the whole job

ISO 27001: the whole job, in order

Customers ask for an ISO 27001 certificate in security questionnaires, and some tenders do too. A certificate shows that an auditor looked at your security management system, within a scope you chose, at a point in time. It does not show compliance with a law. This plan takes you from the decision to certify to the yearly cycle, in six stages.

last checked 2 November 2026

how to read this plan

ISO 27001 is a standard for running security as a management system, so most steps set up rules, owners and checks that repeat. The standard is paid and was not read for this plan, which is why every step says practice and no clause is cited: check the clause and control numbers against your licensed copy. Where a step also feeds a law such as NIS2, the step says so and links the work page, and the basis stays practice because the certificate does not make you compliant. The order follows dependencies. Under each step a small note names the basis.

  • decide and documentchoices, policies and records that someone with authority signs
  • build and configuresystems, settings and procedures that make the choice real
  • prove and operatechecks, logs and records that show it keeps working
01

decide whether to certify, and what for

Find out who needs the certificate, what they would accept instead and which part of the company it should cover.

  1. ask who requires the certificate

    Ask the customers and tenders that raised it whether they require a certificate or would accept a description of your controls, a questionnaire answer or an audit report. Record each answer with the date. No EU rule on this site requires the certificate.

    • owner board
    • decide and document
    what it produces
    a short list of customers, what each asked for and what each would accept
    the proof it leaves
    the list, with the source of each answer

    the work page

    basis working practice. No legal text sets this.

  2. set the scope in writing

    Decide which products, sites, teams and systems the certificate covers, and write down what is out. A certificate covers only its scope, so choose the part that customers actually ask about.

    • owner board
    • decide and document
    what it produces
    a scope statement that names what is in and what is out
    the proof it leaves
    the statement, approved by management

    basis working practice. No legal text sets this.

  3. name who answers for the system

    Name one accountable owner at management level and one operational lead, and give them time and a budget line. If NIS2 covers you, management already answers for the security measures, and this decision can be the same one.

    • owner board
    • decide and document
    what it produces
    a decision naming the accountable owner and the operational lead
    the proof it leaves
    the minutes of that decision

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show a board decision to certify or not, the customers behind it and a written scope.
02

check where you stand

Compare what you do today with what the standard asks, and turn the differences into a list of work.

  1. get a licensed copy and read it

    Buy the standard from the publisher or a national standards body, and give it to the operational lead and to whoever will advise. This plan did not read it, so every clause and control number you use should come from your copy.

    • owner head of IT
    • build and configure
    what it produces
    a licensed copy held by the people doing the work
    the proof it leaves
    the purchase record

    basis working practice. No legal text sets this.

  2. compare your practice with the standard

    Go through the standard with the people who run the systems, and mark what you already do, what you do in part and what is missing. Keep to the scope you wrote. The work you did for laws such as NIS2 will cover a good part of it.

    • owner head of IT
    • prove and operate
    what it produces
    a gap list with the finding, the owner and the proof you already hold
    the proof it leaves
    the gap list, dated and signed by the operational lead

    basis working practice. No legal text sets this.

  3. order the gaps into one plan of work

    Put the gaps in the order in which they depend on each other, give each an owner and a date, and decide what you will accept for now. Management approves the plan, so that the work has authority behind it.

    • owner board
    • decide and document
    what it produces
    an ordered plan of work with owners and dates
    the proof it leaves
    the plan, approved by management

    basis working practice. No legal text sets this.

you are done with this phase when you can show a gap list with an owner and an order of work for each item.
03

build the management system

Write the rules, run the risk work and put the controls in place for everything inside the scope.

  1. write the security policy and the roles

    Write a short security policy that management signs, and list who decides and who carries what. NIS2 asks for policies on risk analysis and information system security, and the same document can serve both.

    • owner board
    • build and configure
    what it produces
    a signed security policy and a table of roles
    the proof it leaves
    the policy with its version and approval, and the table

    the work page

    basis working practice. No legal text sets this.

  2. keep a register of assets and owners

    List the systems, data and suppliers inside the scope, with an owner for each. Assets you cannot list are assets you cannot protect or put in front of an auditor.

    • owner head of IT
    • build and configure
    what it produces
    an asset register with an owner for each item
    the proof it leaves
    the register, with the date of its last review

    the control: asset-inventory

    basis working practice. No legal text sets this.

  3. run the risk assessment and decide what to treat

    Assess the risks to what is inside the scope, decide which you will reduce, accept or hand to someone else, and record who accepted what. State a method once and apply it the same way each time.

    • owner head of IT
    • build and configure
    what it produces
    a risk register with a treatment decision for each risk
    the proof it leaves
    the register and the sign-off for accepted risks

    the work pagethe control: risk-register

    basis working practice. No legal text sets this.

  4. put the controls in place and record them

    Build or fix the controls that the gap list and the risk register call for, and write down for each what it does and who runs it. Several of these, such as access control, backup and incident handling, also serve laws like NIS2.

    • owner head of IT
    • build and configure
    what it produces
    controls running for the scope, with a one-page description of each
    the proof it leaves
    the descriptions and the settings or records that show each one working

    the work pagethe control: privileged-access

    basis working practice. No legal text sets this.

