ISO 27001 Certification Guide 2026

ISO 27001 certification opens enterprise procurement doors, satisfies regulatory requirements, and gives your customers independent verification that you manage information security systematically. It also takes 6-18 months and significant internal resource to achieve. This guide explains what the standard actually requires, where organizations typically stall, and how to run a certification project that does not collapse under scope creep.

What ISO 27001 Requires

ISO 27001:2022 defines requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The standard has two parts: the main body (clauses 4-10) which specifies the management system requirements, and Annex A which contains 93 security controls organized into four themes: Organizational, People, Physical, and Technological.

The critical distinction that confuses first-time implementers: ISO 27001 does not require you to implement all 93 Annex A controls. It requires you to determine which controls are applicable based on your risk assessment and document justification for any controls you exclude — this is the Statement of Applicability (SoA). An organization might legitimately exclude physical security controls for a fully remote company, for example.

Phase 1: Gap Assessment (Weeks 1-4)

Before planning the implementation, assess where you are against where you need to be. A gap assessment maps your current controls against the ISO 27001:2022 requirements and Annex A controls, identifies what is already in place (even informally), and estimates the effort to close each gap.

Run the gap assessment internally using the ISO 27001:2022 checklist available from your national standards body, or engage an external ISO consultant for an independent view. External assessment adds credibility when presenting to leadership and avoids blind spots from internal familiarity with existing processes.

Phase 2: Risk Assessment and Treatment (Weeks 4-12)

ISO 27001 is fundamentally a risk management framework. The risk assessment identifies information assets, threat sources, vulnerabilities, likelihood, and impact to produce a risk register. Your risk treatment plan then maps each unacceptable risk to an Annex A control or other treatment option (accept, avoid, share).

Choose a risk methodology before starting. ISO 27005 provides guidance; common approaches include asset-based risk assessment (enumerate assets, identify threats and vulnerabilities per asset) and scenario-based assessment (define threat scenarios and assess their likelihood and impact). The methodology matters less than consistency — apply it uniformly across all assets in scope.

Phase 3: Policy and Control Implementation (Months 2-6)

The policy framework required by ISO 27001 includes a top-level Information Security Policy, an ISMS scope document, and supporting policies for: access control, asset management, cryptography, physical security, operations security, communications security, supplier relationships, incident management, business continuity, and compliance.

These policies do not need to be long. They need to be accurate descriptions of what your organization actually does or will do. A policy that describes an idealized process no one follows is worse than no policy — it creates a gap between documented controls and actual practice that auditors will find and flag as a nonconformity.

High-priority Annex A controls for most organizations

• A.5.15 — Access control: Define and enforce access policies based on least privilege
• A.5.23 — Information security for cloud services: Govern cloud service use, assess provider security, include security requirements in contracts
• A.8.7 — Protection against malware: Deploy and maintain malware protection, user awareness for vectors
• A.8.15 — Logging: Generate, store, protect, and review logs for security-relevant events
• A.8.24 — Use of cryptography: Define policy for encryption use, key management, and approved algorithms
• A.5.29 — Information security during disruption: Plan for security control availability during incidents and disasters

Phase 4: Internal Audit (Month 6-8)

Before the certification audit, run a full internal audit of your ISMS against all applicable clauses and controls. The internal audit must be conducted by someone independent of the area being audited — not by the person who implemented the control. Findings from the internal audit are inputs to management review and corrective action.

Take internal audit findings seriously. A finding from your internal audit is an opportunity to fix something before the external auditor finds it. An external auditor finding the same issue is a nonconformity in your audit report, which creates certification delay and remediation overhead.

Phase 5: The Certification Audit

Certification audits are conducted by accredited Certification Bodies (CBs) in two stages:

• Stage 1 (Documentation review): The auditor reviews your ISMS documentation, scope, policies, risk assessment, and Statement of Applicability. Typically 1-2 days. Output: readiness determination and list of concerns to address before Stage 2.
• Stage 2 (Implementation audit): The auditor tests that your documented controls are actually implemented and effective. Reviews evidence: logs, access control records, training records, incident tickets, supplier agreements. Typically 2-5 days depending on scope. Output: audit report with any nonconformities (major or minor) that must be addressed for certification to be granted.

Major nonconformities prevent certification until resolved and re-audited. Minor nonconformities must have a corrective action plan within 90 days. The difference: major nonconformities indicate the requirement is not met at all; minor nonconformities indicate the requirement is partially met or evidence is insufficient.