What Is ISO 27001?

ISO 27001 is the international standard for information security management, and the most widely recognised security certification globally. What is certified is the management system rather than any particular set of controls.

That distinction shapes everything about the process: an auditor examines whether you identify risks, select treatments, implement them and improve, rather than whether you chose specific products.

The structure

Clauses four to ten contain the mandatory requirements for the management system itself — context, leadership, planning, support, operation, evaluation and improvement. These are not optional and cannot be excluded.

Annex A contains the control catalogue, reorganised in the 2022 revision into four themes — organisational, people, physical and technological — with new controls covering threat intelligence, cloud services, data leakage prevention and secure coding.

The certification process

A stage one audit reviews documentation and readiness. A stage two audit examines whether the system operates in practice. Certification runs three years with annual surveillance audits and a full recertification at the end.

The certificate is issued by an accredited certification body. Accreditation matters commercially, because certificates from unaccredited bodies are recognised inconsistently.

How it compares with SOC 2

SOC 2 is an attestation report produced by an accounting firm, dominant in North America, particularly among technology vendors. This is a certification, recognised internationally and more common in Europe and Asia.

The underlying control environments overlap substantially, which means an organisation holding one can usually reach the other for considerably less than the first cost. Which to pursue first is generally a question of where your customers are.

Cost and timeline

For an organisation starting from reasonable practice, six to twelve months and a combination of consulting support, internal effort and audit fees in two stages plus annual surveillance.

The dominant cost is internal time, concentrated in documentation and evidence. An organisation that already operates the controls and lacks records faces a documentation project; one that does not operate them faces something much larger, and the two are routinely quoted as if equivalent.

The related standards

A companion standard provides implementation guidance for the Annex A controls and is considerably more useful day to day than the certifiable standard itself.

Sector and topic extensions cover privacy information management, cloud services and artificial intelligence management systems, each building on the same management system structure — which makes adding one much cheaper than the first.

Surveillance audits are where certificates lapse

Certification is not a single event. Annual surveillance audits sample the management system, and the recurring failures are the process requirements rather than the controls: internal audits not performed, management reviews not held, corrective actions not closed.

Those are calendar commitments rather than technical work, and they are the first things to slip once the certificate is obtained and the project team has dispersed. Assigning them to a named owner with scheduled dates is what prevents an avoidable non-conformity.

Where to start

Decide the scope and write it as a customer would read it, then get a gap assessment against the clause requirements rather than against the control catalogue. The clauses are where certifications actually fail.

See certification cost breakdown and SOC 2 versus ISO 27001. GuardsArm delivers ISO 27001 services.