ISO/IEC 27001 is the most widely recognised information security standard in the world, and unlike SOC 2 (an attestation report) or most privacy laws, it's a certification — an accredited third party formally certifies that your organisation meets the standard. That distinction shapes the whole process: there's a defined path, defined audit stages, and a defined certification body relationship, not just an internal assessment.
Step 1: Define the scope of your ISMS
ISO 27001 certifies an Information Security Management System (ISMS) — a defined set of policies, processes, and controls for managing information security risk — not your entire company by default. The first real decision is scope: which business units, locations, systems, and data does the ISMS cover? A narrower, well-defined scope (e.g. "the product engineering and customer data infrastructure of Company X") is often more achievable and still meaningful to customers than an unrealistically broad one.
Step 2: Get leadership commitment and assign ownership
ISO 27001 explicitly requires top management commitment — not just budget sign-off, but active involvement in setting the information security policy and reviewing the ISMS's performance. Someone also needs to own the ISMS day to day; in most organisations this is a security lead, compliance manager, or (in smaller companies) a technical founder wearing that hat.
Step 3: Run a formal risk assessment
This is the engine of the whole standard. You need a documented, repeatable methodology for identifying information security risks (to confidentiality, integrity, and availability of information), assessing their likelihood and impact, and deciding how to treat each one — accept, avoid, transfer, or mitigate with a control. This risk assessment is what actually determines which controls you need; it's not optional paperwork, it's the justification for everything that follows.
Step 4: Build your Statement of Applicability (SoA)
ISO 27001's Annex A lists a comprehensive set of security controls (spanning organisational, people, physical, and technological categories). The Statement of Applicability is the document where you go through every Annex A control and record whether it applies to your ISMS, why, and how it's implemented (or why it's justifiably excluded). Auditors treat the SoA as a central artifact — it needs to be genuinely thought through, not copy-pasted.
Step 5: Implement the controls and generate real evidence
This is usually the longest phase. Each control needs to actually be operating, not just documented — access reviews genuinely happening on a schedule, incident response actually being tested, vendor risk assessments actually being performed. Auditors will ask for evidence, not just policy documents: logs, tickets, sign-offs, meeting minutes, screenshots of configurations.
Step 6: Internal audit and management review
Before the external audit, the standard requires an internal audit (checking whether the ISMS conforms to both the standard and your own documented processes) and a management review (leadership formally reviewing the ISMS's performance, risks, and any needed changes). These aren't formalities — a good internal audit surfaces the gaps an external auditor would otherwise find first.
Step 7: The external certification audit — two stages
The certification audit itself happens in two stages, run by an accredited certification body:
- Stage 1 — a documentation review. The auditor checks that your ISMS documentation (scope, policy, risk assessment, SoA) is complete and ready for a full audit, and typically visits to assess your readiness.
- Stage 2 — the full implementation audit. The auditor tests whether the controls described in your documentation are actually operating in practice, interviewing staff and sampling evidence.
Passing both stages results in certification, valid for three years.
Step 8: Maintain it — surveillance audits and recertification
Certification isn't a one-time event. Certification bodies conduct surveillance audits (typically annually) to confirm the ISMS is still operating, followed by a full recertification audit at the end of the three-year cycle. This is exactly why organisations that treat ISO 27001 as an ongoing operational discipline — rather than a one-time sprint before an audit — have a much easier time year over year.
This guide is general information, not a substitute for guidance from an accredited certification body — specific requirements and timelines can vary by certifier and by your organisation's scope.
Making the evidence side manageable
The single biggest operational cost of ISO 27001 is evidence collection — proving, continuously, that every applicable Annex A control is actually happening. ComplianceDesk's ISO 27001 framework comes with the full Annex A control set pre-built, an evidence vault to attach proof directly to each control, and reminders before anything goes stale — so your Statement of Applicability reflects reality instead of a snapshot from six months ago.