Guides › ISO 27001
Implementing ISO 27001: step by step to certification.
ISO/IEC 27001 is the international standard for information security management systems (ISMS). A certificate shows customers, partners and authorities that you manage information security systematically. This guide shows which steps are needed, which documents the auditor wants to see and how certification works.
What ISO 27001 requires.
The standard consists of two parts: the requirements for the management system itself and a catalogue of security controls. Certification always covers the interplay of both.
Management system (clauses 4 to 10)
Context and scope, leadership, planning with risk assessment, support, operation, performance evaluation and continual improvement. These clauses are mandatory without exception.
Annex A with 93 controls
Since the 2022 version, grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological controls. You justify which ones you apply in the Statement of Applicability.
Certificate for three years
After the certification audit, the certificate is valid for three years. Annual surveillance audits check whether the ISMS is still being lived, followed by recertification.
Why the effort pays off.
Customers and tenders
More and more clients require an ISO 27001 certificate from their service providers, especially in IT, industry and the public sector.
A foundation for NIS2
An ISMS based on ISO 27001 covers a large part of the risk management obligations under NIS2. If you are certified, your evidence is already structured. Learn more in the NIS2 guide.
Fewer surprises
If you know your risks and review them regularly, you spot weaknesses before an attacker or an outage exposes them.
ISO 27001 in 12 steps.
This order has proven itself in practice. The clause of the standard each step refers to is given in brackets.
Management backing
Agree objectives, budget and responsibility with top management (cl. 5.1).
Understand the context
Identify internal and external issues as well as interested parties and their requirements (cl. 4.1, 4.2).
Define the scope
Delimit locations, organisational units, processes and systems (cl. 4.3).
Policy and roles
Adopt the information security policy, appoint the information security officer and assign responsibilities (cl. 5.2, 5.3).
Record assets
Inventory information, applications, systems and service providers and determine their protection requirements (A.5.9).
Assess risks
Define the method, then identify, analyse and evaluate risks (cl. 6.1.2, 8.2).
Treat risks
Select controls, draw up the treatment plan and have the risk owners accept the residual risks (cl. 6.1.3, 8.3).
Statement of Applicability
Record for all 93 controls whether they are applied and why (cl. 6.1.3 d).
Implement controls
Write policies, introduce technical measures and document everything traceably (cl. 8.1).
Train and raise awareness
Train employees on policies and risks and keep evidence of participation (cl. 7.2, 7.3).
Internal audit
Audit the ISMS yourself before certification and correct nonconformities (cl. 9.2, 10.2).
Management review
Top management evaluates results, KPIs and risks and decides on improvements (cl. 9.3).
These are the documents the auditor wants to see.
ISO 27001 makes a number of pieces of documented information mandatory. If one of them is missing, that is a nonconformity in the audit.
| Mandatory document | Clause | In WolfISMS |
|---|---|---|
| Scope of the ISMS | 4.3 | Onboarding dialogue, KPIs & objectives |
| Information security policy | 5.2 | Documents, policy assistant |
| Risk assessment and treatment process | 6.1.2, 6.1.3 | Risk management policy from the onboarding dialogue |
| Statement of Applicability (SoA, guide) | 6.1.3 d | Standards & controls, generated automatically |
| Information security objectives | 6.2 | KPIs & objectives |
| Evidence of competence | 7.2 | Personnel management, policy portal |
| Operational planning and control | 8.1 | Measures, operational plan |
| Results of risk assessment and treatment | 8.2, 8.3 | Risk management |
| Monitoring and measurement results | 9.1 | KPIs & objectives |
| Audit programme and audit results | 9.2 | Audits |
| Results of the management review | 9.3 | Management review |
| Nonconformities and corrective actions | 10.2 | Audits, measures |
In addition, there are the documents you yourself consider necessary (cl. 7.5.1), such as policies on the applied Annex A controls.
Timeframe and process.
For a small or medium-sized company, the road to certification typically takes six to twelve months, depending on the starting point and the time available.
Build
Steps 1 to 10: context, risks, SoA, policies and controls.
Operate
The ISMS is running, KPIs are being collected, and the internal audit and management review take place.
Certification audit
Stage 1 reviews the documentation, stage 2 the effectiveness on site. Carried out by an accredited certification body.
Maintain
Surveillance audits in the first and second year, recertification after three years.
Typical mistakes and how to avoid them.
The scope is too large
If you include everything at once, you get bogged down. Start with the area your customers want to see certified and expand later.
Templates instead of your own documents
Auditors recognise template documents immediately. Policies must fit your organisation and be put into practice.
The SoA is created once and forgotten
The Statement of Applicability must match risks and controls. If these change, the SoA has to follow.
Internal audit and management review too late
Both must have been completed at least once before the certification audit. Plan enough time for them.
Get certified faster with WolfISMS.
The onboarding dialogue creates the scope, policy and risk management policy, the gap assistant shows your gaps, and the Statement of Applicability is generated automatically. No software guarantees a certificate, but it takes the legwork off your hands.