requirement, security questionnaire or tender extract. We use it with your services, systems, locations, headcount and target date to define the certificate scope. Your team provides the people and existing records needed for the risk work, ISMS documents, internal audit, management review and the certification body's Stage 1 and Stage 2 audits.
- 01Confirm the ISMS scope
You send the enterprise requirement and confirm the business activity, services, systems, locations and deadline. We use this to define what the certificate needs to cover.
- 02Review gaps and information risks
We review the policies, processes and records you already use against ISO/IEC 27001:2022. Your team identifies the information risks; we record the treatment actions, owners and priorities.
- 03Prepare the ISMS and Statement of Applicability
We prepare the policies, procedures and Annex A control decisions agreed for the scope. The Statement of Applicability records which controls apply, which do not, and the reason for each decision.
- 04Create records from normal work
Your team starts using the agreed access-review, supplier-review, incident and other records that apply to the scope. We prepare the internal-audit and management-review work, then help your team address findings before the certification body visits.
- 05Prepare for Stage 1 and Stage 2
We organise the scope, risk and control evidence and brief the people the certification body may interview. Stage 1 reviews the ISMS; Stage 2 audits how the system is used.
ISO 27001 deliverables
What you receive, and what your team provides.
After the gap review, we confirm the services, systems, locations and information handling the certificate will cover. We prepare the agreed ISMS documents with your team. Your team provides the records it already uses, including access lists, supplier arrangements and security procedures, and makes the relevant owners available for risk decisions, review and interviews. The written quote names the deliverables for that scope.
- ISMS scope, information-security policy, objectives and roles
- Risk-assessment method, information-risk register and risk-treatment plan
- Statement of Applicability for the agreed Annex A controls
- Asset, access and information-security procedures relevant to your scope
- Enterprise customer and relevant supplier security requirements affecting the ISMS
- Security incident reporting and response records
- Document-control method and controlled document list
- Staff awareness and competence records for the people in scope
- Internal-audit programme, audit records and corrective actions
- Management-review records and certification-audit preparation file
| Information area | Risk | Treatment | Control owner | Evidence to review |
|---|---|---|---|---|
| Customer service data | Unauthorised access | Access review | Service lead | Access-review record |
| Cloud administration | Privileged-account misuse | Access controls | Technical lead | Account approval record |
| Supplier access | Third-party exposure | Supplier review | Operations lead | Supplier assessment |
| Security incidents | Late response | Incident procedure | Management | Incident log and review |
ISO 27001 consultancy cost
Check EDGE before you scope
EDGE pre-check
At a 15-minute EDGE pre-check, we check whether ISO/IEC 27001 and your company appear eligible, the likely scope and quotations needed. The fee is quoted after the pre-check and a short call or site visit. It depends on headcount, systems, locations, risks and existing controls. Certification body fees are separately quoted by the body. EDGE supports ISO/IEC 27001 at up to 50% for SMEs and up to 30% for non-SMEs. Apply before work or payment. Enterprise Singapore assesses each application.
What the implementation quote covers
- Gap review against ISO/IEC 27001:2022
- ISMS scope, risk assessment and Statement of Applicability prepared with your team
- Policies, procedures and records agreed for the scope
- Internal-audit programme, management-review records and corrective-action preparation
- Stage 1 and Stage 2 audit preparation with the certification body's evidence requirements in view
ISO 27001 project timeline
Allow 3–6 months before the certification audit.
For a typical SME, plan around three to six months from gap analysis to the certification audit. That allows time to agree the certificate scope, assess risks, put controls and records into normal work, complete the internal audit and management review, then schedule Stage 1 and Stage 2 with the certification body.
What helps the project move
- A clear enterprise requirement, certificate scope and deadline
- One project contact who can coordinate technical, operations and management decisions
- Existing security policies, system lists and evidence available for review
- Time for staff to use the agreed records before the certification audit
What can add time
- Several locations, services or systems in the ISMS scope
- Information risks or control responsibilities that need clarification
- Controls or records that have not yet been put into normal work
- Stage 1 and Stage 2 dates that need to fit the certification body's schedule
*Indicative SME guide from gap analysis to the certification audit. Your project plan depends on the agreed scope, when the team can create and use the required records, and the certification body's Stage 1 and Stage 2 dates. Your written quote confirms the timeline for your scope and target date.
ISO 27001 audit preparation
What we check before the auditor reviews the ISMS.
The certification body is independent from ZES. Before its audit, we check that the scope, risk decisions, controls and evidence reflect how your business actually manages information security.
The agreed scope names the systems and services
The ISMS scope names the services, systems, locations and business activities that you intend the certification body to audit.
Risks lead to decisions
Your risk assessment records the information risks, treatment actions and owners. The Statement of Applicability explains the Annex A controls that apply.
Controls work in normal operations
The team can show records from normal work, such as access reviews, supplier checks, incident records or security reviews relevant to the scope.
The customer requirement can be traced to evidence
We check that the customer's security questionnaire or contract requirement is addressed in the agreed scope, control decisions and records available for audit.
