Guidance · Situation
We have decided to get ISO 27001 certified
The decisions to take in order, then the documents to work from, up to the first certification audit.
Why this moment is hard
The core of the standard is short, so it is easy to start in the wrong place. A scope drawn too wide multiplies the work, and one drawn too narrow earns a certificate nobody values. A risk method nobody follows leaves the controls chosen from the Annex A list instead of from risk. Documents get written to please an auditor, when the auditor wants records of a system that has been running. And without an internal audit and a management review done in good time, a first audit can end in a major nonconformity and a second visit.
16 Guidance questions6 pack documents1 toolAbout 7 h 35 min of reading in all
This is a reading path, not a checklist. Nothing is ticked off or saved, and you can start at any step.
First, the decisions
Guidance · Regulation, audit and certification
When will certification realistically happen, and what will it cost?Why here A first view of the date and cost now, from indicative figures. Work it out again once the scope is approved and you have a readiness score.
In the LibraryISO 27001 in the Library
Guidance · Regulation, audit and certification
How do we set the scope of our ISMS?Why here Decide what the system covers first: every risk, control and exclusion depends on it. Draft it now.
In the LibraryClause 4.3: Determining the scope of the information security management systemClause 4.1: Understanding the organization and its context
Guidance · Regulation, audit and certification
How do we decide which issues and interested parties' requirements our ISMS has to address?Why here List the issues and the parties' requirements the system must address. Decide if climate change is relevant and record it.
In the LibraryClause 4.1: Understanding the organization and its contextClause 4.2: Understanding the needs and expectations of interested parties
Guidance · Regulation, audit and certification
How do we get the top management commitment and resources an ISO 27001 project needs?Why here With the draft scope, take one paper to top management: scope, policy direction, people, time and money.
In the LibraryClause 5.1: Leadership and commitment
Guidance · Regulation, audit and certification
Do we need a separate register of risks and opportunities for our ISMS itself, apart from our risk register?Why here List what could stop the system working, and what could improve it. Treat that as a separate job from risks to information.
In the LibraryClause 6.1.1: General
Guidance · Regulation, audit and certification
How do we set up an ISO 27001 risk assessment and treatment method that stands up to an audit?Why here Fix the criteria and name risk owners before anyone scores a risk. Choose controls from the risks, then check against Annex A.
In the LibraryClause 6.1.2: Information security risk assessmentClause 6.1.3: Information security risk treatment
Guidance · Regulation, audit and certification
How do we justify excluding an Annex A control?Why here The Statement of Applicability follows the risk assessment. Learn what makes an exclusion defensible first.
In the LibraryClause 6.1.3: Information security risk treatment
Guidance · Regulation, audit and certification
How do we write an information security policy and objectives that stand up to an ISO 27001 audit?Why here The standard requires a policy and objectives, and the auditor will ask for both at Stage 2. Topic policies wait for your chosen controls.
In the LibraryClause 5.2: PolicyClause 6.2: Information security objectives and planning to achieve them
Guidance · Regulation, audit and certification
How do we decide what to monitor and measure in our ISMS, and who evaluates it?Why here Choose the few figures that show the system works, and who reads them. The review reads trends; auditors read the records.
In the LibraryClause 9.1: Monitoring, measurement, analysis and evaluation
Guidance · Regulation, audit and certification
How do we choose a certification body and agree our audit dates?Why here Choose an accredited certification body and book the dates. Set Stage 2 only when the operating period fits.
Guidance · Regulation, audit and certification
How do we show that the people running our ISMS are competent and that our staff are aware?Why here Competence and awareness need records too. Start as controls go in, and keep the evidence.
In the LibraryClause 7.2: CompetenceClause 7.3: Awareness
Guidance · Regulation, audit and certification
How do we decide what documented information our ISMS needs and keep it under control?Why here Decide what to write down beyond the required list, and keep it approved and in date. Auditors sample both.
In the LibraryClause 7.5.3: Control of documented informationClause 7.5.2: Creating and updating
Guidance · Regulation, audit and certification
How do we run an internal audit when we are small?Why here Run it once controls have left records. In a small team the hard part is finding someone independent.
In the LibraryClause 9.2.2: Internal audit programme
Guidance · Regulation, audit and certification
If an internal audit, an incident or a complaint shows a nonconformity, then how do we correct it and stop it coming back?Why here Give each finding a root cause, a dated action and a check that it worked, whatever its source.
In the LibraryClause 10.2: Nonconformity and corrective action
Guidance · Regulation, audit and certification
How do we run a management review that actually decides things?Why here Hold the review after the audit, because its results are an input. Held earlier, it has to be held again.
In the LibraryClause 9.3.2: Management review inputsClause 9.3.3: Management review results
Guidance · Regulation, audit and certification
When are we ready for the Stage 1 audit?Why here The pack's own test before you confirm Stage 1: documents, scope, Statement of Applicability, audit, review and every blocking item (a requirement an audit cannot pass without) in place. Ask your certification body what it needs; Stage 2 has its own check later.
