ISO/IEC 27001:2022
ISO 27001 certification, from scope statement to certificate
In short
ISO/IEC 27001 is the international standard for an information security management system (ISMS). An accredited certification body audits it in two stages and issues a certificate valid for three years, with surveillance audits in years one and two. It certifies the management system (your scope, risk treatment, controls and the evidence that they operate), not your product.
8–12 wks
to audit-ready with a Lead Implementer
93
Annex A controls in the 2022 edition
3 years
certificate validity, audited every year
2 stages
to the first certificate
What ISO 27001 actually certifies
ISO/IEC 27001 is a certifiable standard for an information security management system. The certificate is not awarded for having good security tools. It is awarded for running a management system: a documented, repeating cycle of scoping, risk assessment, control selection, implementation, internal audit, management review and improvement.
That is why it feels heavier than SOC 2 to first-time teams. You are assessed on governance discipline as well as technical controls. The upside is a genuine certificate, issued by an accredited body and recognised internationally, that a buyer can verify.
A narrow, honest scope statement is the single most important decision in the project. It determines which systems, people and locations the auditor examines, and therefore how much work the whole programme is.
Progress rolls up the control tree, from the management-system clauses to each Annex A theme. Illustrative data.
Who needs ISO 27001
ISO 27001 is what buyers in Europe, the UK, the Middle East and much of APAC and India ask for, in the way US buyers ask for SOC 2. Public-sector tenders and regulated industries often require it outright. If you sell internationally, you will usually end up holding both, which is why it pays to build them on one control library.
- SaaS and services companies selling into European, UK or APAC enterprises
- Suppliers to banks, insurers, healthcare and government
- Companies whose customers must assess their own supply chain under NIS2 or DORA
- Teams planning ISO 42001 for AI, which shares ISO 27001’s structure
The documents the auditor reads first
Scope statement (clause 4)
Risk assessment and treatment (clause 6.1)
Statement of Applicability (6.1.3)
Policies and records (clauses 5 to 10)
Two activities are mandatory before certification and are often left too late: an internal audit (clause 9.2), carried out by someone objective who did not build the controls, and a management review (clause 9.3), where leadership looks at the ISMS and records its decisions. The certification body expects both to have happened before Stage 2.
The Statement of Applicability
The Statement of Applicability (SoA) lists all 93 Annex A controls in the 2022 edition, grouped into four themes: organisational, people, physical and technological. For each one it records whether the control applies, why, and how it is implemented.
It is the document auditors scrutinise most. An SoA that lists controls without justifying exclusions is one of the most common Stage 1 findings. “Not applicable” is an acceptable answer, but only with a reason that follows from your risk assessment and scope.
In Certifyi the SoA is generated from the control tree, so it always matches what you have actually implemented and evidenced. Read more in what a Statement of Applicability is.
Each row carries its justification, so an exclusion explains itself instead of inviting a Stage 1 finding. Illustrative data.
Risk assessment and treatment
ISO 27001 is risk-driven: the controls you select exist to treat the risks you identified. The standard asks for a repeatable method, a register with owners, and a treatment decision for every risk: modify it with controls, avoid it, share it, or accept it with approval.
Score risks before and after treatment, so the register shows what your controls actually bought you. When the board asks what a risk is worth in money rather than colour, Certifyi adds Monte Carlo loss modelling, which produces a range with a confidence profile that finance can work with.
Risk acceptance above your appetite needs a second person to approve it, and acceptances expire, so a decision made two years ago doesn’t quietly remain your position.
Inherent and residual scores side by side show what each treatment achieved. Illustrative data.
The path to certification
With a Lead Implementer running weekly sessions, Certifyi customers are audit-ready in 8 to 12 weeks. The certification body then schedules Stage 1, typically within a few weeks, and issues the certificate after a clean Stage 2.
1
Weeks 1–2
Scope and risk
Scope statement, asset inventory, risk method, risk assessment and a first treatment plan.
2
Weeks 3–8
Controls and policies
Annex A controls selected in the SoA, policies adopted and acknowledged, integrations collecting evidence on a schedule.
3
Weeks 9–12
Internal audit and review
Internal audit by someone objective, management review, and findings tracked to closure.
4
Then
Certification audit
Stage 1 documentation review, then Stage 2 implementation audit. The auditor works in their own workspace on your record.
