10 Steps to Implement ISO 27001 and Get Certified

1. Secure Leadership Commitment

ISO 27001 clause 5 places responsibility for the ISMS on top management. In practice this means an executive sponsor who approves the policy, provides budget and people, assigns roles and attends management reviews.

Present the business case in business terms: customer requirements in tenders, reduced breach impact, fewer security questionnaires and a consistent way to manage risk. Agree a realistic timeline and name an ISMS lead who owns the programme day to day.

2. Define the ISMS Scope

Clause 4.3 requires a documented scope. Decide which business units, locations, products, systems and data are included, and record the interfaces and dependencies with anything outside the scope, such as cloud providers or a parent company.

Start with the scope that matters most to customers, often the core product or service and the people and systems that support it. You can extend the scope at a later surveillance or recertification audit.

3. Understand Context and Interested Parties

Clauses 4.1 and 4.2 ask you to identify internal and external issues that affect security, and the interested parties whose requirements the ISMS must address. The 2024 amendment to ISO 27001 also asks organisations to consider whether climate change is a relevant issue.

• External issues: regulations such as GDPR or NIS2, threat landscape, market and supplier dependencies.
• Internal issues: culture, structure, technology, skills and existing processes.
• Interested parties: customers, regulators, staff, shareholders, suppliers and insurers, with the requirements each one has.

4. Write the Information Security Policy and Objectives

Clause 5.2 requires an information security policy approved by top management, and clause 6.2 requires measurable security objectives with owners, resources and deadlines. Good objectives link to business outcomes, for example "100% of production systems covered by MFA by the end of Q2".

This is also the time to plan the topic-specific policies the ISMS will need. The security policy framework guide covers how to structure them.

5. Run the Risk Assessment

Clause 6.1.2 requires a defined, repeatable risk assessment method: how risks are identified, who owns them, how likelihood and consequence are rated and what level of risk is acceptable. ISO/IEC 27005 gives detailed guidance.

Identify risks to the confidentiality, integrity and availability of information in scope, assign each one a risk owner, rate it and compare it to your acceptance criteria. Our risk assessment walkthrough walks through the method, and the free Cyber Risk Register gives you a working register and heat map.

6. Build the Risk Treatment Plan and Statement of Applicability

For every risk above your acceptance level, choose a treatment: modify the risk with controls, avoid it, share it (for example through insurance or a supplier) or retain it with documented approval from the risk owner.

The Statement of Applicability (SoA) lists all 93 Annex A controls, states whether each is applicable, why, and whether it is implemented. Auditors use it as a map of the whole ISMS, so keep it accurate and linked to the risk treatment plan. Each control is explained in plain language in our ISO 27001 Annex A controls list.

7. Implement the Annex A Controls

Turn the risk treatment plan into a project plan with owners and dates. Prioritise controls that reduce the largest risks and those that auditors and customers check most often: access control, MFA, logging, backup, vulnerability management, supplier security and incident response.

For each control, decide what evidence will prove it works: a configuration export, a ticket, a review record or a report. Collecting evidence as you go is far easier than reconstructing it before the audit.

8. Train People and Build Awareness

Clauses 7.2 and 7.3 require that people doing security-relevant work are competent and that everyone in scope knows the policy, their contribution and the consequences of not complying. Keep records of training and competence. The security awareness program guide shows how to design a program that changes behaviour, not just one that produces completion certificates.

9. Monitor, Measure and Run an Internal Audit

Clause 9.1 requires you to decide what to measure, how and when, and to evaluate the results. Clause 9.2 requires an internal audit program run by people who are objective and impartial about the area they audit.

Audit every clause and the applicable Annex A controls before the certification audit. Record nonconformities, find the root cause and track corrective actions to closure as clause 10.2 requires.

10. Hold a Management Review and Book the Certification Audit

Clause 9.3 requires top management to review the ISMS at planned intervals, covering audit results, risk status, objectives, incidents, feedback and opportunities for improvement. Minute the decisions; the record is audit evidence. Our compliance reporting guide covers how to present this.

Choose an accredited certification body. Stage 1 reviews your documentation and readiness. Stage 2 tests whether the ISMS is implemented and effective. Certificates are valid for three years, with surveillance audits in the intervening years. The audit preparation checklist explains how to prepare evidence.