ISO 27001 Certification: Requirements, Process and Readiness

What is ISO 27001?

ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). It sets out how to identify risks to your information, choose controls to treat them, and keep checking that those controls work.

The 2022 edition replaced the 2013 version, and the transition period ended on 31 October 2025. Certificates now need to be against the 2022 edition.

Who needs it

Any organisation that handles information others rely on can use ISO 27001. It is most common among:

• Software, SaaS and cloud providers whose customers ask for proof of security.
• Outsourcing, BPO and contact centre operations that process client data.
• Financial, healthcare, legal and professional services firms.
• Suppliers bidding for contracts that list ISO 27001 as a requirement.

Certification shows customers, partners and regulators that security is managed as an ongoing system, not a one-off project. It often shortens security questionnaires during sales, because a valid certificate and its scope answer many questions at once.

The scope can cover the whole organisation or a defined part of it, such as one product or service. A clear, honest scope makes the audit easier and the certificate more meaningful to customers.

What ISO 27001 requires

ISO 27001 has two parts. Clauses 4 to 10 describe the management system:

• Context and scope (clause 4) — which parts of the organisation, locations and systems the ISMS covers.
• Leadership (clause 5) — top management commitment, an information security policy and assigned roles.
• Planning (clause 6) — a repeatable risk assessment and risk treatment process, and measurable security objectives.
• Support (clause 7) — resources, competence, awareness, communication and controlled documents.
• Operation (clause 8) — carry out risk assessments and treatment plans and control changes.
• Performance evaluation (clause 9) — monitoring, internal audit and management review.
• Improvement (clause 10) — nonconformities, corrective action and continual improvement.

Annex A lists 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). You decide which controls apply based on your risk assessment and record that decision in the Statement of Applicability.

Documents and evidence auditors expect

Documented information auditors typically ask for includes:

• ISMS scope (4.3)
• Information security policy (5.2)
• Risk assessment process (6.1.2) and results (8.2)
• Risk treatment process (6.1.3) and results (8.3)
• Statement of Applicability
• Information security objectives (6.2)
• Competence evidence (7.2)
• Operational planning and control (8.1)
• Monitoring and measurement results (9.1)
• Internal audit programme and results (9.2)
• Management review results (9.3)
• Nonconformities and corrective actions (10.2)

For Annex A, auditors look for evidence that selected controls operate: access reviews, training records, asset inventories, supplier agreements, backup and incident logs, and screenshots of system settings.

How the certification process works

Most organisations follow the same path to ISO 27001 certification. The certificate itself is issued by an accredited certification body after its audit — not by CertiFlow and not by a consultant.

• Readiness or gap check — compare what you have today with the requirements and list what is missing.
• Implement and run the system — put the missing documents and controls in place and operate them long enough to produce real records.
• Internal audit and management review — check the system yourself and have top management review its results.
• Stage 1 audit — the certification body reviews your documentation and confirms you are ready for the main audit.
• Stage 2 audit — auditors check that the system is implemented and working in practice, through interviews, observation and records.
• Certification cycle — the certificate is valid for three years, with surveillance audits every year and a recertification audit in year three.

Findings raised at Stage 2 must be addressed before the certificate is issued, which is why closing gaps beforehand matters so much.

How CertiFlow gets you audit-ready

For ISO 27001, CertiFlow checks your ISMS documents against clauses 4–10 and the Annex A controls you select, lists every open task, drafts missing policies and keeps control evidence ready for the auditor.

1. Free pre-certification check — Answer 5 quick questions and get your full questionnaire by email, or choose an AI audit of your documents.
2. AI certification audit — Upload your policies, procedures and forms. AI checks them against the requirements and lists every task still open.
3. Fix the gaps — AI drafts missing policies, procedures and forms so your team reviews and approves instead of writing from scratch.
4. Collect and verify evidence — Keep documents, photos and videos in one place, organised by requirement and checked by AI.
5. Audit day — Everything your auditor needs is verifiable and in one place.

Free pre-certification check

Start with 5 quick questions about your ISO 27001 journey. Receive your full questionnaire by email, or upload policies, SOPs and evidence for an AI pre-certification audit.

Start your free pre-certification check

Frequently asked questions

How long does ISO 27001 certification take?

It depends on your scope, size and existing security practices. Your ISMS must run long enough to complete a risk assessment, operate the selected controls, and hold an internal audit and management review before Stage 2.

What is a Statement of Applicability?

The Statement of Applicability (SoA) lists the Annex A controls, states whether each one is included or excluded, explains why, and shows whether included controls are implemented. It links your risk assessment to the controls you actually use.

Do we need all 93 Annex A controls?

No. You justify inclusions and exclusions in the Statement of Applicability based on your risk assessment. A control can be excluded when it is not relevant to your risks or scope.

Is ISO 27001 the same as SOC 2?

No. ISO 27001 is a certifiable international standard for an information security management system. SOC 2 is an attestation report under AICPA criteria. Many organisations use evidence from one to support the other.

Can AI help us prepare for ISO 27001?

Yes, with preparation. AI can check your policies against the requirements, map evidence to controls, list gaps and draft missing documents. The certification decision stays with an accredited certification body.