By Akash Sengar · · 5 min read
The path at a glance
ISO/IEC 27001:2022 sets requirements for an information security management system (ISMS). Certification means an independent certification body has audited your ISMS against those requirements and issued a certificate. The work falls into two parts: building and running the ISMS, then being audited.
If you hold a certificate to the 2013 edition, note that the transition period to the 2022 edition has ended. New certification is to the 2022 edition.
1. Scope
Clause 4 asks you to understand your organisation, the interested parties and their requirements, and then define the scope of the ISMS. The scope states which parts of the business, locations, systems and services are covered, and the interfaces with what is outside it.
- Start from what clients ask about. If they care about the service you deliver to them, scope that service and the people, systems and suppliers behind it.
- Avoid scoping so narrowly that the certificate does not answer client questionnaires, or so broadly that the first audit cycle is unmanageable.
- Write the scope statement in one or two sentences. It will appear on the certificate.
2. Gap assessment
A gap assessment compares what you do today with clauses 4 to 10 and the 93 controls in Annex A. It produces a list of gaps, owners and a plan. Do it honestly: a gap you hide now becomes a nonconformity at Stage 2.
Typical gaps in a first assessment include missing documented information (policies, the risk methodology, records), no formal internal audit, informal access reviews, supplier security that is not written into contracts, and incident handling that exists in practice but is not recorded.
3. Risk assessment and Statement of Applicability
Clause 6.1.2 requires a defined information security risk assessment process that produces consistent, valid and comparable results. You identify risks to the confidentiality, integrity and availability of information in scope, name risk owners, and analyse and evaluate each risk against criteria you set.
Clause 6.1.3 covers risk treatment. You choose treatment options, determine the controls needed and compare them with Annex A to check nothing necessary has been missed. The result is the Statement of Applicability (SoA): for each Annex A control, whether it is included, the justification for including it, whether it is implemented, and the justification for any exclusion. You also produce a risk treatment plan, which risk owners approve, along with the residual risks.
Keep the method simple enough that people outside the security team can follow it. Auditors look for consistency more than sophistication.
4. Implement the controls
Annex A of the 2022 edition groups 93 controls into four themes: organisational (37), people (8), physical (14) and technological (34). Implement the controls your SoA includes, and keep evidence that they operate. Evidence is the thing most first-time projects underestimate.
- Policies approved by management and communicated to staff.
- Records that controls run: access reviews, backups tested, training completed, vulnerabilities tracked to closure, supplier assessments done.
- Defined objectives for information security and a way of measuring them (clause 6.2 and 9.1).
Let the ISMS run for long enough to produce records before the audit. A certification body needs to see that it operates, not just that documents exist.
5. Internal audit
Clause 9.2 requires internal audits at planned intervals to check the ISMS conforms to your own requirements and to the standard, and is effectively implemented and maintained. Plan an audit programme, choose auditors who are objective and impartial (they should not audit their own work), and report results to management.
Before certification, audit the whole ISMS at least once. Record findings, then correct them under clause 10.2 (nonconformity and corrective action), keeping evidence of the root cause and the fix.
6. Management review
Clause 9.3 requires top management to review the ISMS at planned intervals. The standard lists the inputs: the status of actions from previous reviews, changes in issues and interested parties, feedback on performance (nonconformities, monitoring results, audit results, objectives), feedback from interested parties, risk assessment results and the status of the risk treatment plan, and opportunities for improvement. Minute the decisions. This is one of the first records an auditor asks for.
7. Stage 1 and Stage 2 audits
Choose a certification body accredited for ISO/IEC 27001 by a recognised accreditation body. Accredited certification bodies work to ISO/IEC 17021-1, which sets requirements for bodies auditing management systems, together with sector-specific requirements for information security. Ask for their accreditation details and check them with the accreditation body.
Stage 1
Stage 1 reviews your documented information and your readiness: scope, risk assessment, SoA, policies, internal audit and management review. It identifies areas of concern that could be nonconformities at Stage 2, and plans the Stage 2 audit.
Stage 2
Stage 2 evaluates whether the ISMS is implemented and effective. Auditors interview people, sample records and observe controls. Findings are graded as major or minor nonconformities or as observations. Nonconformities need corrective action, accepted by the certification body, before the certificate is issued.
8. Surveillance and recertification
An accredited certificate runs for a three-year cycle. Surveillance audits take place at least once a year in the years between, and a recertification audit before the certificate expires. Surveillance audits sample parts of the ISMS, so the internal audit programme, management reviews and records need to continue all year, not just before the auditor arrives.
The documents auditors expect
ISO/IEC 27001 asks for "documented information" rather than a fixed list of manuals. In practice the auditor will ask to see, at minimum:
- The ISMS scope, with interfaces and dependencies
- The information security policy and information security objectives
- The risk assessment and risk treatment processes, and their results
- The Statement of Applicability
- Evidence of competence for people doing work that affects security
- Operational planning and control records
- Results of monitoring and measurement
- The internal audit programme and audit results
- Management review results
- Nonconformities and the corrective actions taken
Annex A controls add their own evidence: access reviews, supplier assessments, backup tests, training records, incident logs. Keep documents short and true to how you work. An auditor will compare what a policy says with what staff actually do, and a long policy nobody follows creates nonconformities.
Use one controlled place for documents, with owners, version numbers and review dates. A shared folder with clear naming works for small organisations; a GRC tool helps when the scope grows.
What drives the timeline
There is no fixed duration. The main factors are:
- How much of the ISMS already exists, as shown by the gap assessment
- The size and complexity of the scope: locations, people, systems and suppliers
- How quickly management makes decisions and approves policies
- Time for the ISMS to operate and produce records before the audit
- Internal resource: a named owner with time set aside makes the biggest difference
- The certification body's availability for Stage 1 and Stage 2
Plan the project from the gap assessment, not from a target date. If a client contract sets a deadline, tell the client what stage you will have reached by then.
