ISO 27001 certification: steps, timeline and who does what

ISO 27001 certification is a two-stage audit by a certification body, followed by a certificate that is valid for three years. During those three years the body returns at least once per calendar year for a surveillance audit. The certificate says your ISMS meets the standard within the scope stated on it, not that your organisation cannot be breached.

Who does what

Accreditation is not a legal requirement for a certification body, but customers and contracting authorities almost always ask for an accredited certificate in practice. The RvA website has a searchable register of accredited bodies, and ISO points to the IAF CertSearch database for certificates worldwide.

The steps

1. Define the scope. Which part of the company, which services and which locations. For a SaaS supplier this is often the platform, the development pipeline and support.
2. Baseline. Where you stand against clauses 4 to 10 and Annex A.
3. Assess and treat risks. Including the Statement of Applicability.
4. Implement controls and let them run. An auditor wants to see controls working, not just described. That takes some time in which evidence builds up.
5. Internal audit and management review. Both should have been carried out at least once before stage 2 makes sense.
6. Choose a certification body. Request quotes, check accreditation and experience with your sector.
7. Stage 1 audit. Review of documentation and readiness.
8. Stage 2 audit. Assessment of how things work in practice.
9. Certification decision. Once any nonconformities are dealt with, the body takes its decision. The three-year cycle runs from that date.

Stage 1

In stage 1 the auditor looks at your documented ISMS: scope, policy, risk assessment, Statement of Applicability, internal audit and management review. They assess whether you understand the requirements of the standard and whether stage 2 can go ahead. Stage 1 often produces points of attention you can pick up before stage 2, which is why there are usually a few weeks between the two stages.

Stage 2

In stage 2 the auditor assesses whether the ISMS works in practice. They talk to people, look at systems and take samples: access reviews, backup tests, handled incidents, changes in the development pipeline. At a software company part of this happens remotely, with screen sharing.

Findings come in two kinds. A major nonconformity means a requirement has not been met, or not effectively; the certificate follows only once you have demonstrably resolved it. A minor nonconformity is an isolated shortcoming; a correction plan the auditor accepts is usually enough.

The three-year cycle

A surveillance audit is shorter than the initial audit and looks at part of the system each time, plus in any case the internal audit, the management review and the follow up of earlier findings. Organisations that go quiet between audits notice it at the first surveillance.

Timeline

There is no guaranteed timeline. For an IT or software company of 10 to 100 people, six months to a year from start to certificate is a common experience. What makes the difference:

• Starting point. A company that already works with code reviews, access management and backup tests mainly needs to record what it does. A company that does not yet do those things has to introduce them first.
• Scope. One product is quicker than the whole company across three offices.
• People's time. Someone with a fixed part of the week for it moves faster than someone doing it on the side.
• The body's schedule. Auditors are not always available at short notice. Ask for dates early.

Choosing a certification body

• Check with the RvA that the body is accredited for ISO/IEC 27001.
• Ask whether the auditors have experience with software companies, SaaS or your sector, for example healthcare if you are also considering NEN 7510.
• Compare quotes on the number of audit days for the whole cycle, not just the first year.
• Ask how the body handles remote audits if your team largely works from home.

What certification costs and which items it involves is covered in the article on cost. Preparation per phase is in the checklist.