ISO 27001 in plain words: what it asks and how to get certified
ISO 27001 is the standard large customers ask for when a questionnaire is no longer enough. Here's what it asks, the documents you'll need, and how the certification audit works.
In 30 seconds
- What
- An international standard, ISO/IEC 27001:2022, for running information security as a management system: decide, do, check, improve.
- Who
- Any organisation, any size. No law requires it in general; customers and tenders often do.
- Two parts
- Clauses 4 to 10, which you must meet, and Annex A: 93 controls you select from, based on your risks.
- Key document
- The Statement of Applicability: each Annex A control, whether it applies to you, and why.
- Certification
- Done by an accredited certification body, never by ISO itself. Two audit stages, then a certificate valid three years with surveillance audits.
- Your part
- Management commits, sets the scope and reviews the system. Your team runs the controls and keeps the records.
What ISO 27001 is
ISO/IEC 27001 is an international standard for running information security as a management system: you decide what to protect, put controls in place, check that they work, and improve them. The current version was published in 2022, with a small amendment in 2024.
It doesn’t prescribe a technology. It asks you to make decisions based on your risks, write them down, apply them, and prove it. A certificate tells your customers that an independent auditor checked this.
What the standard asks
The standard has two parts. Clauses 4 to 10 are the management system itself; you must meet all of them. Annex A lists controls you select from, based on your risk assessment.
Clauses 4 to 10 mandatory
Annex A 93 controls
You decide which controls apply to you and justify it in the Statement of Applicability.
The documents a small company needs
Auditors look for documented information that matches what really happens. For a small or mid-sized company, the core set is short:
- The scope of the management system: which activities, sites and systems are covered.
- The information security policy, approved by management.
- The risk assessment method and its results, and the risk treatment plan.
- The Statement of Applicability: every Annex A control, applied or not, with the reason.
- Security objectives and how you measure them.
- Records: training done, access reviews, backup tests, incidents, supplier checks.
- The internal audit report and the management review minutes.
Write what’s true. A policy copied from a template that nobody applies is the fastest way to fail an audit. Each rule should describe what you do today, or a decision with an owner and a date.
How certification works
ISO doesn’t certify anyone. Independent certification bodies do, and you should choose one that is accredited by your national accreditation body (COFRAC in France, UKAS in the UK, for example).
- AuditStage 1The auditor reviews your documents and checks you're ready.
- AuditStage 2The auditor checks that the system runs in practice, with evidence.
- Each yearSurveillanceShorter audits to check the system keeps running.
- Year 3RenewalA recertification audit for a new three-year cycle.
Findings are normal. A major nonconformity must be fixed before the certificate is issued; minor ones go into your corrective action plan.
ISO 27001, NIS2 and GDPR
The three overlap without replacing each other. ISO 27001 is a voluntary standard. NIS2 is EU law for organisations in listed sectors, with management training, incident reporting deadlines and registration that ISO 27001 doesn’t cover on its own. GDPR requires security appropriate to the risk for personal data (article 32) and breach notification; an ISO 27001 system is a good way to organise that work, and it doesn’t make you GDPR-compliant by itself.
Is it for you now?
ISO 27001 is worth it when customers or tenders ask for it, or when you answer the same security questionnaires again and again. If one customer asks once, a well-answered questionnaire and a short security plan may be enough for now. Ask the customer what they accept: a certificate, a roadmap to certification, or evidence of specific controls.
Getting ready for ISO 27001: who does what
What QoBot does
- Proposes a scope that fits the customer's request, and explains the trade-offs.
- Runs the risk assessment with you and drafts the Statement of Applicability.
- Writes the policies and procedures from what's true in your company today.
- Lists the evidence the auditor will ask for, and where each piece is.
- Prepares the internal audit and the management review.
What your team does
- Management approves the scope, the policy and the risk decisions.
- Your team applies the controls with step-by-step guides.
- You keep the records: access reviews, backups tested, training done.
- You choose the certification body and sit the audits.
Proposed scope: the transport management platform and the Lyon office. 38 of the controls you selected are partly in place. This week:
- Claire (COO): approve the scope and the security policy · ~20 minNeeds you
- Tom (IT): export the admin accounts from Microsoft 365 · guide ready · ~15 minYour turn
FAQ
Is ISO 27001 mandatory?
Not by law in general. It becomes a requirement when a customer, a tender or a partner writes it into the contract. NIS2 and GDPR ask for appropriate security measures, and ISO 27001 is one recognised way to organise them.
Can QoBot certify us?
No. Only an accredited certification body can issue an ISO 27001 certificate, after its own audits. QoBot gets you ready: the documents, the evidence list, the internal audit preparation and a plan your team can follow.
How long does it take?
It depends on your scope and on what's already in place. Plan in months rather than weeks: the certification body wants to see the system running, with an internal audit and a management review already done, before the stage 2 audit.
What does certification cost?
Two costs: the certification body's audit days, which depend on your headcount and scope, and your team's time. Ask two or three accredited bodies for a quote on the same scope.
What's the difference between ISO 27001 and ISO 27002?
ISO 27001 sets the requirements you're certified against. ISO 27002 is a guide that explains how to implement each Annex A control. You can't be certified against ISO 27002.
Does ISO 27001 cover NIS2?
Much of it: risk analysis, policies, incidents, suppliers, access control. NIS2 adds duties of its own, such as management training, reporting deadlines and registration with the national authority. See NIS2 in plain words.
Sources
- ISO/IEC 27001:2022ISO · Information security management systems: requirementsOfficial text
- ISO/IEC 27001:2022/Amd 1:2024ISO · climate action changes to clauses 4.1 and 4.2Official text
- ISO/IEC 27002:2022ISO · guidance on information security controlsOfficial text
- CertificationISO · ISO develops standards; independent bodies certifyOfficial page
This page explains the rules in plain words. It isn't legal advice: for a borderline case, ask a lawyer. Report an error