Then, the documents
Framework / Methodology · P08-A02
ISO 27001 Implementation Methodology & Project PlanWhy here The plan to work to: six phases from scoping to the audits, each ending in a check, and ten rules that keep the order.
Assessment / Questionnaire · P08-A06
Certification Readiness Self-AssessmentWhy here Score what an auditor could see today to forecast the Stage 2 date. Repeat it monthly once implementation starts.
Register / Tracker · P08-A07
ISMS Gap & Remediation TrackerWhy here Turn each gap into a row with an owner and a date, blockers first, to keep the implementation in order.
Checklist · P08-A05
Mandatory ISMS Documentation ChecklistWhy here The 16 documents and records the standard requires and the 28 auditors commonly expect, and what each must show.
In the LibraryClause 7.5.3: Control of documented information
Template / Form · P08-A04
Statement of Applicability TemplateWhy here All 93 Annex A controls, each included or excluded with a reason. Fill it in from the risk treatment plan, not the Annex A list.
In the LibraryClause 6.1.3: Information security risk treatment
Meeting / Communications Pack · P08-A09
Management Review Meeting PackWhy here Agenda, papers and minutes for the review. The certification body will usually ask for the minutes.
Finally, a tool
Tool
Where are our gaps? — ISO/IEC 27001 2022Why here A self-check of about 70 minutes against the standard's requirements, to see what you still cannot evidence. Repeat it before Stage 2.
If your start looks different
- If an audit is within weeksThe auditor arrives in six weeks
- If DORA or NIS2 also apply and you want one control setHow do we find the minimum control set when DORA, NIS2 and ISO 27001 all apply to us?
- If you are halfway through and behind plan, before you move the audit dateIf we are halfway through implementation and behind plan, then do we move the audit date?
- If you are weighing a consultant against doing the work in-houseHow do we decide whether our own people, a consultant or both do the ISO 27001 implementation work?In the LibraryClause 7.1: Resources
- When you start putting controls in place: what implementing each Annex A control involvesAnnex A Control Implementation Library
- When you build your list of legal and contractual requirementsHow do we build a register of legal, regulatory and contractual requirements that stands up to an ISO 27001 audit?In the LibraryControl A.5.31: Legal, statutory, regulatory and contractual requirements
- If your systems run on cloud services: what a provider's certificate does and does not coverHow do we use our cloud providers' certificates and reports in our ISMS scope and Statement of Applicability?In the LibraryControl A.5.23: Information security for use of cloud services
- When controls start going in: keeping an asset inventory an auditor can traceHow do we keep an asset inventory that stands up to an ISO 27001 audit?In the LibraryControl A.5.9: Inventory of information and other associated assets
- When controls start going in: what to log, how long to keep it and who reviews itHow do we decide what to log and monitor, and who reviews it, for an ISO 27001 audit?In the LibraryControl A.8.15: LoggingControl A.8.16: Monitoring activities
- When controls start going in: which changes need approval, and how to handle emergency changesHow do we decide which changes to systems need approval, and handle emergency changes, under ISO 27001?In the LibraryControl A.8.32: Change management
- If you build or configure software yourselves: how much secure development an auditor expectsIf we build or configure software ourselves, how much secure development does ISO 27001 expect?In the LibraryControl A.8.25: Secure development life cycle
- When controls start going in: encryption rules, keys and certificatesHow do we decide where we need encryption and how we manage keys and certificates under ISO 27001?In the LibraryControl A.8.24: Use of cryptography
- If staff work remotely or on their own devices: the rules to set and enforceHow do we decide the rules for remote working and personal devices under ISO 27001?In the LibraryControl A.6.7: Remote workingControl A.8.1: User endpoint devices
- If you work from a shared or rented building: the physical controls you still needIf we work from a shared building or a rented office, which physical controls do we still need under ISO 27001?In the LibraryControl A.7.1: Physical security perimetersControl A.7.2: Physical entry
- When controls start going in: stopping information leaving, and the rules for sending itHow do we decide how to prevent data leakage and set the rules for sending information out, under ISO 27001?In the LibraryControl A.8.12: Data leakage preventionControl A.5.14: Information transfer
- When you plan the internal audit: the programme and procedure, including who may audit whatISMS Internal Audit Programme & Procedure
- If an audit is close: preparing your people for auditor interviewsHow do we prepare our people for auditor interviews?
- If an audit is close: what to do if the auditor raises a major nonconformityIf the auditor raises a major nonconformity, then what?
- If Stage 1 is booked: what the certification body asks for, samples and grades at each stageStage 1 and Stage 2 Audit Preparation Guide
- If Stage 1 has raised concerns: how to get ready for Stage 2If Stage 1 has raised concerns, then how do we get ready for Stage 2?
- Once you are certified: keeping the certificate through the surveillance audits and recertificationHow do we keep our ISO 27001 certificate after the certification audit?
Reading times are estimates: the words on each question's flow or document's preview at 220 words a minute, rounded up to the next five minutes. A tool shows its own time.