An ISO 27001 Readiness Guide: What Certification Actually Requires

ISO 27001 certification is achievable for organisations of any size, but most organisations underestimate the operational work involved. It's not a document-writing exercise, it's building an information security management system (ISMS) that actually runs.

What certification actually requires

An ISMS covering risk assessment, a defined set of controls (from Annex A or an equivalent control set), documented policies, and, critically, evidence that the controls are actually operating, not just documented. Certification bodies audit for evidence of ongoing practice, not policy documents in isolation.

A realistic sequence

• Scope definition. Decide what's actually in scope: the whole organisation, or a specific product/service line. Narrower scope is often the right call for a first certification.
• Gap assessment. Compare current practice against ISO 27001's requirements to find out how far there is to go.
• Risk assessment. A formal, documented process for identifying and treating information security risks. This is a core requirement, not optional supporting documentation.
• Control implementation. Building out the technical and organisational controls the risk assessment and standard call for.
• Internal audit. Testing your own ISMS before the certification body does.
• Certification audit. Conducted by an accredited certification body, typically in two stages.

Where organisations underestimate the work

The most common miscalculation is treating this as a documentation project: writing policies that describe an ideal state rather than actual practice. Auditors ask for evidence: access review records, incident logs, training completion records. If the policy says access is reviewed quarterly and there's no record of it happening, that's a finding.

The second most common issue is scoping too broadly for a first certification, which multiplies the amount of evidence needed across every corner of the organisation rather than the part that actually needs to demonstrate maturity.

Do you need ISO 27001, or is alignment enough?

Certification matters when a customer or contract explicitly requires it. If nothing is forcing formal certification, many organisations get real security value from aligning to ISO 27001's control set without pursuing the certification audit itself, a lighter-weight path worth considering before committing to full certification.