ISO 27001 implementation guide: from gap analysis to the certification audit

Before you start: mandate, owner and team

Clause 5.1 puts leadership and commitment on top management. In practice that means three things have to exist before any analysis starts: a sponsor in senior management who will sign the policy and release budget, a named project manager with the authority to chase other departments, and a small team that includes IT, HR, legal or compliance, and the business units inside the likely scope.

Write the business case in the language of the people who approve it. Customers asking for the certificate, a regulator's framework, a tender requirement or a past incident are all reasons management understands. "Best practice" is not.

Gap analysis: where you are against the standard

A gap analysis compares what your organization does today with what ISO/IEC 27001 requires. It is not an audit and it does not have to be formal. Its job is to tell you how big the project is and where the effort will go.

How to run one

1. Fix the provisional scope. You cannot assess everything. Pick the services, sites and systems you expect to certify.
2. Go through clauses 4 to 10 one by one. For each requirement, record whether it is met, partly met or not met, and what evidence exists.
3. Go through the 93 Annex A controls. Note which ones are already in place, even informally. Most organizations are surprised by how much they already do.
4. Talk to people, do not just read documents. A policy on the intranet tells you little. Ask the service desk how access is actually granted.
5. Turn the gaps into a plan. Each gap gets an owner, an effort estimate and a target date.

The usual pattern is strong technical controls and a weak management system. Firewalls, backups and access control are in place. The risk method, internal audit and management review are missing. That is good news, because the missing parts are process work, not purchases.

Plan: scope, risk and the Statement of Applicability

Context, interested parties and scope

Clauses 4.1 and 4.2 ask you to understand the issues that affect your ISMS and the requirements of interested parties: customers, regulators, owners, staff, suppliers. Since the 2024 amendment, clause 4.1 also asks you to determine whether climate change is a relevant issue. Record the answer either way.

Clause 4.3 then asks for a documented scope. This is the first decision the certification body will read. State the services, locations, teams and technology that are inside, and be clear about interfaces with what is outside. A narrow scope is allowed. A vague one is not. If you operate in the EU, set the scope so that it covers the services regulated under NIS 2; the guide to ISO 27001 in the EU explains why.

Policy, roles and objectives

Top management approves an information security policy (clause 5.2) and assigns roles and responsibilities (clause 5.3). Keep the policy short enough that people read it. Then set measurable information security objectives (clause 6.2) and decide how you will track them.

Risk assessment

Clause 6.1.2 asks for a defined risk assessment process: your risk criteria, how you identify risks, how you analyze and evaluate them, and how you make results consistent and comparable. ISO/IEC 27005:2022 gives guidance on doing this and follows the principles of ISO 31000. It is guidance, not a requirement, and you can use any method that meets clause 6.1.2.

Choose criteria that match how your business measures loss: money, downtime, regulatory exposure, customer impact. Then identify risks to the confidentiality, integrity and availability of information within the scope, name an owner for each, and evaluate them against the criteria.

Risk treatment and the Statement of Applicability

Clause 6.1.3 asks you to choose a treatment option for each risk, determine the controls you need, and compare them with Annex A to confirm nothing necessary was left out. The result is the Statement of Applicability: the controls you apply, why you apply them, whether they are implemented, and why you excluded any Annex A control. Risk owners then approve the treatment plan and accept the residual risk.

The controls themselves are explained in ISO/IEC 27002, and ISO 27001 vs ISO 27002 covers how the two relate. The requirements for ISO 27001 certification lists what the standard needs overall.

Do: documents, controls and people

Documented information

Clause 7.5 asks for the documented information the standard requires, plus whatever you decide you need for the ISMS to work. The standard does not ask for a manual or for a fixed number of procedures. It does ask for the items below. Check this list against your copy of the standard, because wording matters in an audit.

Implementing the controls

Work through the risk treatment plan in priority order. For each control, decide who owns it, how it operates, and what record shows that it operated. A control with no evidence does not exist as far as an audit is concerned. Use what you already have: your ticketing system, HR system and logs produce most of the records you need.

