ISO consulting · ISO 27001
ISO 27001 information security in Melbourne
Answer security questionnaires with confidence – an ISO 27001 information security management system sized for a growing business, then taken through certification.
📍 Melbourne-based · working with businesses Australia-wide (remote)
Who it’s for
- Software, SaaS and IT service businesses
- Consultancies and engineering firms holding client data
- Businesses asked for ISO 27001 by enterprise or government clients
- Teams already working toward Essential Eight
Problems we fix
- Long security questionnaires slowing down sales
- No clear owner for information security
- Access, backups and suppliers managed informally
- Not sure which Annex A controls apply to you
What’s included
What your ISO 27001 system covers
Information security risk
A risk assessment that reflects your real assets and threats.
- Scope and context of your ISMS
- Information asset register
- Risk assessment and treatment plan
- Information security policy and objectives
Statement of Applicability
Every Annex A control reviewed and justified.
- Statement of Applicability
- Control owners and evidence
- Mapping to Essential Eight where useful
- Supplier and cloud security requirements
Policies and controls
Practical controls your team will actually follow.
- Access control and joiner-mover-leaver
- Backup, incident and continuity procedures
- Acceptable use and security awareness
- Change and asset management
Audit and certification
Proof the ISMS works, ready for the certification body.
- Internal audit of the ISMS
- Management review
- Help choosing an accredited certification body
- Support at Stage 1 and Stage 2 audits
How it works
How ISO 27001 certification works
- Free 20-minute callWe talk about your business, your sites and why you need ISO 27001.
- Gap auditWe audit what you have now against the standard and give you a clear action plan.
- Build and roll outWe write the system with you, train your people and run it for a few months to create records.
- Internal audit and certificationWe run the internal audit and management review, then attend your certification audit.
Why OHS Talks
- Led by a qualified ISO lead auditor with hands-on construction and engineering experience
- Systems written for how your business really works – no 300-page template
- One consultant for ISO 9001, 14001, 45001 and 27001, so integrated systems stay simple
- Clear starting prices and a written scope before any work starts
Packages
Clear starting prices
Gap audit
Timing set in your quote
- Audit against every ISO 27001 clause
- Written findings ranked by risk
- Clear action plan and cost to certify
- Ideal first step before a Certification Program
Certification Program
Usually 4–6 months for ISO 27001, depending on scope
- Full management system for one standard: ISO 9001, 14001, 45001 or 27001
- Gap audit and pre-certification internal audit
- Management review
- We attend your certification audit
Integrated system
Scoped to your standards
- Two or more of ISO 9001, 14001, 45001 and 27001
- One manual, one set of procedures and one audit cycle
- Shared risk register, document control and reviews
- Less duplication than running separate systems
Ongoing WHS support from $1,250/month (minimum 6 months): document control, incident reviews, a monthly site visit and audit preparation. Standalone internal or gap audit from $1,650 per standard. Two or more standards as one integrated system are quoted; ISO 27001 usually takes 4–6 months. Prices include GST and are starting prices. Timeframes depend on scope – every business is different. Monthly programs run under a written agreement with a fixed monthly fee. Travel, permits and approvals are charged at actual cost. Every job starts with a free 20-minute scoping call and a written quote.
Typical timeframes
| Package | Usual timeframe |
|---|---|
| Gap audit | Set in your quote |
| Certification Program (ISO 27001) | Usually 4–6 months |
| Integrated system | Quoted on scope |
New to ISO 27001? Read our plain-English ISO 27001 guide for small business – steps, costs and timeline.
FAQs
Common questions
How long does ISO 27001 take?
Usually 4–6 months for a small or medium business. The Statement of Applicability and the records needed before audit take longer than for other standards.
Do we need technical tools?
Usually not many. Most controls are about clear ownership, processes and evidence. Where tools are needed, we recommend options that suit your size.
What does it cost?
A gap audit starts at $1,650. Our Certification Program starts at $3,000 per month, and ISO 27001 usually runs 4–6 months, plus certification body fees.
How does ISO 27001 relate to Essential Eight?
They work well together. Essential Eight is a set of technical strategies; ISO 27001 is the management system around them. We map the two where it helps.
Can you combine it with ISO 9001?
Yes. An integrated system shares document control, internal audit and management review.
Ready to get ISO 27001 certified?
Book a free 20-minute call and we will tell you what it will take for your business.
This page is general information, not legal advice. OHS Talks Pty Ltd · ABN 96 702 010 964.