Advice/opinion appreciated.
Ultimately, our company would like to achieve ISO27001:2013 certification, but that is some way off. In the interim, we want to be able to get to the point whereby we can "attest" to compliance (similar to the PCI DSS AOC). Is there such a mechanism for ISO27001:2013? Is it possible to get a 3rd party auditor to confirm "progress towards compliance" or will a 3rd party only ever certify based on an audit establishing full compliance?
Our company is effectively split into 2 business units within the same corporate structure. We anticipate that scope for compliance would exist almost entirely within one of those units. If we presented that scope to a 3rd party auditor, but the auditor felt that the scope wasn't wide enough to fully address information security risk within the company, would the auditor be likely to agree to certification?
In other words, will a 3rd party auditor only ever certify at corporate level, or are they amenable to certify particular functions within a corporate structure?