Is ISO 27001:2013 still valid?

No. The IAF transition period ended on 31 October 2025. Certificates referencing ISO/IEC 27001:2013 are no longer valid, and organizations will be assessed against the 2022 version at their next audit.

What changed in ISO 27001:2022?

Annex A was restructured from 114 controls across 14 domains into 93 controls across four themes: organizational, people, physical and technological. Eleven controls are entirely new, including threat intelligence, cloud services security and data leakage prevention.

What is the ISO 27001 Statement of Applicability?

The document listing every Annex A control, whether the organization applies it, and the justification for inclusion or exclusion. It is central to certification and is typically the first document an auditor reviews.

Do organizations with R2v3 also need ISO 27001?

Not necessarily. R2v3 Core 7 and Appendix B cover data security for processed devices, while ISO 27001 covers information security across the whole organization. ITAD providers whose customers ask about corporate information security often hold both.

Home
/
Who we work with

Who we work with

Do you work with companies like mine?

Electronics recyclers, machine shops, manufacturers and service organizations. Here is the honest answer, including when we are not the right call.

50+R2 certifications
100+ISO certifications
12–300Typical client size
5Ways people arrive

Book a free readiness call See case studies

Most people arriving here are asking one thing: do you work with companies like mine? So rather than a list of industries, here is the honest version, including the situations where we are not the right call.

By sector

Where most of our work sits

Electronics recyclers and ITAD
R2v3, RIOS and e-Stewards. Facilities handling data-bearing devices, downstream vendor chains and Focus Materials. More than 50 taken through R2 certification, and the lane where we know the audit best.
Machine shops, fabricators and job shops
Usually ISO 9001, usually because a customer or a tender asked. Often companies doing the work well already and unable to evidence it.
Manufacturers and suppliers
Quality, environmental, health & safety and energy management, frequently integrated. Requirements often flow down from a larger customer.
Service organizations and technology
ISO 9001 and increasingly ISO 27001, where a client contract or a procurement questionnaire made certification a condition of doing business.

Size matters less than you would think

Our clients run from a dozen people to a few hundred, across single sites and multi-site operations. What actually changes the work is not headcount, it is how much system already exists and how much internal capacity you have.

A well-run 25-person shop with someone who owns quality is often a shorter project than a 200-person company where nobody does.

What drives the cost

Smallest engagements

A single internal audit for a company that built its own system. Sometimes a few days of work.

Largest

Multi-site, multi-standard implementations running most of a year, with ongoing maintenance afterwards.

By situation

Five ways people usually arrive

The trigger shapes the work more than the industry does.

A customer made it a condition. The most common reason by some distance. The first job is establishing exactly which standard they named, because "are you ISO certified" can mean several different things.

You are losing tenders. Certification is a gate on bids you would otherwise win. Here the deadline is usually set by a bid calendar rather than by you.

Your quality manager left. The system exists but the reasoning walked out of the door, and a surveillance audit is coming. A good share of our work.

A standard was revised. ISO 14001:2026 is published with a deadline attached, and ISO 9001:2026 is close behind. Transitions are their own kind of project.

You collected findings. An audit went badly and corrective actions need closing properly, with root cause and effectiveness review rather than a quick patch.

When we are not the right call

Being straight about this saves everyone time, and it is the same answer you would get on the phone.

You need a certificate, not a systemAnyone promising certification without the underlying work is selling something that will fail its first surveillance audit. We are not that.
You want the cheapest optionWe are not it, and we publish our range so you can find that out before spending time on a call.
You need IATF 16949, AS9100 or another scheme-specific standardThose carry their own rules and auditor requirements. We would point you elsewhere.
You have the capacity in-houseIf you have an experienced quality manager and time, you may not need a consultant. That advice is free.
You want us to be your certification bodyNo consultant can be. That separation is what makes a certificate mean anything.

In their words

What clients say

Tony at Wilkshire Consulting has been an unbelievable asset helping us to achieve and maintain ISO certification for our machine shop … I have recommended Tony to other small shops like ours many times and will continue to do so. Sean Motyl — Google review

Read all reviews

Not sure you fit any of these?

Describe the situation on the call. If we are not right for it we will say so, and usually point you at who is.

Next step

Recognise your situation?

Most engagements start with someone describing one of the five above. Thirty minutes, free, and you leave better informed either way.

Book a free readiness call See case studies