Prepare for your ISO 27001 audit. An accredited body certifies; we do the preparation.
A gap assessment and audit preparation for ISO/IEC 27001:2022, with the cryptography, PKI, monitoring and supplier controls handled by engineers who run them every day. SkyQon is not a certification body.
ISO/IEC 27001 is a certificate for a management system: scope, risk assessment, policies, people, premises and processes, audited by an accredited certification body over a Stage 1 and Stage 2 visit. Readiness is everything before that body walks in. We find the gaps, help you scope and document, run the internal audit and the management-review rehearsal, and introduce you to a certification body. In Belgium, the same work is mapped to the CyFun framework, so one effort serves both the audit and your NIS2 obligations.
What we do
Six pieces of work. You choose how many we do.
Gap assessment
Where you stand against the 2022 edition's clauses and 93 Annex A controls, in a prioritised list: what to fix before the audit, what to fix after, and what is already fine. Fixed scope, two to four weeks.
Scope, risk assessment and Statement of Applicability
The three documents an auditor reads first. We help you draw a scope you can defend, run a risk assessment that leads to the controls you chose, and write the Statement of Applicability so every exclusion has a reason.
Cryptography, PKI and the technical controls
Use of cryptography (A.8.24), technical vulnerabilities (A.8.8), monitoring (A.8.16), threat intelligence (A.5.7), supplier monitoring (A.5.22). We design and run certificate authorities ourselves, so these controls are written by people who operate them, with measured records rather than policy statements.
Mapped to CyFun for Belgian NIS2
Belgium's NIS2 Act of 26 April 2024 lists an ISO 27001 certificate, scoped to the whole organisation with the Statement of Applicability mapped to your CyFun level, as one way an essential entity shows conformity; certification is due by 18 April 2027 (Cyber Security Coalition summary, checked 22 October 2026). We produce that mapping alongside the ISO work, so one programme serves both.
Internal audit and management review
Both are required before certification and both are where first-time candidates stumble. We run the internal audit as an independent party, rehearse the management review with your leadership, and leave you a record the auditor can read.
Evidence from continuous measurement
Auditors want operational records over months, not a snapshot. The Digital Trust Center measures your public endpoints on a stated interval and produces signed reports an auditor can re-verify: certificates and TLS in use, findings with detection and resolution dates, monitoring continuity. Your certification body decides whether that is sufficient for a control. We present it as evidence and nothing more.
What we don't do
Three limits, stated before you call.
We do not issue certificates
Only an accredited certification body can. A body that advises you cannot also audit you, which is exactly why independent preparation exists. We introduce you to accredited bodies active in Belgium and the Netherlands and hand over cleanly; the audit fee is theirs, not ours.
Regional subsidies may apply
Flanders, Wallonia and Luxembourg run schemes that fund part of a cybersecurity assessment or improvement plan, through providers they recognise and under conditions that change. Ask us before you budget; we will tell you which scheme applies to you and whether we qualify as a provider for it.
On ISO/IEC 42001
The AI management system standard is not a harmonised standard under the EU AI Act, so it gives no presumption of conformity. 271 accredited certificates existed worldwide at the end of 2025 (ISO Survey 2025). If a buyer asks you for it, we refer you to an accredited body; we do not sell a 42001 programme.
Start with the gap assessment
Fixed scope, a prioritised findings list, and an answer to the question every first-time candidate asks: how far are we from certification? From there you decide how much of the rest you want us for.