Stage 1 and Stage 2
| Stage 1 | Stage 2 | |
|---|---|---|
| Purpose | Is the ISMS designed, and are you ready for Stage 2? | Does the ISMS operate as documented? |
| What happens | Documentation review: scope, risk method, SoA, policies, internal audit and management review | Interviews, sampling and evidence across the controls in scope |
| Typical effort | Usually one to two auditor-days | Usually two to five auditor-days, depending on scope |
| Outcome | Areas of concern to fix before Stage 2 | Recommendation for certification, or nonconformities to close first |
Findings are raised as minor or major nonconformities rather than as a pass or fail. A major nonconformity must be corrected, with a root-cause analysis and evidence of the fix, before the certificate is issued. Commonly, four to eight weeks separate Stage 1 and Stage 2, which is enough time to close findings and build up operating evidence. See Stage 1 vs Stage 2 for what each visit samples.
The three-year cycle
A certificate is not a single event. It is a full audit, two shorter surveillance visits in years one and two, then a recertification audit in year three that looks at the whole system again. Surveillance visits sample part of the ISMS, so the controls outside this year’s sample still have to operate.
Certifyi works out where you are in the cycle from the engagements that exist, and shows it two ways: a plain-language cycle map for you, and the ISO/IEC 17021-1 terms the certification body uses directly below it. Because findings, evidence and scope attach to engagements, the next auditor can see what was raised, what was fixed and who verified it.
Read how a surveillance audit and a recertification audit work.
Where you are in the cycle, and what the next visit will sample. Illustrative data.
ISO 27001 and SOC 2
| ISO 27001 | SOC 2 | |
|---|---|---|
| Output | Certificate | Auditor’s attestation report |
| Issued by | Accredited certification body | Licensed CPA firm |
| Validity | Three years, with annual surveillance | Covers a stated period, usually refreshed each year |
| Strongest in | Europe, UK, APAC, India, the Middle East | United States |
| Emphasis | Management system and governance | Controls operating against the criteria |
They overlap heavily on controls and differ on structure and geography. If you hold a SOC 2 report, most of the control work carries over: access control, change management, logging, vendor management and incident response satisfy both. What ISO 27001 adds is the management-system layer. In Certifyi both frameworks read from one control library, so the second one is a mapping exercise rather than a second project.
How Certifyi helps
A real ISMS, run with people who have done this before
Lead Implementers on your programme
The management system keeps running
One control library
The auditor works inside the platform
Go deeper
ISO 27001 guides from the compliance team
Understand
What is a Statement of Applicability?
Read →
Understand
Stage 1 vs Stage 2 audit
Read →
Understand
ISO 27001:2022 changes
Read →
Questions
ISO 27001, answered
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system. An accredited certification body audits the system in two stages and issues a certificate valid for three years, with surveillance audits in between.
What’s the fastest way to get audit-ready?
Scope narrowly, work from a proven control library, connect your systems early so evidence builds up, book the auditor in week two and have one named person drive it weekly. Most teams are audit-ready in 8 to 12 weeks that way. Read the full answer.
How long does ISO 27001 take with Certifyi?
Most teams are audit-ready in 8 to 12 weeks with a Lead Implementer running weekly sessions. The certification body’s Stage 1 and Stage 2 audits then follow, depending on their schedule.
Who issues the ISO 27001 certificate?
An accredited certification body, accredited by a national body such as UKAS or ANAB. Consultants and software vendors cannot certify you. Certifyi coordinates the certification body and hosts the audit in its auditor workspace.
Do we need all 93 Annex A controls?
No. You select the controls that treat your risks and justify each exclusion in the Statement of Applicability. Weak justifications are one of the most common Stage 1 findings.
Do we need an internal audit before certification?
Yes. Clause 9.2 requires an internal audit programme, and the certification body expects at least one internal audit and one management review before Stage 2. The internal auditor must be objective, so it cannot be the person who built the controls.
How long is the certificate valid?
Three years, with a surveillance audit in each of the two intervening years and a recertification audit in year three.
What happens if Stage 2 finds a major nonconformity?
Certification waits until it is fixed. You submit a root-cause analysis and corrective action, and the auditor verifies it, sometimes with a short follow-up visit, before recommending certification.
Is ISO 27001 harder than SOC 2?
It is more prescriptive about governance: internal audit and management review are mandatory. The technical control overlap with SOC 2 is substantial, so doing both on one control library avoids paying twice.
Can a small team get ISO 27001?
Yes. The standard scales to the organisation: a 20-person company documents a smaller scope, fewer assets and simpler processes. What it cannot skip is the management system itself.
Does Certifyi issue the certificate?
No. Certifyi builds and runs your ISMS with you and gets you ready for Stage 1 and Stage 2. The certificate comes from your accredited certification body.