Competence, awareness and communication

Clauses 7.2 to 7.4 cover people. Those doing work that affects information security must be competent, and you need evidence of it. Everyone in scope must know the policy, how they contribute and what happens if they do not follow it. Run awareness in short sessions tied to real incidents, and keep attendance records.

Operation

Clause 8 is where the plans run. Carry out risk assessments at planned intervals and when significant changes happen, and keep the results. Control changes and outsourced processes. This is the phase that takes longest, because it depends on other teams doing things differently.

Check: measure, audit, review

Monitoring and measurement

Clause 9.1 asks you to decide what to monitor and measure, how, when and who analyzes the results. Pick a handful of measures that tell you whether controls work, such as time to revoke access for leavers or the share of critical patches applied on time. Avoid measuring what is easy just because it is easy.

Internal audit

Clause 9.2 requires internal audits at planned intervals, run by auditors who are objective and impartial. That means people do not audit their own work. The internal audit must cover the ISMS before the certification audit, and it is the cheapest rehearsal you will get. Findings here are a gift: you can fix them before an external auditor sees them.

Management review

Clause 9.3 requires top management to review the ISMS at planned intervals. The standard lists what the review must consider, including the status of earlier actions, changes in issues and interested-party needs, performance trends, audit results, risk assessment results and opportunities for improvement. Keep minutes with decisions, not just a slide deck.

Act: fix the causes and keep improving

Clause 10.2 covers nonconformities. When something does not meet a requirement, you correct it, find the cause, decide whether action is needed to stop it happening again, take that action and check that it worked. Record all of it. Clause 10.1 then asks you to keep improving the suitability, adequacy and effectiveness of the ISMS.

The trap is fixing the symptom. If access was not revoked for a leaver, removing that one account is a correction. Finding out why HR did not tell IT, and changing the process, is corrective action. Auditors look for the second.

How long it takes, and what it costs

There is no standard timeline, and anyone who quotes one without asking about your scope is guessing. Four things move it: the size and complexity of the scope, the number of sites, how many controls already operate, and how much time management and other departments give the project. A narrow scope in an organization with mature IT processes moves quickly. A whole-company scope across several countries does not.

Cost follows the same drivers, plus the certification body's audit days. What ISO 27001 certification costs breaks down where the money goes, and whether ISO 27001 certification is worth it helps you make the case internally.

One way to shorten the project is to start with the minimum the standard requires for a sensible scope, get certified, and widen the scope and deepen the controls through continual improvement. That is what the standard expects you to do anyway.

Where implementations go wrong

• Starting with documents. Buying a template pack and filling it in produces paper, not a management system. Start with scope and risk.
• A scope nobody can draw. If you cannot sketch what is inside and outside on one page, the auditor cannot audit it.
• A copied risk method. A scoring scale borrowed from a template gives results nobody in the business believes.
• Controls with no owner. Every control needs a named person and a record. Shared ownership means no ownership.
• Leaving the internal audit to the end. It needs time to be done properly and time to act on.
• Treating certification as the finish. Surveillance audits check that the ISMS still runs. Systems built only to pass decay within a year.

Who should lead the project, and how to prepare them

The project manager does not need to be the most technical person in the room. They need to understand the standard, be able to run a risk assessment, and have enough standing to get other departments to act. That is the profile the PECB ISO 27001 Lead Implementer course is built for, and it follows the same order as this guide. The person who will run your internal audits is better served by the Lead Auditor course. ISO 27001 Lead Implementer vs Lead Auditor compares the two.

With reconn, every enrollment comes with a 1-on-1 session with a PECB Certified Trainer and email and WhatsApp support until you clear the exam, within 12 months of enrollment. I am your mentor, and you can bring your own project to those conversations. If you are in the Gulf, the guide to ISO 27001 courses in the Middle East covers the local regulations and how to buy.

For people aiming beyond the ISMS toward a head-of-security role, reconn also puts together the PECB CISO, the ISO 27001 Lead Implementer and the ISO 42001 Lead Implementer as one package.