Governance & policies
Security policy, roles and responsibilities, segregation of duties, communication with authorities.
ISO/IEC 27001:2022 · Certification
ISO 27001 certification, without rewriting your work.
We design and build the ISMS around how you already operate. In 12 weeks you have a system the auditor accepts — and that keeps working after certification, not just up to it.
KodeX GRC, based in Larissa, Greece, prepares organisations for ISO/IEC 27001:2022 certification. In about 12 weeks you have a working ISMS with the 8 core documents and all 93 Annex A controls mapped, and we sit beside you at Stage 1 and Stage 2 of the audit. Total time to the certificate is typically 4–5 months.
What it covers
All 93 Annex A controls, organised into eight areas — each mapped to an owner, an artefact, and a method of proof.
Risk management
Methodology, register, acceptance criteria, periodic re-assessment.
Assets, identities, access
Asset inventory, information classification, authentication, MFA, access reviews.
Technical measures
Privileged access, encryption, key management, secure configuration.
Incidents
Detection, response, recording, learning, evidence.
Supply chain
Supplier register, assessment, clauses, relationship and risk management.
Continuity & resilience
BCP/DR plan, RTO/RPO, periodic testing, results documentation.
Compliance & review
Internal audit, management review, corrective actions, compliance with requirements.
Who it's for
Certification is worth it when a third party asks for it — a client, a tender, a regulator, or the board itself.
We work primarily with Greek companies between 50 and 500 employees that already have a technical environment but no documented management system.
The rule: if you answer client security questionnaires with "yes, but we don't have a document", certification closes that conversation once and for all.
B2B companies responding to RFPs and client questionnaires
SaaS and software selling to enterprise or regulated industries
Manufacturing and export with EU clients that require it contractually
Companies in NIS2 or DORA that want one framework to cover everything
Anyone already paying for fragmented security measures without proof
How we work
Five phases. Each has a clear deliverable, a clear duration, and a completion criterion you can verify.
Assessment
What you actually have
Interviews, inventory, evidence review. Output: a gap register the board can read.
2 weeksDesign
A system, not a manual
We write the policies around how you operate. Statement of Applicability, risk plan, roles.
3 weeksImplementation
Controls in production
We deploy the technical and organisational measures, build the evidence pipeline, assign owners.
4 weeksInternal audit
A dry run through the auditor's eyes
We run the audit first. We close findings before anyone else sees them.
2 weeksCertification
We sit beside you
Presence at Stage 1 and Stage 2. We answer findings with you, not instead of you.
1 weekWhat you get
Eight artefacts the auditor will ask for by name. None of them are documents you'll have to write yourself afterwards.
Statement of Applicability (SoA)All 93 controls, with justification for inclusion or exclusion.
Risk registerWith owners, assessment, existing controls, treatment plan.
Complete set of policiesSecurity, access, suppliers, incidents, continuity, and more.
Asset inventoryWith classification, owners, and linkage to risks.
Evidence pipelineFolder structure, naming convention, renewal schedule.
Internal audit reportResults, findings, corrective actions.
Management review minutesStructured agenda, decisions, resource commitments.
Stage 1 & 2 supportPreparation, presence, findings responses, CAPA closure.
Timeline — 12 weeks
Typical engagement for a mid-sized organisation. Weeks adjust if scope or availability requires.
WK 01–02
Scoping & discovery
Boundaries, in-scope assets, interviews, gap register delivered.
WK 03–05
SoA & design
Statement of Applicability, risk plan, full set of policies.
WK 06–09
Build & implement
Controls live, evidence pipeline, owners, training.
WK 10–11
Internal audit
Dry run, finding closure, corrective actions, management review.
WK 12
Stage 1 & 2
Presence at the certification body, finding management, closure.
Frequently asked
The questions we hear before taking on the first project.
How long until we get the ISO 27001 certificate?
Typically 4–5 months from kickoff to Stage 2 for a mid-sized organisation. The 12 weeks cover preparation; the time to the audit depends on the certification body's availability.
Do we need to change tools or buy technology for ISO 27001?
Rarely. In most Greek SMEs the technical measures already exist — what's missing is documentation and mapping to controls. If something is required, we say so explicitly with a cost estimate.
Which certification body do you work with?
We have no exclusive relationship. We work with the major accredited bodies and help you choose based on scope, language and availability — not on commission.
What happens after ISO 27001 certification?
The certificate is valid for 3 years with annual surveillance audits. Most systems fail in the second year — not the first. We handle maintenance: reviews, updates, surveillance preparation.
How much does ISO 27001 certification cost?
It depends on scope, number of sites, and maturity level. A price range emerges after the free gap analysis — not before. We don't quote without seeing what's actually there.
Related services
These usually combine with an ISO 27001 project, because they share evidence and technical depth.
08 · vCISO
CISO as a service
For the continuity after certification — reviews, board reporting, incident management.
05 · PentestPenetration testing
Technical verification that satisfies A.8.8 and is asked for by clients.
07 · CloudCloud security
M365, AWS, Azure — the settings usually missing from A.8.
Get started
Free gap analysis in two weeks.
A prioritised gap register, a costed 12-week roadmap, and an executive summary for the board. No commitment — you can hand it to another consultant if you prefer.
No commitment
Confidential
Greek or English