{"head":{"title":"What Does ISO 27001 Involve? Certification Step by Step","description":"ISO 27001 involves running an information security management system, choosing controls from Annex A by risk, and passing an audit by a certification body.","canonical":"https://oceanlab.in/questions/what-does-iso-27001-involve"},"crumbs":[{"name":"Home","path":"/"},{"name":"Questions","path":"/questions"},{"name":"What does ISO 27001 involve?","path":"/questions/what-does-iso-27001-involve"}],"question":"What does ISO 27001 involve?","answer":["ISO/IEC 27001 involves setting up and running an information security management system (ISMS): you assess your security risks, choose controls to treat them, write a Statement of Applicability, and keep the system running with internal audits and management reviews. Certification then comes from an accredited certification body that audits you."],"sections":[{"heading":"The main steps","body":[],"bullets":[["Set the scope: which parts of the business, products and locations the ISMS covers."],["Run a risk assessment and decide how to treat each risk."],["Compare your controls with the reference set in Annex A, and record which apply, and why, in a Statement of Applicability."],["Put the controls in place and keep evidence that they work."],["Run internal audits and management reviews, and fix what they find."],["Pass the certification audit, then annual surveillance audits and a recertification audit every few years."]]},{"heading":"What the 2022 version changed","body":[["ISO/IEC 27001:2022 replaced the 2013 edition. Its Annex A follows ISO/IEC 27002:2022, which has 93 controls in 4 groups instead of 114 in 14, with 11 new controls. The deadline for certified organisations to move to the 2022 version was 31 October 2025, after which 2013 certificates expired or were withdrawn."]],"bullets":[]},{"heading":"Where the software comes in","body":[["Many controls touch the product: access control and least privilege, secure development, logging and monitoring, backups, encryption, supplier management and change management. Building these into the product and the delivery pipeline makes the audit evidence a by-product of normal work."]],"bullets":[]}],"faqs":[{"question":"ISO 27001 or SOC 2: which do we need?","answer":"Whichever your buyers ask for. US buyers often ask for SOC 2; buyers in Europe and Asia often ask for ISO 27001. The control work overlaps a lot."},{"question":"Does every Annex A control have to be implemented?","answer":"No. You decide by risk and justify any exclusions in the Statement of Applicability. The auditor checks that the reasoning holds up."},{"question":"Can a vendor's certificate cover us?","answer":"No. A supplier's certificate covers the supplier's ISMS. It helps your supplier management, but you need your own ISMS and audit."}],"terms":[{"href":"/glossary/soc-2-type-ii","label":"SOC 2 Type II"},{"href":"/glossary/total-cost-of-ownership","label":"total cost of ownership"}],"tools":[{"href":"/tools/soc-2-checklist","label":"SOC 2 checklist","detail":"Free tool"}],"links":[{"href":"/compliance/soc-2","label":"SOC 2 guide","detail":"The controls behind a SOC 2 report."},{"href":"/compliance","label":"Compliance guides","detail":"What each rule means for the software you build."}],"related":[{"href":"/questions/do-i-need-soc-2","label":"Do I need SOC 2?","detail":"Question"},{"href":"/questions/what-is-dora-for-fintech","label":"What is DORA for fintech?","detail":"Question"},{"href":"/questions/what-is-a-reasonable-sla","label":"What is a reasonable SLA?","detail":"Question"},{"href":"/compare/ai-agent-vs-workflow-automation","label":"AI agent vs workflow automation","detail":"Comparison"},{"href":"/compare/rag-vs-fine-tuning","label":"RAG vs fine-tuning","detail":"Comparison"},{"href":"/glossary","label":"Glossary","detail":"Every term, in plain words."}],"sources":[{"title":"IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022","url":"https://iaf.nu/iaf_system/uploads/documents/IAF_MD26_Issue_2_15012023.pdf","checkedAt":"2026-10-25"}],"legal":true,"updatedAt":"2026-10-25"}