  5. bring suppliers and people into scope

    Sort the suppliers that touch the scope by what they can reach, ask the critical ones about their security and put terms in the contract. Train the people inside the scope on the policy and keep the record.

    • owner procurement
    • build and configure
    what it produces
    a supplier register with contract terms, and a training record
    the proof it leaves
    the register, the answers received and the attendance record

    the work pagethe control: supplier-management

    basis working practice. No legal text sets this.

you are done with this phase when you can show the policies, the risk register and the controls running for the whole scope.
04

audit yourself and review with management

Check that the system runs as written, and put the results in front of management.

  1. audit the system from inside

    Have someone who did not build the system check, against your own rules and the standard, that each part of the scope runs as written. Plan the audit, keep notes and write a report with findings.

    • owner everyone
    • prove and operate
    what it produces
    an internal audit plan and report with findings
    the proof it leaves
    the report, dated, with the auditor named

    basis working practice. No legal text sets this.

  2. fix the findings and record the fix

    For each finding, decide the fix, an owner and a date, and record when it was done. Fix the cause as well as the symptom, so that it does not return next year.

    • owner head of IT
    • build and configure
    what it produces
    a corrective action list with owners and dates
    the proof it leaves
    the list, with each item closed or dated

    basis working practice. No legal text sets this.

  3. hold the management review

    Put the audit result, the risk picture, incidents and open gaps in front of management, and record what they decide. The standard asks for this review, so check its inputs against your copy.

    • owner board
    • prove and operate
    what it produces
    a management review record with decisions and actions
    the proof it leaves
    the record and the minutes

    the work page

    basis working practice. No legal text sets this.

you are done with this phase when you can show an internal audit report, a management review record and a list of corrective actions.
05

pass the external audit

Choose a certification body, go through its audit and deal with what it finds.

  1. choose a certification body and check its accreditation

    Ask each candidate which accreditation it holds for this standard, from which accreditation body, and check the answer with that body. Ask what the audit covers and how it proceeds, and get the answers in writing.

    • owner procurement
    • decide and document
    what it produces
    a chosen certification body and its accreditation scope
    the proof it leaves
    the written answers and the accreditation check

    basis working practice. No legal text sets this.

  2. prepare the evidence and the people

    Gather the policy, the registers, the audit report, the review record and the control evidence in one place organised by what the standard asks, and brief the people who will be interviewed. An evidence map helps.

    • owner everyone
    • prove and operate
    what it produces
    an evidence folder and a list of interviewees
    the proof it leaves
    the folder, with each item dated

    the work page

    basis working practice. No legal text sets this.

  3. go through the audit and answer the findings

    Give the auditor access, answer what is asked and note every finding. For each, agree the fix with the certification body and carry it out in the time it sets.

    • owner everyone
    • prove and operate
    what it produces
    the audit report, the finding responses and the fixes
    the proof it leaves
    the report, the responses and the closing records

    basis working practice. No legal text sets this.

  4. read the certificate and say what it covers

    Check the scope, the dates and the issuer printed on the certificate, and use them as written when you answer a customer. Say plainly what it covers and what it does not, and do not describe it as compliance with a law.

    • owner legal or DPO
    • decide and document
    what it produces
    a short statement of what the certificate covers, for sales and legal
    the proof it leaves
    the certificate and the statement

    basis working practice. No legal text sets this.

you are done with this phase when you can show a certification body's decision and the scope it states.
06

keep it alive each year

Run the system through the year, repeat the audit and review, and meet the certification body's follow-up.

  1. ask what follows the certificate

    Ask the certification body what it checks after the certificate is issued, how often and what happens if findings stay open. Put the dates in the same calendar as your own audit and review.

    • owner procurement
    • decide and document
    what it produces
    a calendar of the body's follow-up and your own internal dates
    the proof it leaves
    the written answer and the calendar

    basis working practice. No legal text sets this.

  2. repeat the internal audit and the review

    Run the internal audit and the management review again on a fixed rhythm, with fresh evidence. Re-run the risk assessment when the scope, the systems or the threats change.

    • owner everyone
    • prove and operate
    what it produces
    a yearly internal audit and management review
    the proof it leaves
    the reports and the minutes, dated

    basis working practice. No legal text sets this.

  3. change the scope on purpose

    When the company adds a product, a site or a supplier, decide whether it joins the scope and tell the certification body. If a customer later asks for more, widen the scope by decision, with a plan.

    • owner board
    • decide and document
    what it produces
    a scope change decision with its reason
    the proof it leaves
    the decision and the notice to the body

    basis working practice. No legal text sets this.

you are done with this phase when you can show a second internal audit and management review, and the body's follow-up outcome.

who carries what

The same steps, grouped by the person who has to act.

board

head of IT

procurement

everyone

legal or DPO

controls you will need

Each control has its own page: what it is, what to look for, where it goes wrong and the proof it leaves.

    check it yourself

    your next step

    Ask your three largest customers whether they require a certificate or would accept your evidence, and write the answers down before you scope anything.

    open the map