ISO 27001 Implementation & Certification Readiness — Guide
- Version 1.1
- Updated
- Next review
- 9 documents
- Word, Excel
ISO 27001 Implementation & Certification Readiness
A customer asks for a certificate, so someone buys a toolkit, writes forty policies and books an audit. At Stage 1 the auditor finds a scope nobody can explain, controls copied from Annex A instead of chosen from risk, and no records. This pack sets realistic expectations for a first certification: what it costs, how long it takes, and which decisions determine whether it goes well.
Is this for you?
This pack is for you if:
- a customer, tender or board has asked for ISO/IEC 27001 certification;
- you have controls but no management system around them;
- you need a date you can defend, not a sales estimate.
How long it really takes
For 100 to 300 people with some controls in place, the phases take about 38 weeks of work. Allow 9 to 12 months from approval to certificate, once you include waiting for audit dates.
| Phase | Weeks | You’re done when |
|---|---|---|
| 1 Decide and scope | 3 | Management has approved the scope, policy and resources |
| 2 Assess risk | 5 | Risks are assessed and a treatment plan agreed |
| 3 Select and document controls | 6 | The Statement of Applicability, policies and procedures are approved |
| 4 Implement and operate | 12 | Controls are working and producing records |
| 5 Check | 4 | An internal audit and a management review are complete |
| 6 Certify | 8 | Stage 1, fixes and Stage 2 are done |
Phase 4 cannot be compressed. The ISMS must run for at least three months before Stage 2 (IS-05), because the auditor samples records over time: access reviews, incidents, supplier checks, training. More writing does not create a history.
What it costs
Every figure here is an estimate, not a price: confirm each with your own figures and with quotes from accredited certification bodies.
- Internal effort: an ISMS manager at half to full time for the project, plus a few days a month from each control owner. An estimated 150 to 300 person-days in total.
- Certification body fees: set by audit days, which depend mainly on headcount and scope. For this size, an estimated 10 to 15 days across Stage 1 and Stage 2, or an estimated €10,000 to €25,000; surveillance audits in years two and three cost an estimated third of that each.
- Optional: consultancy, a contracted internal auditor or compliance software.
The decisions that decide it
- Scope: name the organisation, locations, services and interfaces covered, and justify every exclusion (IS-02). A vague scope is a common Stage 1 finding.
- Controls from risk: choose controls from your risk assessment, not the Annex A list, and justify each inclusion and exclusion in the Statement of Applicability (IS-03).
- Records, not documents: most required documented information is evidence that something happened. Policies without records fail.
- Audit yourself first: complete a full internal audit and management review before Stage 2 (IS-06), with auditors who are not checking their own work (IS-07).
Start with these three
- ISO 27001 Implementation Methodology & Project Plan — the phases, rules and plan.
- Certification Readiness Self-Assessment — where you stand, requirement by requirement.
- Statement of Applicability Template — the 93 Annex A controls, each with a decision and reason.
Four numbers to report
Report these to top management monthly from Phase 4 (IS-10).
| Number | Target |
|---|---|
| Blocking items operating | All, before the Stage 2 date |
| Requirements operating | Rising monthly |
| Gaps overdue | Zero on the critical path |
| Weeks to certification | On or before the planned date |
You may already have half of it
Other CISO Times packs supply much of this: the policy set, the risk method and register, supplier assessments and access reviews. Once running, their records are evidence.
Everything in the pack
- Word
ISO 27001 Implementation Methodology & Project Plan
Phases, rules and the plan
- Excel
Annex A Control Implementation Library
How to implement each control
- Excel
Statement of Applicability Template
Every control’s decision and reason
- Excel
Mandatory ISMS Documentation Checklist
Required documents and records, by clause
- Excel
Certification Readiness Self-Assessment
Readiness scored per requirement
- Excel
ISMS Gap & Remediation Tracker
Every gap with an owner and date
- Word
ISMS Internal Audit Programme & Procedure
Planning and running internal audits
- Word
Management Review Meeting Pack
Agenda, inputs and decisions
- Word
Stage 1 and Stage 2 Audit Preparation Guide
What auditors ask and sample
No document matches those words.
Adapting it
- Small organisation: fewer people shorten phases 1 to 3, not the three-month operating period.
- Regulated entity: certification supports NIS2 or DORA compliance but does not equal it. Those laws set obligations, such as incident reporting, that a certificate does not prove.
- IT run by providers: check that each provider’s certificate covers the service you buy, and manage them under your supplier controls.
Where it maps
- ISO/IEC 27001:2022 — Clauses 4 to 10 and Annex A.
- NIST CSF 2.0 — GV.OC-01 and GV.OC-03.
