ISO 27001 · SUNSHINE COAST
Give information security a clear owner, a workable routine and evidence your customers can assess.
Aegentra helps Sunshine Coast businesses establish and improve an ISO/IEC 27001:2022 information security management system. We connect the project to your customer requirements, existing operations and the capacity of the people who will maintain it.
Melbourne-based · Remote Sunshine Coast delivery · Onsite by arrangement
Business-wide feedback, including consulting and Academy training.
A customer requests a certificate. The business owner reviews policies, the IT provider manages systems and the operations manager collects documents. Nobody has agreed who owns the whole system.
Start by establishing responsibility, deciding the scope and identifying work already happening.
Sunshine Coast Council describes diversification into professional services, finance and other activities supported by technology. Its investment priorities include health, education and knowledge industries. Your security programme should reflect your organisation's particular work. Council economic context · Industry priorities
Imagine a Sunshine Coast consultancy with a small permanent team, specialist contractors and clients elsewhere in Australia. This is an illustrative example, not an Aegentra client case study.
The business already approves new starters, backs up information and discusses delivery risks. However, access decisions sit in email, supplier checks are informal and security actions lose priority during busy projects.
Assign owners and bring existing activities into a consistent process. Leadership makes risk decisions; operational owners perform and record the work. An internal audit examines conformity and whether the system operates as intended.
A narrow scope still needs to account for shared staff, systems and suppliers. It should describe the service being assured accurately. Use the project scoping worksheet to prepare that discussion.
Select the areas you have already agreed with your team. This checklist creates a discussion list, not a maturity score.
Selections stay on this page and clear when you leave or refresh. No names, dates, client details or documents are requested.
| Checkbox label | Action shown while unchecked |
|---|---|
| A leader is accountable for the ISMS and risk decisions. | Agree accountability. Identify who can approve priorities, resources and risk decisions. |
| Each recurring activity has an owner and backup. | Allocate the work. Cover access reviews, supplier reviews, training and other activities relevant to your risks. |
| We have agreed when reviews happen and what triggers an earlier review. | Set the rhythm. Combine a planned calendar with reviews prompted by significant changes or incidents. |
| Evidence has an agreed location and is kept current. | Make evidence usable. Decide where completed records live and who checks that they reflect current practice. |
| Internal audit and management review are planned. | Plan evaluation. Allow for impartial auditing, leadership review and time to address findings. |
Use this list in a project discussion
For a wider view of implementation requirements, use the ISO 27001 checklist.
You may need a complete implementation, help finishing existing work, or an independent internal audit. The proposal should identify what can be reused and what still needs to be done.
Indicative starting budget: A$12,000–15,000 + GST A$13,200–16,500 including Australian GST.
For suitably scoped organisations with fewer than 10 people. Establish the ISMS scope, risk assessment, treatment plan, Statement of Applicability and agreed operating controls. We organise the implementation work, responsibilities and evidence, with certification-preparation support defined in your proposal. Internal audit is separately scoped unless included.
From A$2,300 + GST From A$2,530 including Australian GST.
For a smaller organisation with one clear ISMS scope and straightforward evidence access. A competent auditor reviews documents, interviews control owners and samples operating evidence against the agreed criteria. Deliverables include the audit plan, documented findings and report; any corrective-action follow-up is specified in the scope.
Indicative starting budget: A$15,000–18,000 + GST A$16,500–19,800 including Australian GST.
For suitably scoped organisations with fewer than 10 people. An implementation consultant, a different internal auditor and a project manager coordinate the programme. Auditor assignment is subject to documented competence, conflict-of-interest and impartiality checks. The agreed package includes assistance arranging a certification body and preparing for Stage 1 and Stage 2.
Your starting point, services, systems, locations, existing evidence and remediation needs determine the final work. We confirm the scope and fixed fee in writing. These starting budgets are not quotes for every organisation; larger or more complex businesses need a separate scope.
Certification-body fees are separate. Your proposal identifies any travel, licences, additional technical work and other exclusions before you commit. Compare the complete implementation and certification budget, not just the first invoice.
See ISO 27001 implementation for the full service. For an established system, review the internal audit service and internal audit preparation checklist.
Aegentra is Melbourne-based and supports Sunshine Coast businesses remotely. Onsite sessions are available by arrangement, with travel quoted. Agree workshop attendance and work between sessions.
The schedule must account for operational evidence, leadership availability and customer deadlines. A requested date does not guarantee certification by then.
Confirm what your customer needs, the services and information in scope, existing work, responsibilities and decision dates. Record the agreed deliverables and exclusions before implementation begins.
