How to get ISO 27001 certified: A step-by-step guide

In a world where big data, online connectivity, and AI integration are at the core of business infrastructure, ensuring safety and security is indispensable. That's why companies turn to ISO/IEC 27001, the international standard for information security. We asked Linda Porter, Principal Assessor, Information Security Management Systems at NQA, a Kiwa company, to tell us more about ISO/IEC 27001:2022 and the process of getting certified.

What is ISO 27001?

ISO 27001 is an international standard for information security. It provides a structured framework for developing and maintaining a robust information security management system (ISMS). “With that in place, your company can protect its information, stay proactive and aware in the ever-changing cyber-risk landscape, and offer customers assurance that their data is safe with you”, says Linda. “Annex A of the standard sets out 93 security controls across four themes: organizational, people, physical, and technological.”

What is an information security management system (ISMS)?

An ISMS is the framework put in place to manage sensitive data. “It’s there to help you understand your vulnerabilities and opportunities”, says Linda. “It helps you manage risks and continually improve. The foundation of any ISMS is the CIA triad: Confidentiality, so only authorized individuals can access data; Integrity, making data secure against unauthorized editing or deletion; and Availability, ensuring it’s accessible when needed”.

Who is ISO 27001 for?

In the past, it was common to assume that only software or technology companies needed a standard like ISO 27001. This is far from the truth today. "Everyone needs it," says Linda. "Whether you're dealing with customer data, have a website, or simply use the internet as part of your business, ISO 27001's controls are applicable to you. We've even seen single-person companies adopt it."

It all depends on your business and its context, what you do and how you do it. "It's not about trying to implement all 93 controls," says Linda. Some controls may be required for legal or contractual reasons, others become relevant because an organization handles sensitive information regularly. Every company faces some level of risk around cybercrime and data theft, which is why Linda sees this as something all organizations should at least consider. Part of the process is justifying, for each control, why it's needed or why it isn't.

What are the benefits of ISO 27001?

The central benefit of ISO 27001 is safeguarding your data and information. At the same time, it can deliver other benefits to your company:

Comply with regulations: ISO 27001 can help you comply with regulations like the EU General Data Protection Regulation (GDPR)

Improve trust: your business partners and customers will see that you've taken steps to protect data, proving you take data security seriously
A competitive business advantage: whether you're tendering for a contract or talking to a supply chain partner, demonstrating data security can make the difference
Reduce business risk: a data breach can mean reputational damage, regulatory fines, and lost contracts; certification helps reduce the likelihood of that happening in the first place

How do you get ISO 27001 certified?

When it comes to getting started with ISO 27001, there are two steps to take. “Conducting a gap analysis and preparing your documentation”, says Linda.

What is an ISO 27001 gap analysis?

A gap analysis is a natural starting point for certification. In this process, you take the ISO 27001 standard and compare it to what you have in place and how far you are from meeting the requirements. One important document is ISO 27002, shares Linda. “It’s a companion piece that breaks down each of the Annex A controls in detail. While we don’t certify against it, it’s a useful document to have with you, to check whether you're implementing a control in the best way, and whether you've thought of everything.”

What documentation is required for ISO 27001?

Before a third-party starts auditing your company, you need to have certain documents in place: a documented scope, an information security policy, a risk assessment, a statement of applicability, and a risk treatment plan with objectives. The standard also requires certain records to be kept, training and competency records, measurement results, internal audit reports, management review outcomes, and records of any nonconformities or security incidents.

"The level of documentation is determined by the organization," Linda says. "If you've only got two people, you may not need to write down every procedure in detail. But if you've got 1,500 people, you're going to need more documentation, so everyone knows what's expected of them."

Stage 1

a high-level review of your documentation and processes checks they meet the requirements. Any gaps are noted as Areas of Concern and must then be addressed before moving on.

Stage 2

this stage covers all clauses and controls in full, and centers on looking for evidence that the management system works in practice.

Stage 3

If successful and certified, organizations enter a three-year audit cycle: two annual surveillance audits followed by a recertification audit in year three, with every clause and control covered at least once across that cycle.

Why consider ISO 27001?

In Linda’s perspective, information security is too important to leave to chance. "If data leaks, whether that's intentional, a mistake, or malicious, you're still accountable, or the business is," she says. "You can face reputational damage, a fine from the Information Commission’s Office, lost contracts, it can even put you out of business. In my view, it is an essential standard to adopt."

Want to start your certification journey? Find out more about ISO 27001 or reach out to Kiwa today