Requests for ISO/IEC 27001 certification increasingly come from outside the organization: a customer’s procurement questionnaire, a partner’s due diligence, an investor’s review. The temptation is to treat certification as a compliance deliverable to be obtained as quickly as possible. In practice, the standard asks for something more demanding and more useful: an information security management system (ISMS) that leadership governs, that is based on the organization’s own risks, and that demonstrably operates over time.
This guide sets out what the 2022 edition of the standard requires, how certification works, and where leadership attention is most needed. One distinction runs throughout: advisors can prepare an organization for certification, but only an accredited certification body can certify it, and no advisor can guarantee the outcome of that audit.
What the standard actually asks of an organization
ISO/IEC 27001:2022 has two parts that work together. Clauses 4 to 10 set out the management system requirements: understanding the organization’s context and interested parties, leadership commitment and an information security policy, risk-based planning and objectives, resources and competence, operational control, performance evaluation and continual improvement. Annex A then provides a reference set of 93 information security controls, grouped into organizational, people, physical and technological themes.
The Annex A controls are not a checklist to be implemented in full. They are a reference against which the organization checks that its risk treatment has not overlooked anything necessary. Certification therefore assesses a system of governance and decision-making, not merely a catalogue of technical measures.
Scope is the first strategic decision
The ISMS scope defines which activities, sites, teams, information and systems are covered, and it appears on the certificate. A scope that is too narrow may fail to answer the customers who asked for certification; one that is too broad can make the first cycle unmanageable. Scope should be driven by the services and information that matter to stakeholders, with interfaces and dependencies on what lies outside it, such as group functions, cloud providers and outsourced operations, clearly identified and addressed.
Scope also depends on a sound understanding of context: the internal and external issues that affect information security, the legal, regulatory and contractual requirements that apply, and the expectations of interested parties such as customers, regulators and staff. These are not formalities. They determine which risks the ISMS must address and which commitments it must be able to demonstrate. Where obligations are legal or regulatory in nature, their interpretation should be confirmed with qualified legal specialists.
Risk assessment, treatment and the Statement of Applicability
At the core of the ISMS is a defined and repeatable method for identifying, analysing and evaluating information security risks, with risk owners and acceptance criteria agreed by management. Each significant risk is then treated: reduced through controls, avoided, transferred or formally accepted. The resulting risk treatment plan is approved by risk owners, who also accept the residual risk.
The Statement of Applicability (SoA) records which Annex A controls are necessary, whether they are implemented, and the justification for including or excluding each one. Auditors rely on it heavily, and it is a useful leadership document in its own right: a concise view of how the organization has chosen to protect its information, and why.
Operating the ISMS before the audit
Certification auditors look for evidence that the management system works, not just that it has been written. Before the certification audit, the organization should have run the ISMS for long enough to generate records: risk reviews, incident handling, access reviews, supplier assessments, awareness activities and monitoring of security objectives. Two activities are essential and frequently underestimated. An internal audit, performed by competent and objective auditors, must cover the ISMS requirements. A management review, in which top management examines performance, risks, audit results and improvement opportunities, must take place and be documented.
How certification works
Certification is performed by an independent certification body, ideally one accredited by a recognized national accreditation body. The initial audit has two stages. Stage 1 reviews the ISMS documentation, scope and readiness, and confirms whether the organization is prepared for the next step. Stage 2 assesses whether the ISMS is implemented and effective in practice, through interviews, sampling and observation. Nonconformities raised by the auditors must be addressed through corrective action before certification can be granted. Once issued, a certificate typically runs on a three-year cycle, with surveillance audits at least annually and a recertification audit before expiry.
The role of advisors, and the questions leadership should ask
Advisors can add real value in preparation: a gap assessment against the standard, support in defining scope and risk methodology, drafting the policies and procedures the organization will own, coaching risk and control owners, and a mock or pre-certification audit. What they cannot do is certify, or promise that a certification body will reach a particular conclusion. Certification bodies, in turn, must stay independent and do not provide consulting to the organizations they certify. Keeping these roles distinct protects the credibility of the certificate.
- Which customers, contracts or markets are driving the request, and what scope will genuinely satisfy them?
- Who in the leadership team owns the ISMS, and who owns each significant risk?
- Are our risk acceptance criteria explicit, and are we comfortable defending them?
- Have we budgeted for operating the ISMS after certification, not only for obtaining it?
- Is our timeline realistic, allowing the ISMS to run long enough to produce credible evidence?
A certificate records that a management system was found to conform at a point in time; only leadership can make it hold between audits.