Work through the risks, necessary controls, Statement of Applicability and operating procedures. Implement the agreed changes and collect evidence from the people and systems that perform the work.
Arrange an objective internal audit, address findings and complete management review. The auditor must not audit their own work; appoint a separate provider if objectivity cannot be protected.
Organise the evidence and support agreed preparation for Stage 1 and Stage 2. The certification body controls its audit programme, findings and certification decision. Aegentra does not issue the certificate.
Timing depends on readiness, not just headcount. For an eligible fast-track scope, 5–7 weeks is an implementation planning target, not a promised certificate date. Leadership decisions, remediation, operating evidence, audit findings and certification-body availability can change the schedule. Your written proposal records the actual plan and dependencies.
Client feedback
Medical clinic · ISO 27001
“We certified our medical clinic for ISO 27001 through Aegentra, and the entire process was smooth and well managed.”
Google review excerpt, reproduced with permission.
Aegentra is based in Melbourne and delivers ISO 27001 services remotely across Australia, with onsite work by arrangement. We confirm the people assigned, their relevant qualifications, responsibilities and availability in your proposal. Travel and any onsite requirements are agreed before booking.
Our delivery-team capability includes ISO/IEC 27001 implementation and audit qualifications, CISA, CISM and cloud-security credentials. These are held across the team—not necessarily by every consultant. The experience and credential evidence relevant to your assigned roles are confirmed before work starts.
If Aegentra provides both implementation and internal audit, a different competent consultant who is independent of the implementation work performs the audit, subject to documented conflict and impartiality checks. If those safeguards cannot protect objectivity, a separate provider is required. Certification remains the responsibility of an independent accredited certification body.
Meet our delivery-team capability · Read an Australian internal-audit engagement
The linked audit case study is a published Australian engagement, not evidence of a client in this location.
Read Aegentra's Google reviews
Business-wide feedback, including consulting and Academy training.
Compare certification proposals using the same service scope, sites and accreditation requirements. Include the recurring audit programme and your own team's time when considering the ongoing commitment.
ISO/IEC 27001 is the management-system standard. An independent certification body audits your organisation and decides whether to issue a certificate. ANAB—the ANSI National Accreditation Board—IAS, the International Accreditation Service, and JASANZ are accreditation bodies: they assess certification bodies. They are not three different grades of ISO 27001.
Check that the proposed certification body holds current accreditation for ISO/IEC 27001 and that the certificate's scope fits the services, legal entity and locations your buyer needs covered. International recognition can support acceptance, but it does not override a tender's conditions. If a customer specifies an accreditation or permits an equivalent, clarify acceptance in writing before you book.
A certificate does not guarantee a government contract. If certification covering the work being purchased is mandatory, an unsuitable scope may leave your bid non-compliant. Meeting that requirement still does not replace the buyer's other participation conditions or evaluation criteria. Read the specific procurement documents and seek clarification where needed.
Why can the price differ? You buy certification from a certification body, not from an accreditation logo. Audit time, complexity, sites, travel, rates, follow-up work and the ongoing audit programme affect the quote. Compare Stage 1, Stage 2, surveillance and recertification on the same scope. Do not assume ANAB is always dearer, IAS is always cheaper, or that a customer's country alone determines which certificate it will accept.
Compare accreditation and certification costs
Verification references: ISO: certification and accreditation, ANAB: certificate checks, ANAB: certification cost factors, IAS management-system accreditation, Commonwealth procurement evaluation. State-specific guidance is linked in the relevant city sections.
The Australian certification cost guide explains the main cost categories to discuss before committing.
Yes, provided it can assign responsibility, make the necessary risk decisions and operate the agreed processes. The appropriate scope and level of support depend on the business. Team size alone does not determine readiness.
An IT provider can perform agreed technical activities and supply evidence. Business leadership still needs to make decisions about scope, risk, resources and accountability. Clarify those responsibilities before the project starts.
Often. First check whether they describe current practice, cover the relevant requirements and support usable evidence. Reuse should reduce duplicated work without carrying forward gaps or obsolete processes.
Your organisation continues operating and improving the ISMS. That includes reviewing risks, maintaining evidence, conducting internal audits and management reviews, addressing findings and meeting its certification body's applicable audit arrangements.
LET'S TALK
Tell us what has prompted the project, which service needs assurance and who will be involved. We can discuss a scope and delivery approach that makes the responsibilities clear.
Call 03 9956 9399 · Request a project discussion
03 9956 9399
Overseas: +61 3 9956 9399
Contact@aegentra.com.au
We typically respond within 1–3 business hours.