ISO 27001 READINESS
A practical route to ISO 27001 certification in Houston
DESSS is a Houston-based IT consulting firm that helps organizations across Houston, Austin, and the rest of Texas prepare for ISO/IEC 27001 certification. We build the ISMS, run the risk assessment, implement the controls, and support your team through the Stage 1 and Stage 2 audits.
ISO/IEC 27001 is the international standard for information security management systems. It requires you to understand your information security risks, treat them with suitable controls, and keep improving the system over time.
DESSS prepares you for certification: we define the ISMS scope, run the information security risk assessment, build the Statement of Applicability, write the policies and procedures, and implement the technical controls. An accredited certification body then performs the audit and issues the certificate.
If you hold a certificate against the older 2013 edition, we also handle the move to ISO/IEC 27001:2022, including the new Annex A controls.
Who it suits in Houston
Houston organizations selling to international or enterprise customers, regulated industries, and companies that want one framework to anchor their security program.
Who certifies you
An accredited certification body audits the ISMS and issues the certificate. DESSS prepares you and supports you through the audits.
Certificate cycle
A certificate is valid for three years, with surveillance audits in the years between initial certification and recertification.
Current edition
ISO/IEC 27001:2022 is the current edition, with a 2024 amendment that asks organizations to consider climate change in their context.
ISO 27001 consulting for Houston and Texas businesses
Houston companies that sell to global buyers, work in regulated industries, or answer enterprise security questionnaires often choose ISO 27001 because the certificate is recognized internationally. DESSS works with your team to set the ISMS scope, close control gaps, and prepare evidence before the certification body arrives.
- Houston-based team for scoping workshops and management reviews
- Remote delivery for organizations across Texas and the United States
- Controls implemented in Microsoft 365, Azure, and AWS
WHAT THE STANDARD REQUIRES
What ISO 27001 requires
Clauses 4 to 10 set the management system requirements, and Annex A lists the reference controls. Certification auditors test both.
Context and scope
Define the issues, interested parties and requirements that shape the ISMS, and document a clear scope with its boundaries.
Leadership
Top management sets the information security policy, assigns roles and responsibilities, and shows active commitment to the ISMS.
Risk assessment and treatment
A repeatable method to identify, analyze and evaluate risks, and a treatment plan that selects controls to address them.
Statement of Applicability
A record of every Annex A control, whether it applies, why, and whether it is implemented.
Internal audit and review
Planned internal audits and management reviews that check the ISMS works and drive decisions about it.
Continual improvement
Nonconformities are corrected, root causes addressed and the ISMS improved over time.
ANNEX A CONTROLS
Annex A controls in the 2022 edition
ISO/IEC 27001:2022 groups 93 controls into four themes. You decide which apply based on your risk assessment, and justify each decision in the Statement of Applicability.
Organizational controls (37)
What do organizational controls cover? The largest theme covers policies, roles, asset management, access control rules, supplier relationships, incident management, business continuity and legal and regulatory compliance.
Our vendor risk management work supports the supplier controls.
–Information security policies
–Asset inventory and classification
–Supplier security
–Incident management
–Information security in continuity planning
People controls (8)
What do people controls cover? People controls address screening, terms of employment, security awareness and training, disciplinary process, responsibilities after termination, confidentiality agreements, remote working and event reporting.
Our security awareness training provides the training records auditors review.
–Background screening
–Awareness and training
–Confidentiality agreements
–Remote working
–Reporting security events
Physical controls (14)
What do physical controls cover? Physical controls protect offices, data rooms and equipment: perimeters, entry controls, monitoring, protection against environmental threats, clear desk and screen, and secure disposal of equipment and media.
–Secure areas and entry control
–Physical security monitoring
–Equipment protection
–Clear desk and clear screen
–Secure disposal and reuse
Technological controls (34)
What do technological controls cover? Technological controls cover endpoints, privileged access, authentication, malware protection, vulnerability and configuration management, backup, logging, monitoring, network security and secure development.
We implement many of these with Microsoft Entra Conditional Access and MFA, EDR and SIEM monitoring.
–Secure authentication
–Configuration management
–Data leakage prevention
–Logging and monitoring
–Secure coding
Controls added in 2022
Which controls are new in ISO 27001:2022? Eleven controls were added in the 2022 edition. Organizations moving from the 2013 edition need to assess and, where they apply, implement them.
–Threat intelligence
–Information security for use of cloud services
–ICT readiness for business continuity
–Physical security monitoring
–Configuration management
–Information deletion
–Data masking
–Data leakage prevention
–Monitoring activities
–Web filtering
–Secure coding
HOW WE WORK
How an ISO 27001 engagement runs
Six steps take you from scoping to a certification-ready ISMS, then support you through Stage 1 and Stage 2.
STEP 01
Scope the ISMS
Agree the organizational units, locations, systems and processes in scope, and record the context and interested parties.
STEP 02
Gap assessment
Compare current practice to clauses 4 to 10 and the Annex A controls to see what is missing.
STEP 03
Risk assessment
Identify and evaluate information security risks, then plan how each one will be treated.
STEP 04
Build and implement
Write policies, implement selected controls and complete the Statement of Applicability.
STEP 05
Internal audit and review
Run an internal audit and a management review, then correct any nonconformities found.
STEP 06
Certification support
Support Stage 1 and Stage 2 audits with your chosen certification body, and plan for surveillance audits.
SERVICES
DESSS services that support ISO 27001
An ISMS draws on governance, identity, monitoring and resilience work. These services deliver the controls the Statement of Applicability depends on.
WHY DESSS
Why work with DESSS on ISO 27001
Certification is the start, not the finish. We build an ISMS your team can keep running through every surveillance audit.
Controls implemented, not just listed
Our engineers implement the technological controls in your Microsoft, Azure and AWS environments, so the Statement of Applicability reflects reality.
Independent of the certification body
We prepare you and support you during the audits, but the certificate comes from an accredited certification body you choose.
Built for your team size
Documentation is sized to your organization, so mid-sized teams are not buried in paperwork they will never maintain.
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It sets requirements for managing information security risks and lists reference controls in Annex A.
Annex A of ISO/IEC 27001:2022 contains 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological controls.
The Statement of Applicability lists every Annex A control, states whether it applies to your organization with a justification, and records whether it is implemented. Auditors review it closely.
An accredited certification body performs the Stage 1 and Stage 2 audits and issues the certificate. Consultants such as DESSS prepare you but cannot certify you.
A certificate is valid for three years. The certification body performs surveillance audits in the intervening years, followed by a recertification audit.
The 2022 edition reorganized Annex A from 114 controls in 14 domains into 93 controls in four themes, added 11 new controls, and updated several management system clauses. The transition period for 2013 certificates ended on 31 October 2025.
No. ISO 27001 certifies a management system and is recognized internationally. SOC 2 is an AICPA attestation report on controls, common with US customers. Many controls overlap, so organizations often pursue both.
Yes. DESSS is based in Houston and prepares organizations across Houston and Texas for ISO/IEC 27001 certification. An accredited certification body performs the audit and issues the certificate.
No. You choose an accredited certification body, and it can audit remotely or on-site. DESSS prepares you for the audit and does not certify you.
ISO 27001 READINESS
Plan your ISO 27001 certification in Houston
Start with a scoping call. We will outline the ISMS scope, the main gaps and a realistic plan to certification.
RELATED
Related Compliance and Security Pages
Other compliance frameworks we support, and the DESSS security services that produce the evidence auditors ask for.