Cycubix Is ISO 27001 Certified: What It Means for You

Cycubix is now certified to ISO/IEC 27001:2022, the international standard for information security management.

Clients, procurement teams and regulators increasingly expect suppliers to prove how they protect information, not simply describe it. Our certification answers that expectation with independent evidence.

This FAQ explains what ISO 27001 is, what our certification means for your organisation, and how we can help you achieve and keep a certification of your own.

Is Cycubix ISO 27001 certified?

Yes. Cycubix Ltd is certified to ISO/IEC 27001:2022 following independent Stage 1 and Stage 2 audits by West Assured, an accredited certification body. Certificate number: 0926317-A/1. Issued: 22 September 2026.

You can request a copy of our certificate at any time.

What is ISO 27001?

ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system (ISMS). It is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The current edition is ISO/IEC 27001:2022.

An ISMS is a structured, risk-based way of managing information security. It brings together the policies, processes, people and technical controls that protect the confidentiality, integrity and availability of information.

The standard has two parts:

• Clauses 4 to 10 set out mandatory management requirements: context and scope, leadership, planning, support, operation, performance evaluation and improvement.
• Annex A lists 93 reference controls grouped into four themes: organisational, people, physical and technological. Each organisation selects the controls that address its own risks and records its decisions in a Statement of Applicability.

What does certification involve?

Certification is granted by an independent, accredited certification body. The process follows a set cycle:

1. Stage 1 audit: the auditor reviews your ISMS documentation and confirms you are ready for the main audit.
2. Stage 2 audit: the auditor tests whether your ISMS is implemented and working effectively in practice.
3. Certification: once any findings are resolved, a certificate is issued, valid for three years.
4. Surveillance audits: shorter audits in the first and second years confirm the ISMS is maintained and improving.
5. Recertification audit: a full audit before the certificate expires starts a new three-year cycle.

Between external audits, the standard requires regular internal audits and management reviews, so certification is an ongoing commitment rather than a one-off project.

What does our certification mean for you?

It means the organisation you trust with your training, risk and compliance work has been independently verified against the international benchmark for information security management. In practice, you gain:

• Independent assurance. An accredited auditor has tested how we protect information, and surveillance audits keep testing it.
• Faster supplier due diligence. Our certificate and its scope can answer many of the questions in a typical security questionnaire, which can shorten supplier onboarding.
• Support for your own compliance. ISO 27001 expects you to manage information security in your supplier relationships. GDPR requires processors to provide sufficient guarantees, and NIS2 includes supply chain security among its risk-management measures. A certified supplier gives you documented evidence for each.
• Protection for what you share with us. Your staff details, training records, risk assessments and audit findings are handled within a managed system covering access control, incident management, business continuity and supplier oversight.
• Advice tested in practice. We have been through the same Stage 1 and Stage 2 audits we prepare you for. Our guidance combines years of experience helping organisations achieve and maintain ISO 27001 certification with first-hand experience of running a certified ISMS ourselves.

Does my organisation need ISO 27001?

ISO 27001 is voluntary, and no law requires certification on its own. However, it is often requested in public sector tenders, enterprise procurement and contracts with regulated clients.

It is particularly relevant if you are a software company, SaaS provider, managed service provider or consultancy handling client data, or if you supply organisations regulated under NIS2, DORA or GDPR. Certification gives you a recognised way to show that your security is structured, risk-based and independently checked.

How can Cycubix help you achieve certification?

We meet you where you are, whether you are just starting out or already have security practices in place. Our ISO 27001 readiness and certification service can be used end to end or as individual building blocks:

1. Gap assessment: we measure your current position against the clauses and Annex A controls, and give you a prioritised, realistic roadmap.
2. Scope and context: we help you define what your ISMS covers, so certification reflects the services your clients care about.
3. Risk assessment and treatment: we guide you through identifying and treating information risks, and preparing your Statement of Applicability.
4. Policies, procedures and controls: we help you write documentation that fits how your organisation actually works, not generic templates.
5. Training and awareness: we prepare your people to understand and apply their responsibilities, from leadership to developers.
6. Internal audit and management review: we help you run both with the objectivity the standard requires.
7. Certification audit support: we help you select an accredited certification body, prepare for Stage 1 and Stage 2, and respond to findings.

We work as an extension of your team and transfer knowledge as we go. The aim is an ISMS your organisation owns.

How can Cycubix help you stay certified?

Certification is only the start of a three-year cycle. We can support you with:

• Virtual CISO (vCISO) services for ongoing ownership and guidance of your ISMS.
• Annual internal audits and management review support.
• Preparation for surveillance and recertification audits.
• Updates to risk assessments, policies and controls when your business, suppliers or regulations change.
• Ongoing security awareness and secure coding training to keep skills current.

How long does certification take?

It depends on your size, the scope you choose and how mature your current security practices are. A gap assessment gives you a realistic timeline based on your actual starting point, rather than a generic estimate. For an overview of the full journey, read our step-by-step ISO 27001 roadmap.

Ready to start your ISO 27001 journey?

Whether you are preparing for your first certification or looking for support to keep it, a short conversation is the best first step. Book an ISO 27001 gap assessment with our team and you will know exactly where you stand and what comes next.

Talk to our ISO 27001 team