Services
Independent audits and assessments
We certify information security management systems to ISO/IEC 27001 and assess security controls against NIST SP 800-53 and NIST SP 800-171. Every engagement is planned around your calendar and priced before you commit.
ISO/IEC 27001
Certification audits for every point in the cycle
Each service is a defined step in the three-year ISO 27001 certification cycle, ending in a certificate your customers can verify.
ISO 27001 certification
Initial certification of your ISMS against ISO/IEC 27001:2022: Stage 1, Stage 2, and an independent certification decision.
Learn moreISO 27001 surveillance audits
Annual audits in years one and two of the cycle that confirm the ISMS is maintained and your certificate stays valid.
Learn moreISO 27001 recertification
A full audit before your certificate expires that starts a new three-year cycle with no gap in certification.
Learn moreIntegrated audits: ISO 27701 and ISO 22301
One audit program covering ISO 27001 alongside ISO/IEC 27701 privacy or ISO 22301 business continuity.
Learn moreNIST SP 800-53, the Risk Management Framework, and NIST SP 800-171
Independent control assessments
Assessments of NIST SP 800-53 controls for the assess and monitor steps of the Risk Management Framework, and of the NIST SP 800-171 requirements for protecting controlled unclassified information.
NIST SP 800-53 control assessments
Independent assessment of your NIST SP 800-53 controls for the Assess step of the Risk Management Framework, reported in a security assessment report.
Learn moreRMF continuous monitoring assessments
Scheduled assessments of the controls your continuous monitoring strategy calls for each period, so an authorization stays current.
Learn moreNIST SP 800-171 assessments
Independent assessment of the NIST SP 800-171 security requirements for contractors and suppliers that handle controlled unclassified information.
Learn moreWhere each ISO 27001 service fits
The certification cycle at a glance
Your consultancy prepares and attests the package before it reaches us. Initial certification takes it from Stage 1 to a certificate. Surveillance keeps the certificate valid. Recertification starts the next cycle.
Before
ConsultancyBuild and attest
Your consultancy helps you build the ISMS and attests that the package is ready, then submits it to us.
Month 0
Stage 1Readiness review
We review the package: scope, risk assessment, Statement of Applicability, and evidence of internal audit and management review, and confirm you are ready for Stage 2.
Month 1 to 2
Stage 2Certification audit
On-site or remote audit of how the ISMS actually operates: interviews, records, sampled controls, and evidence.
Month 2 to 3
DecisionCertificate issued
An independent reviewer checks the audit file. Once any nonconformities are closed, your certificate is issued and can be verified with us directly.
Month 12
Year 1Surveillance audit
A shorter audit confirming the ISMS is maintained, internal audits and management reviews have happened, and corrective actions are working.
Month 24
Year 2Surveillance audit
Second annual check, usually covering the parts of the ISMS not sampled in year one.
Month 36
Year 3Recertification
A full audit before the certificate expires. Pass it and a new three-year cycle begins with no gap in certification.
What we do not do
No consulting. No implementation.
Sanvada does not write policies or system security plans, run risk assessments, act as an internal auditor, or implement controls.
That work is done by your consultants or your own team. Most ISO 27001 packages we certify are built and attested by a consultancy; we accept packages prepared by any consultancy or in-house.
Ready to scope your audit?
Tell us about your organization, your ISMS scope, and your target date. We reply with a fixed-fee quote and available audit dates within two business days.