ISO 27001 is the internationally recognized standard for establishing, implementing, maintaining, and continually improving an Information Security Management System. This checklist guides organizations of any size through the certification process, from initial scoping through the Stage 2 certification audit and beyond. Whether you are pursuing ISO 27001 to meet customer requirements or strengthen your security posture, this structured approach will help you achieve certification efficiently.
Work through each phase in order. Most organizations complete this checklist in 6-12 months for first-time certification; 2-3 months for surveillance audits.
7 items in this phase
Determine which business units, locations, systems, and processes will be included in the ISMS scope. Consider customer requirements, regulatory obligations, and organizational context when setting boundaries.
Obtain formal commitment from top management including budget allocation, resource assignment, and a signed information security policy. ISO 27001 requires demonstrated leadership involvement.
Identify internal and external issues relevant to your ISMS, determine the needs and expectations of interested parties, and document how these factors influence your information security objectives.
Assess your current information security posture against all ISO 27001 clauses (4-10) and Annex A controls. Identify gaps and prioritize remediation based on risk and effort required.
Research and select an accredited certification body. Consider their experience in your industry, availability, pricing, and reputation. Confirm they are accredited by a recognized accreditation body.
Assemble a cross-functional implementation team and develop a detailed project plan with milestones for documentation, control implementation, internal auditing, and the certification audit.
Create a comprehensive register of all information assets including data, hardware, software, personnel, and facilities. Assign ownership and classify assets according to their value and sensitivity.
12 items in this phase
Draft an overarching ISMS policy that sets the direction for information security and defines measurable security objectives aligned with business goals. Ensure the policy is communicated to all relevant parties.
Implement a risk assessment methodology, identify information security risks, analyze likelihood and impact, and evaluate risks against your risk acceptance criteria. Document the complete risk register.
For each identified risk above the acceptance threshold, select an appropriate treatment option (mitigate, transfer, avoid, or accept). Map treatments to specific Annex A controls and assign implementation ownership.
Produce a Statement of Applicability listing all Annex A controls, indicating which are applicable and which are excluded with justification. This is a mandatory document and a key audit artifact.
Establish access control procedures based on business and security requirements. Implement user access management, system authentication, and privilege management aligned with the principle of least privilege.
Create an information security incident management process covering detection, reporting, assessment, response, and lessons learned. Define severity levels and escalation procedures.
Define information security requirements for supplier relationships. Assess supplier risks, include security clauses in contracts, and monitor supplier compliance with your requirements.
Develop business continuity plans that address information security aspects. Define recovery objectives, implement redundancy measures, and establish procedures for operating during disruptions.
Implement physical security controls including secure areas, equipment protection, and environmental controls to prevent unauthorized access, damage, and interference to information processing facilities.
Create all mandatory procedures required by ISO 27001 including document control, internal audit, corrective action, and management review. Ensure document formats and version control meet the standard.
Implement a security awareness program ensuring all personnel understand the ISMS policy, their role in information security, and the consequences of non-compliance. Maintain training records.
Define and implement a cryptographic policy covering encryption standards, key management procedures, and acceptable use of cryptographic techniques for protecting information.
6 items in this phase
Perform a comprehensive internal audit covering all ISO 27001 clauses and applicable Annex A controls. Use qualified internal auditors or engage external support. Document findings and nonconformities.
Conduct a formal management review meeting covering audit results, risk assessment status, security incidents, performance metrics, and opportunities for improvement. Document minutes and decisions.
Address all nonconformities and observations from the internal audit. Implement corrective actions, perform root cause analysis, and verify the effectiveness of corrections.
Organize all ISMS documentation for review by the certification body. The Stage 1 audit verifies that your documentation meets ISO 27001 requirements and identifies any areas needing attention before Stage 2.
Undergo the on-site Stage 2 audit where the certification body verifies that your ISMS is implemented and operating effectively. Demonstrate that controls are functioning and evidence is being collected.
Remediate any major or minor nonconformities identified during the Stage 2 audit within the certification body's specified timeframe. Provide evidence of corrective actions to obtain certification.
5 items in this phase
Prepare for and complete annual surveillance audits conducted by the certification body. These audits verify ongoing conformity and typically cover a subset of the ISMS each year.
Continuously update the risk register as new threats emerge, controls change, or the business environment evolves. Review risk treatment effectiveness and adjust controls accordingly.
Implement a continual improvement process using corrective actions, preventive actions, and management review outputs to systematically enhance the ISMS effectiveness over time.
Review and update the SoA when controls are added, modified, or removed. Ensure justifications for excluded controls remain valid and new Annex A controls from standard revisions are addressed.
Plan for the full recertification audit at the end of the three-year certification cycle. Conduct a comprehensive internal audit, management review, and pre-assessment to ensure readiness.
6-12 months for first-time certification; 2-3 months for surveillance audits
$30,000-$200,000 depending on organization size, scope, and certification body
First-time ISO 27001 certification typically takes 6-12 months, depending on your organization's size, complexity, and existing security maturity. Organizations with established security programs may achieve certification in as little as 4-6 months, while larger enterprises or those starting from scratch may need 12-18 months.
Total costs range from $30,000 to $200,000 or more. This includes certification body fees ($10,000-$50,000), consultant fees ($15,000-$80,000), compliance tooling ($5,000-$30,000/year), internal resource time, and potential infrastructure upgrades. Ongoing annual costs for surveillance audits and maintenance typically run $10,000-$30,000.
ISO 27001 is an international standard resulting in a formal certification valid for three years, while SOC 2 is an attestation report issued by a CPA firm covering a specific observation period. ISO 27001 is prescriptive about building an ISMS, while SOC 2 is criteria-based. Many organizations pursue both, as ISO 27001 is preferred internationally and SOC 2 is standard in North America.
The Statement of Applicability (SoA) is a mandatory ISO 27001 document that lists all Annex A controls and indicates whether each is applicable or excluded, with justification for exclusions. It serves as a bridge between your risk assessment and the specific controls you have implemented and is one of the first documents auditors review.
While not required, most organizations benefit from consulting support, especially for first-time certification. A consultant can accelerate the process, help avoid common mistakes, and provide templates and guidance based on experience with the certification body's expectations. However, your internal team must own the ISMS to demonstrate genuine commitment during the audit.
Surveillance audits occur annually between certification cycles and verify that your ISMS continues to operate effectively. Auditors review a subset of controls and clauses each year, check corrective actions from previous audits, and look for evidence of continual improvement. They are shorter and less intensive than the initial certification audit.
Yes, you can define the ISMS scope to cover specific business units, locations, or services rather than the entire organization. However, the scope must be clearly defined, interfaces with out-of-scope areas must be managed, and the scope should make sense from a risk perspective. Auditors will challenge artificially narrow scoping that excludes areas that clearly affect information security.
PoliWriter creates all the policies referenced in this checklist, customized to your organization. AI-powered, audit-ready, hours not months.
Get Started Free