ISO 27001 is often the first certification a growing software company is asked for, usually by an enterprise customer’s security questionnaire. The transition from the 2013 edition is now over: every ISO/IEC 27001:2013 certificate had to expire or be withdrawn by 31 October 2025, so anyone certifying today does so against ISO/IEC 27001:2022.
Many first attempts go wrong the same way. The team treats it as a documentation project, produces a stack of policies, and finds in the audit that nobody follows them.
What the standard actually asks for
ISO 27001 isn’t a list of controls to switch on. It specifies an information security management system (ISMS): a way of deciding what to protect, assessing the risks to it, choosing controls, checking they work and improving them.
The core of the work is in four places:
- Scope. Which parts of the organisation, which products, which locations and which systems the ISMS covers.
- Risk assessment. A repeatable method for identifying risks to that scope and deciding how to treat each one.
- Statement of Applicability (SoA). Every control in Annex A, whether it applies, and why. The 2022 edition groups its controls into four themes: organisational, people, physical and technological.
- Management system clauses. Leadership, objectives, competence, internal audit, management review and corrective action. These are what make it a system rather than a project.
What the certification audit tests
Certification is done by an accredited certification body in two stages.
Stage 1: documentation review
The auditor checks that the ISMS is designed properly: scope, policy, risk assessment method and results, SoA and objectives. Stage 1 findings tell you what to fix before Stage 2.
Stage 2: implementation audit
The auditor checks that the ISMS operates as documented. Expect interviews with people across the organisation, not just the security lead, and requests for evidence: access review records, onboarding and offboarding tickets, vulnerability scan results, incident logs, internal audit reports and management review minutes.
Findings are graded as major nonconformities, which block certification until they’re resolved, or minor nonconformities, which you fix and the auditor follows up later.
Five common mistakes
- Writing policies nobody follows. A policy that describes what you wish happened produces nonconformities in Stage 2. Write down what you actually do, then improve it.
- A superficial risk assessment. A generic risk register copied from a template doesn’t justify your control choices. The SoA should trace back to real risks.
- Too broad a first scope. Certifying the whole company at once multiplies the evidence you need. Start with the product or service your customers are asking about, then extend.
- No visible management involvement. Auditors look for leadership setting objectives and reviewing the ISMS. A management review that never happened is a common major finding.
- Neglecting technical controls. Access reviews, vulnerability management, logging and backups need to run on a schedule and leave evidence. This is where security engineering and compliance meet.
A practical readiness plan
- Gap assessment. Compare what exists today with the standard’s clauses and Annex A. Agree the scope.
- Governance. Name an owner, set objectives and schedule management reviews.
- Risk assessment and SoA. Run the assessment on the agreed scope and decide treatment.
- Implement controls. Close the gaps, prioritizing the controls that address your highest risks.
- Operate and collect evidence. Let the processes run long enough to produce records. Most certification bodies expect to see the ISMS operating, not just designed.
- Internal audit and management review. Both are required before Stage 1 and Stage 2.
- Certification audit. Stage 1, fix findings, then Stage 2.
How long this takes depends on your size, scope and how much already exists. Expect months, not weeks.
Choosing a certification body
Choose a body accredited by a national accreditation body that is a member of the International Accreditation Forum (IAF). You can check a certificate or a certification body on IAF CertSearch. Experience in your sector helps, and it’s worth comparing at least two quotes.
Certification isn’t one-off. Plan for annual surveillance audits and a full recertification audit every three years, and budget for the people who keep the ISMS running between them.