A customer request may be the reason to begin ISO 27001 work, but the program should also help the business manage its information security. Start with the scope, the important risks, and the people responsible for the controls.
Begin with the work, then the documents
Review access protection, backups, suppliers, and incident handling. Find recent evidence of what already works and identify the gaps. A focused scope and a realistic plan are more useful than a large set of policies copied before the business is understood.
Connect security and privacy
Customer questions may also cover personal information, processing records, rights requests, and website notices. Coordinate these with the security work and the relevant legal requirements. ISO 27001 supports an information security management system; it does not replace the organization’s privacy obligations.