Organisational37
People8
Physical14
Technological34
Data and AI ISO 27001
ISO 27001
The information security standard most NHS buyers and enterprise customers expect.
- Who is responsible, which risks matter, which controls are in place.
- In Qyro, the whole system arrives configured to your company.
- Documents in your library
- 87
- Annex A controls
- 93
- Control themes
- 4
- Management system clauses
- 4 to 10
Clauses 4 to 10, and all 93 controls.
Qyro Library links each policy to the controls it answers.
Configured by your answers, not drafted by hand.
A blank template
[Organisation name] shall restrict access in accordance with [policy reference].
Your profile
Named clinical staff. Managed personal devices. Quarterly reviews.
Your policy
Fernway Health restricts access to patient data to named clinical staff, reviewed every quarter. (Example company.)
Six folders. Every document in its place.
From gap analysis to certificate, and every visit after.
1Gap analysisWhere you stand
2ImplementationControls in place
3Internal auditChecked first
4Management reviewSigned off
5Stage 1 auditDocuments
6Stage 2 auditPractice
7SurveillanceEvery year
Work done here counts elsewhere.
Questions buyers ask.
What do auditors look for?
That the system runs as written: a current risk assessment, a Statement of Applicability, internal audit and management review records, and evidence that matches your policies.
How do we choose a certification body?
Choose one accredited by UKAS. NHS and enterprise buyers look for it.
How long does it take?
It depends on where you start. One customer reached audit-ready in under four weeks. We will give you a realistic date on a walkthrough.
What does it cost against a consultant?
Talk to us about pricing.