What changed
Each change to this pack's documents since it was published, newest first.Changes across all packs
The supporting documents of A.5.5, A.5.26, A.5.31 and A.5.34 now name the two US scenario decks (P10-A13 and P10-A14) and the two US notification documents (P18-A09 and P18-A10), as the catalogue lists them.
- Annex A Control Implementation Library 1.12 → 1.13
Phase 1 now asks whether climate change is a relevant issue for the ISMS, as Amendment 1:2024 requires of the standard's context clause; the Stage 1 go and no-go says that the completed audit and review is the pack's gate while the pack's own rule sets Stage 2 as the latest point; a failure-mode row names the go and no-go decisions before each stage; the Stage 2 go and no-go asks for every Stage 1 concern closed, as the audit preparation guide does, instead of closed or planned.
The first full cycle is planned to finish before Stage 1, the pack's own gate, while the pack's own rule sets Stage 2 as the latest point; the audit schedule, the timing table and the note on the first certification now say so, and that a certification body may accept a dated plan at Stage 1.
The schedule row for the first review says the pack plans it before Stage 1 while the pack's own rule sets Stage 2 as the latest point.
- Management Review Meeting Pack 1.0 → 1.1
The Stage 1 checklist says that a completed internal audit and management review is the pack's gate, that the pack's own rule sets Stage 2 as the latest point, and that a certification body may accept a dated plan at Stage 1; the line on what the certification body checks at Stage 1 no longer cites the rule; the Before Stage 2 list labels closing every concern as the pack's own rule.
The training interval is this pack's default, not the Directive's, and the P27 documents are named.
- Annex A Control Implementation Library 1.11 → 1.12
Names the P24 documents.
- Annex A Control Implementation Library 1.9 → 1.10
- Mandatory ISMS Documentation Checklist 1.6 → 1.7
- Stage 1 and Stage 2 Audit Preparation Guide 1.6 → 1.7
Names the P26 documents.
- Annex A Control Implementation Library 1.10 → 1.11
Names the P21 documents.
- Annex A Control Implementation Library 1.8 → 1.9
- Mandatory ISMS Documentation Checklist 1.5 → 1.6
- Stage 1 and Stage 2 Audit Preparation Guide 1.5 → 1.6
Names the P23 documents.
- Annex A Control Implementation Library 1.7 → 1.8
- Mandatory ISMS Documentation Checklist 1.4 → 1.5
- Stage 1 and Stage 2 Audit Preparation Guide 1.4 → 1.5
The Catalogue support column now names the regulatory incident notification documents now published (P18).
- Annex A Control Implementation Library 1.3 → 1.4
The Catalogue support column now names the security maturity assessment documents now published (P19).
- Annex A Control Implementation Library 1.4 → 1.5
The Catalogue support column now names the security control assurance documents now published (P20).
- Annex A Control Implementation Library 1.5 → 1.6
Names the P22 documents.
- Annex A Control Implementation Library 1.6 → 1.7
- Mandatory ISMS Documentation Checklist 1.3 → 1.4
- Stage 1 and Stage 2 Audit Preparation Guide 1.3 → 1.4
The Catalogue support column now names the access, privileged access, classification, awareness and patch management documents now published (P13 to P17).
- Annex A Control Implementation Library 1.2 → 1.3
- Mandatory ISMS Documentation Checklist 1.2 → 1.3
The blocking-item support table now names the access, privileged access, classification, awareness and patch management documents now published (P13 to P17).
Narrowing the scope to meet a date is allowed only where the scope still passes every scope test, or by leaving out a service not yet run for the operating period, added at surveillance; group IT that runs systems the scope depends on is included, not named as an interface.
The Catalogue support column now names the published P09 and P10 documents (and P06-A10, P07-A05) instead of 'more planned'.
- Annex A Control Implementation Library 1.0 → 1.1
The Catalogue support column now names the metrics and NIS2 documents now published (P11, P12) where it said 'more planned' or 'None yet'.
- Annex A Control Implementation Library 1.1 → 1.2
The Catalogue support column now names the published P09 and P10 documents instead of 'Coming'.
- Mandatory ISMS Documentation Checklist 1.0 → 1.1
The Catalogue support column now names the NIS2 documents now published (P12) where it said they were coming.
- Mandatory ISMS Documentation Checklist 1.1 → 1.2
The 30- and 90-day corrective action targets are labelled as internal audit targets, and a certification body's finding follows the period that body sets.
The blocking-item support table now names the published P09 and P10 documents instead of 'coming' packs.
The blocking-item support table now names the NIS2 documents now published (P12) where it said a pack was coming.
Every cost figure is stated as an estimate, not a price: confirm each with your own figures and with quotes from accredited certification bodies.
- Guide 1.0 → 1.1
Every cost figure is stated as an estimate, not a price or a quote: the cost table's column reads Estimated range, each range is an estimate, and the limitation says the ranges are estimates.
Published. The guide and nine documents, at 1.0.