ISO 27001 certifies something subtle: not that your security is perfect, but that you run a functioning Information Security Management System — a governance loop that identifies risk, applies controls, checks itself and improves. Understanding that framing makes the whole certification process legible.
Build the ISMS
- Define scope: which parts of the organization and which services the certificate covers.
- Run the risk assessment and choose treatments using a documented methodology.
- Produce the Statement of Applicability — the master document justifying which Annex A controls apply.
- Implement controls and the required documentation: policies, objectives, competence records, supplier requirements.
Prove it runs
Before a certification body arrives, the standard requires you to audit yourself — a real internal audit with findings, and a management review where leadership examines the ISMS's performance. First-time projects lose the most time here, because both need evidence of having genuinely happened, not templates with signatures.
The certification audits
Stage 1 is a documentation review: the auditor checks the ISMS design and flags gaps while they're still cheap to fix. Stage 2 is the real assessment — interviews, sampled records, control walkthroughs across your scope. Pass, and the certificate is issued for three years, with surveillance audits in years one and two and recertification in year three.
Keeping the certificate cheap
The organizations that sail through surveillance treat the ISMS calendar as operations: quarterly risk reviews, scheduled internal audits, continuous evidence collection. The ones that suffer rebuild the system every year, two weeks before the auditor lands.
