Fast facts
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System. What is certified is the management system — the discipline of identifying risk, selecting controls, operating them and improving — not any particular technical configuration.
The 2022 revision restructured Annex A into 93 controls across four themes: organisational, people, physical and technological. Eleven controls are new, addressing threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
Certification runs on a three-year cycle: an initial Stage 1 documentation review and Stage 2 implementation audit, followed by annual surveillance audits and a full recertification in year three. The standard is deliberately scalable — a 40-person SaaS company and a 40,000-person bank can both hold it, with very different implementations.
Who it applies to
The commercial and regulatory argument, rather than a restatement of the text. If none of these apply to you, the honest answer is that this framework is not your priority.
European, Indian and Middle Eastern enterprise buyers and public tenders ask for ISO 27001 by name far more often than any alternative. Not holding it removes you from shortlists before a conversation happens.
What is audited is the management system — the repeatable practice of identifying risk, selecting controls, operating them and improving. That is why it holds value across a 40-person SaaS company and a 40,000-person bank alike.
The management-system machinery — risk assessment, internal audit, management review, corrective action — is reused by ISO 27701, ISO 42001 and, substantially, SOC 2. Sequencing ISO 27001 first is the single highest-leverage certification decision.
Scope is the decision that sets the cost, and it is usually made in week one when the team knows least. Both columns matter equally.
In scope
Out of scope
How the boundary is decided: The scope statement appears on the certificate, so buyers read it. Scope to the product and the teams that build and run it, plus the shared services they depend on — then read it as a sceptical procurement analyst would. A scope that excludes the service being purchased is worse than no certificate.
Stated as the duty rather than the clause number, because clause numbers do not tell an engineering team what to build.
Determine internal and external issues, interested parties and their requirements, and define a defensible ISMS scope covering the products, locations and systems in question.
Demonstrable top-management commitment, an approved information security policy, and clearly assigned roles, responsibilities and authorities.
A repeatable risk assessment methodology, an assessed risk register, a documented risk treatment plan and a Statement of Applicability justifying each Annex A control included or excluded.
Resources, competence, awareness, communication and documented information, plus operational planning and control of the processes that manage security risk.
Monitoring and measurement against defined objectives, an internal audit programme conforming to ISO 19011, and management review at planned intervals.
Nonconformity handling, root cause analysis, corrective action and demonstrable improvement of the management system over time.
The areas your teams will actually be building in, with control counts where the framework defines them.
Policies, roles, segregation of duties, threat intelligence, cloud service security, supplier relationships, incident management and continuity.
Screening, terms of employment, awareness and training, disciplinary process, responsibilities after termination and remote working.
Perimeters, entry control, securing offices, monitoring, equipment siting, secure disposal and clear desk requirements.
Endpoint security, privileged access, cryptography, secure development, logging, monitoring, data masking, DLP, backup and web filtering.
Phases overlap deliberately. Design begins before assessment closes, so the programme does not stall waiting for a document to be signed off.
Weeks 1–2
Agree the boundary, the applicable framework version and the certification body. Build the master plan with dates, owners and dependencies.
Weeks 2–5
Clause-by-clause and Annex A control assessment, producing a remediation backlog sized in effort and sequenced by dependency.
Weeks 5–10
Context, leadership, planning, support and operation documented as working artefacts. Risk assessment, treatment plan and Statement of Applicability completed.
Weeks 8–16
Close control gaps with engineering teams and operate the controls long enough to generate genuine evidence rather than retrospective screenshots.
Weeks 16–20
Internal audit to ISO 19011, management review with recorded decisions, then Stage 1 and Stage 2 support with nonconformity closure.
Named artefacts, listed in the statement of work. If something is not on this list, we will tell you before you sign rather than after.
First certification typically takes 14–20 weeks for a mid-sized organisation. Organisations transitioning from ISO 27001:2013 must complete the move to the 2022 revision at their next recertification.
Scoping and gap assessment
Weeks 1–5
Boundary fixed and the true size of the work established. Rushing this phase is the most common cause of overrun.
Management system build
Weeks 5–10
Documentation, risk assessment and SoA. Largely parallel with early control remediation.
Control implementation
Weeks 8–16
The variable phase. Organisations with mature engineering practice move fastest here.
Audit cycle
Weeks 16–20
Internal audit, management review, then Stage 1 and Stage 2. Certification typically issued 2–4 weeks after Stage 2.
The sequence we follow, and the parts where first-time implementations most often lose time.
Define a scope that is credible to auditors and buyers without being unnecessarily large.
Run a clause-level and Annex A gap assessment with effort-sized remediation backlog.
Build the ISMS documentation set as working documents rather than shelf-ware.
Implement controls with your engineering teams, prioritising those that reduce real risk.
Operate the system long enough to generate genuine evidence before the Stage 2 audit.
Run an internal audit deliberately harder than the certification audit, then close findings.
Certification without the eighteen-month scramble.
Readiness, implementation and audit support for ISO 27001, ISO 27701, ISO 42001, SOC 2 and PCI DSS — run as a project with dates, owners and a definition of done.
Explore capabilityDefensible security, built around how your business actually loses money.
Threat-led security strategy, architecture and control design that prioritises the handful of scenarios that would genuinely hurt you — not a generic checklist of 300 controls.
Explore capabilityOne operating model for privacy, security, risk and AI accountability.
We design the committees, policies, decision rights and reporting lines that let trust obligations be managed as one programme instead of four competing ones.
Explore capabilityThe choice is decided by who is buying, not by which framework is better. A practical decision guide, plus why sequencing ISO first makes the SOC 2 cheaper and the reverse is not true.
The 2022 revision added eleven controls. Four of them are where most first certifications lose weeks. A clause-level look at what auditors actually ask for.
Access review is one control that answers ISO 27001, SOC 2, DPDPA, PCI DSS and NIST CSF. Here is how to build the library so a single implementation serves all of them.
Sequencing matters. Running these together off one control library costs meaningfully less than running them apart.
Including the questions where the honest answer is less convenient than the marketing one.
Ask a practitioner directly. First responses come from the person who would run your engagement, within one business day.
Ask a question
