The ISO 27001 certification process
You go through six steps from decision to certificate. Count on six to eighteen months, depending on your starting position and IT complexity.
The six steps to certification
- Determine scope - Which parts of your organisation, systems and locations are covered by the ISMS? Start small if necessary and expand later.
- Perform risk analysis - Identify information security risks and determine what measures are needed. This is the heart of ISO 27001.
- Set up ISMS - Implement controls, establish policies, train employees, and document processes.
- Complete proof period - Work under your ISMS for a minimum of three months. Auditors want proof that the system works in practice.
- Internal audit and management review - Check yourself whether everything is working and have management formally assess the ISMS.
- External audit - The certification body carries out the audit in two phases. If successful you will receive the certificate.
Who does what?
You
Risk analysis, setting up ISMS, internal audits, training employees
IT department
Implementing technical measures, logging, monitoring
Consultant (optional)
Guidance, gap analysis, templates, training
Certification body
Perform audit, issue certificate
Accreditation body
Checks the certification body (the Dutch body, UKAS, etc.)
Good to know: A consultant is not mandatory. Many organisations with experienced IT and compliance people do it themselves.
Preparation for ISO 27001
Good preparation is half the battle. Most of the time is spent on the risk analysis and setting up your ISMS, not on the audit itself.
What do you need to arrange internally?
Then follow these steps:
- Appoint project leader - Someone with a mandate, IT knowledge and time commitment
- Determine scope - Which systems, processes and locations are covered by the ISMS?
- Perform Risk Analysis - Identify threats, vulnerabilities and risks
- Implement measures - Technical and organizational, based on the risk analysis
- Create awareness - Train employees, phishing testing, communicate policies
- Start proof period - Work for at least three months according to the ISMS
- Perform internal audit - Test whether everything works before the certification body arrives
What documentation is needed?
The standard requires at least:
Information Security Policy
Your vision and objectives in the field of information security
Scope of the ISMS
Which parts of your organisation will be certified
Risk analysis and treatment plan
Identified risks and chosen measures
SoA
Statement of Applicability
Which controls you apply and which you do not, with substantiation
Process descriptions
How you work (incident management, access management, change management)
Registrations
Proof that you do what you say (audits, incidents, training)
No need for a thick manual. Many organisations work with a digital system or compact documents. The form is free, as long as it is current and accessible.
Three common mistakes
Mistake 2: Paper tiger
Your documents must correspond with practice. If you write down that you will check logs every week, you should actually do so. Auditors ask for evidence.
Mistake 3: Starting the proof period too late
You must have worked under your ISMS for at least three months before the external audit can take place. Plan this, otherwise your certification date will be postponed.