Compliance · ISO 27001
ISO 27001
The international standard for an Information Security Management System (ISMS), recognised by clients, insurers and regulators worldwide.
What it is
A risk-based management system, not a checklist.
ISO 27001 defines how to build and run an ISMS: a risk-based system of policies, controls and evidence, supported by the Annex A control set.
Certification is awarded by an accredited body following Stage 1 and Stage 2 audits, then maintained through surveillance audits.
What the standard contains
Clauses 4 to 10, and the Annex A controls.
The current edition is ISO/IEC 27001:2022. Clauses 4 to 10 set out the management system itself: the context and scope of the ISMS, leadership, risk assessment and treatment, support, operation, performance evaluation and improvement.
Annex A lists 93 information security controls, grouped into organisational, people, physical and technological themes. Your risk assessment decides which apply, and the Statement of Applicability records each decision and why. Most organisations apply the large majority of them.
Who needs it
When a recognised standard is the price of entry.
It is widely expected by enterprise clients, insurers and regulators, and frequently appears as a hard requirement in supplier audits and bids.
It is often the answer to international client audits, including those driven by DORA, where a buyer needs evidence of a mature control framework rather than a baseline. Regulators such as the FCA and the ICO do not require a specific certification, but they treat ISO 27001 as strong evidence of mature security management.
How certification works
Two audits to certify, then a three-year cycle.
In the UK, look for a certification body accredited by UKAS, as that is what most clients and procurement teams check for.
- Stage 1: the certification body reviews your documentation and readiness
- Stage 2: an operational audit tests that the ISMS is genuinely running and the controls work
- Before Stage 2 you need evidence of the system in operation, including an internal audit and a management review
- The certificate is valid for three years, with lighter surveillance audits in years two and three
- Full recertification follows at the end of the cycle
Timeline
How long ISO 27001 takes.
A focused gap analysis typically takes around four weeks and produces a gap report and an implementation roadmap.
Full implementation typically takes six to nine months for an organisation with a reasonable starting position, and up to twelve if starting from very little. Scope is the biggest lever: a tightly defined ISMS is faster to build and easier to run.
Common pitfalls
Where ISO 27001 programmes go wrong.
- A scope drawn too wide, so the work is disproportionate, or too narrow, so clients do not accept it
- Policies that describe how things should work rather than how they actually do
- A risk assessment that does not drive the choice of controls
- An internal audit programme or supplier risk process that only exists on paper, two common Stage 2 findings
- Parking the ISMS between audits, which makes the next surveillance audit painful
How we help
Scope it tight, build it to last, keep it alive.
- Scope the ISMS tightly so the work is proportionate
- Run a gap analysis against the standard and the Annex A controls
- Build the controls, documentation and evidence, and run the management system
- Certification audits delivered through certified assessment partners
- Maintain it continuously so surveillance audits never become a scramble
FAQ
Questions buyers actually ask
- Typically six to nine months from the start of implementation for an organisation with a reasonable starting position, and up to twelve months if starting from very little. A gap analysis to tell you where you stand usually takes around four weeks.
- Three years. The certification body runs surveillance audits in years two and three to confirm the management system is still operating, followed by a full recertification audit at the end of the cycle.
- No. The transition period to ISO/IEC 27001:2022 ended on 31 October 2025, so certificates against the 2013 edition have expired. Current certification is against the 2022 edition and its 93 Annex A controls.
- ISO 27001 is the certifiable standard: it sets the requirements for the management system and lists the Annex A controls. ISO 27002 is guidance on how to implement those controls. You certify against ISO 27001; you use ISO 27002 to help you do it well.
- It depends on who is asking. Cyber Essentials proves a technical baseline and is often enough for UK public-sector contracts and insurers. ISO 27001 proves a managed, risk-based security programme and is what enterprise and international clients usually expect. Many organisations hold both.
- An accredited certification body, which in the UK should be UKAS-accredited. Threat Protect scopes, builds and runs the ISMS with you and keeps it current, with the certification audits delivered through certified assessment partners.
Thinking about ISO 27001?
We’ll help you scope it before you commit. Most quotes go wrong because the scope is wrong.
Book a call