People know their role
The people the certification body may interview understand their information-security responsibilities and can explain the records they use.
Internal-audit and management-review records are ready
Your team has checked the ISMS, recorded findings and reviewed the system before the certification body samples it.
Your ISO 27001 consultant
One consultant for scope, risk work and audit preparation.
Nachi Leong, Principal Consultant
Nachi Leong leads every ZES project. Nachi works with your team from the scope call through risk decisions, ISMS documents and audit preparation. Nachi has experience since 2014.
About Nachi Leong- One consultant
Nachi leads the scope, risk review, document preparation and audit preparation with your team.
- Audit preparation experience
PSCMC certified. Nachi completed the ISO/IEC 27001:2022 Lead Auditor course (Exemplar Global-certified, 2026). She also holds a Diploma in Business Information Technology and worked from 2021 to 2024 at a global cloud accounting software (SaaS) company, first as a Small Business Specialist and then as a Customer Onboarding Specialist. ZES prepares your team for the independent certification body's audit.
- Risk-based system
We build the ISMS around the services, systems and information risks in your agreed scope, including the Annex A controls that apply.
- Confidential project discussion
We handle security details discreetly and can sign an NDA where you need one.
Recent ISO work
- ISO 9001 implementationHospital laboratory
- ISO 9001, ISO 45001 and bizSAFE Star recertification, plus ISO 14001M&E group, two companies
- Standards adoption across six companiesAutomotive group
ISO 27001 questions
Costs, timing and the certification audit.
Short answers for Singapore IT and technology companies responding to enterprise security requirements.
What is ISO 27001?
ISO/IEC 27001:2022 is the international standard for an Information Security Management System, or ISMS. It sets requirements for managing information-security risks and the controls used to protect the confidentiality, integrity and availability of information. An independent certification body audits the ISMS before issuing a certificate.
Why would an enterprise client ask us for ISO 27001?
Enterprise customers commonly use ISO 27001 as part of vendor due diligence, security questionnaires, tenders and supplier onboarding. The certificate gives the buyer independent evidence that your ISMS has been audited against ISO/IEC 27001:2022. Send us the customer's wording or questionnaire so we can plan the scope around the requirement.
How long does ISO 27001 certification take?
For a typical SME, plan around three to six months from gap analysis to the certification audit. This includes the scope and risk work, documents and controls in use, internal audit, management review, then the certification body's Stage 1 and Stage 2 dates. Your written quote sets out a timeline for your scope and target date.
What is an ISMS and a Statement of Applicability?
The ISMS is the set of policies, processes, risk decisions and controls used to manage information security. The Statement of Applicability, often called the SoA, lists the Annex A controls that apply to your ISMS and records why they apply or do not apply. Both are central to the certification process.
How much does ISO 27001 consultancy cost?
ZES quotes ISO 27001 consultancy after a 15-minute EDGE pre-check and a short call or site visit. The scope depends on headcount, the ISMS scope, systems, locations, information risks and existing documents or controls. Certification body audit fees are separate and quoted by the body.
What does my team need to provide?
Send the enterprise requirement or security questionnaire, your business activity, systems and locations in scope, approximate headcount and target date. Nominate a project contact and make the people responsible for technical systems, service delivery, supplier management and management decisions available. Your team also provides the records it already uses, confirms the scope and risks, reviews the documents, uses the agreed records, joins the internal audit and management review, and is available for certification-body interviews.
Who audits and issues the ISO 27001 certificate?
An independent accredited certification body, not ZES, audits the ISMS and issues the certificate. It reviews the system at Stage 1 and how it is used at Stage 2. ZES prepares the documents, internal audit, management review and team briefing, but the certification body decides whether its requirements are met.
What if the certification body raises findings?
Your team addresses the findings and provides the evidence the certification body requests before certification can be issued. We help you work through the points and prepare the evidence. The certification body makes the decision, so we do not promise an audit outcome.
How is ISO 27001 different from the Cyber Essentials Mark?
Cyber Essentials is a lighter baseline scheme. ISO/IEC 27001 is an international standard for information-security management systems. Some enterprise customers ask for the ISO/IEC 27001 certificate specifically, so check the tender, contract or security questionnaire before choosing a route (see ISO 27001 vs the Cyber Trust Mark).
Can ISO 27001 get grant support?
EDGE supports ISO/IEC 27001 at up to 50% for SMEs and up to 30% for non-SMEs. Consultant fees and first-year certification costs are supported. ZES meets the SS 680 vendor requirement through Nachi's PSCMC certification. Apply before starting work, signing, paying or placing a deposit. Enterprise Singapore assesses each application, so we do not promise approval.
Related ISO services and guides
Plan the certificate scope and audit route.
Start your ISO 27001 project
Send the requirement.
Know what your project needs.
Send the customer's ISO 27001 requirement or security questionnaire, your business activity, systems and locations in scope, approximate headcount and target date. We reply within one working day. After a short call or site visit, you receive a written quote listing the ISMS work, the documents and people your team must provide, and the project timeline.
- Phone
- +65 8901 2255