ISO 27001 Implementation Roadmap

1. Secure leadership and define scope

ISO 27001 is a management-system standard, so leadership commitment is a requirement, not a nicety. Agree the scope: which parts of the business, locations, systems and information the ISMS covers. A tight, well-justified scope is easier to certify and maintain.

2. Run a risk assessment

Identify the risks to the confidentiality, integrity and availability of information in scope, assess their likelihood and impact, and decide how to treat each one (mitigate, transfer, accept or avoid). The risk assessment drives every control decision that follows.

3. Select controls and write the Statement of Applicability

Annex A provides a catalogue of controls. For each, decide whether it applies and why, and document this in the Statement of Applicability (SoA) — the central document auditors will scrutinise. Controls must trace back to your risks.

4. Build policies, processes and controls

• Core policies: information security, access control, acceptable use, incident response, supplier security.
• Operational controls: access management, logging, backups, vulnerability management, change control.
• People controls: awareness training, onboarding/offboarding, confidentiality agreements.

5. Operate the ISMS

Certification requires evidence that the ISMS actually runs. Perform access reviews, manage risks and incidents, track corrective actions and maintain records over time. Auditors want to see the system living, not just documented.

6. Internal audit and management review

Before the external audit, run an internal audit to find and fix gaps, and hold a management review where leadership evaluates ISMS performance and decides on improvements. Both are mandatory clauses.

7. The certification audit

• Stage 1: the auditor reviews your documentation and readiness.
• Stage 2: the auditor tests that controls operate effectively in practice.
• Address any nonconformities, then receive your certificate (valid three years with surveillance audits).

8. Maintain certification

Certification is not a one-off. Annual surveillance audits, continual improvement, and keeping the risk assessment and SoA current keep you certified and — more importantly — actually secure.

How CyberSigma helps

We guide organisations end to end — scoping, risk assessment, control implementation, internal audit and audit support — so you reach certification without the false starts, and sustain it afterwards.