A step-by-step walkthrough of the ISO 27001 certification process, including ISMS implementation, risk assessment, and audit preparation.
ISO 27001 is the international standard for information security management. It is recognised globally, required by an increasing number of enterprise procurement processes, and provides a structured framework for managing information security risk. This guide walks through what certification involves, how long it takes, and what it costs, honestly.
ISO 27001 is published by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC). The current version is ISO/IEC 27001:2022, which introduced significant updates to Annex A controls compared to the 2013 version.
The standard requires organisations to establish, implement, maintain, and continually improve an Information Security Management System (ISMS), a systematic approach to managing sensitive company information so that it remains secure.
Unlike SOC 2, ISO 27001 is a certifiable standard. Certification is issued by an accredited certification body following a successful audit, and is valid for three years with annual surveillance audits.
The ISMS is the core of ISO 27001. It is not a piece of software, it is a management system: a set of policies, processes, procedures, and controls that together manage information security risk across your organisation.
The ISMS must cover the scope of your certification, which parts of the organisation, which information assets, and which locations are included. Scoping is a critical decision that affects the complexity and cost of certification.
Key components of the ISMS include an information security policy, a risk assessment and treatment process, a Statement of Applicability (SoA) documenting which Annex A controls apply and why, and an internal audit programme.
Risk assessment is the foundation of ISO 27001. You must identify information assets, assess the threats and vulnerabilities that could affect them, evaluate the likelihood and impact of each risk, and decide how to treat each risk, accept, mitigate, transfer, or avoid.
The risk treatment plan documents the controls you will implement to address identified risks. These controls are drawn from Annex A of the standard, which in the 2022 version contains 93 controls across four themes: Organisational, People, Physical, and Technological.
The Statement of Applicability (SoA) is a key document that lists all Annex A controls, states whether each is applicable, and provides justification for inclusions and exclusions. Auditors scrutinise this document carefully.
For a company of 20 to 100 people with no existing security programme, ISO 27001 certification typically takes 9 to 18 months from start to certification. Companies with existing security controls and documentation can achieve certification in 6 to 12 months.
Costs vary significantly by company size, scope, and approach. Certification body fees typically range from £5,000 to £20,000 for the initial audit. Consultant or managed service fees, GRC platform costs, and internal resource time add to this. A realistic total budget for a 50-person company is £25,000 to £60,000 for initial certification.
Annual surveillance audits cost less than the initial certification, typically 30 to 50% of the initial audit fee. Recertification audits occur every three years.
Understanding internal and external issues, interested parties, and the scope of the ISMS.
Top management commitment, information security policy, and assignment of roles and responsibilities.
Systematic identification, analysis, and evaluation of information security risks.
Selection and implementation of controls to address identified risks, documented in the Statement of Applicability.
93 controls across Organisational, People, Physical, and Technological themes, applied as relevant to your risk treatment plan.
Regular internal audits to verify the ISMS operates as intended and identify opportunities for improvement.
Assess your current security posture against ISO 27001 requirements, identifying gaps and producing a prioritised remediation roadmap.
Define the scope, develop the information security policy, and establish the risk assessment methodology.
Identify information assets, assess threats and vulnerabilities, and produce the risk treatment plan and Statement of Applicability.
Implement the controls documented in your risk treatment plan, including policies, procedures, and technical safeguards.
Conduct an internal audit to verify the ISMS is operating effectively before the certification audit.
Stage 1 (documentation review) followed by Stage 2 (on-site or remote audit). Successful completion results in ISO 27001 certification.
Netru methodology