Build Your Information Security Management System,
Then Seek Independent Certification
To achieve ISO 27001 certification, your organisation
needs to establish, operate and maintain an information
security management system, then have it assessed by
an independent certification body.
An ISMS provides a structured approach to protecting
the confidentiality, integrity and availability of
information. It connects risk assessment, controls,
responsibilities and evidence with ongoing review
and improvement.
The starting point is understanding the information
your organisation needs to protect and the activities,
people, systems and suppliers involved.
Start With the Applicable Standard
Use ISO/IEC 27001:2022 together with Amendment 1:2024.
Obtain the standard and make sure the people responsible
for implementation understand its requirements.
ISO/IEC 27001 contains the requirements for the ISMS.
ISO/IEC 27002 provides supporting guidance on
information security controls.
Define your approach around your organisation’s
context and risks. A collection of policies or
security tools alone does not constitute a
functioning management system.
1. Define the Scope and Responsibilities
Decide which activities, services, locations and
information are included in the ISMS. Identify
boundaries and dependencies, including outsourced
activities and shared systems.
- What information needs protection?
- Which products and services are within scope?
- Who owns the relevant processes and decisions?
- Which customers and other interested parties
have relevant requirements? - Which legal and contractual obligations apply?
- What resources and competence are needed?
Leadership needs to support the system, assign
responsibilities and ensure that information security
is integrated with the organisation’s work.
2. Assess Information Security Risks
Establish a consistent method for identifying,
analysing and evaluating information security risks,
including criteria for accepting them.
Consider how information could be disclosed,
changed, lost or made unavailable, and the consequences
for your organisation and the people who depend on it.
- Identify relevant information, processes and dependencies.
- Describe credible risks and their consequences.
- Assign risk owners.
- Evaluate existing controls.
- Determine which risks need treatment.
- Retain the assessment and its supporting reasoning.
Review the assessment when significant changes,
incidents or other new information affect the
organisation’s exposure.
3. Select Controls and Prepare Your Statement of Applicability
Determine the controls needed to treat the identified
risks. Compare them with Annex A to check that
necessary controls have not been overlooked.
Annex A of ISO/IEC 27001:2022 contains 93 reference
controls across organisational, people, physical
and technological themes.
This is not a requirement to apply every control
indiscriminately. Selection needs to reflect your
risks and applicable requirements. Necessary controls
may also come from outside Annex A.
Your Statement of Applicability should identify
the necessary controls, explain their inclusion,
record whether they are implemented and justify
exclusions of Annex A controls.
Maintain a risk treatment plan, obtain the required
approvals and record acceptance of residual risks
by the risk owners.
4. Implement the Controls and Retain Evidence
Translate approved arrangements into the way
people work. Assign owners, communicate requirements
and retain evidence appropriate to the controls.
Depending on your scope and assessment, this
could include:
- Access approval, review and removal arrangements.
- Information handling and classification practices.
- Supplier security assessment and oversight.
- Incident reporting and response responsibilities.
- Backup and recovery arrangements with appropriate testing.
- Staff awareness and role-specific competence.
- Physical security and equipment controls.
- Controlled policies, procedures and records.
Assess implementation in practice. An approved
policy shows what is expected; operating records
and other evidence help demonstrate what happened.
5. Audit, Review and Improve the ISMS
Before certification, operate the system and
evaluate its performance through monitoring,
internal audits and management review.
Internal audits examine whether the ISMS conforms
to the applicable requirements and is effectively
implemented and maintained.
- Plan audits with defined scope and criteria.
- Use auditors who support objectivity and impartiality.
- Examine appropriate evidence and record findings.
- Address nonconformities and evaluate corrective action.
- Bring performance and unresolved issues into management review.
- Retain decisions and follow resulting actions through.
6. Arrange Independent Certification
Select a certification body and agree the intended
scope, assessment arrangements and evidence needed.
If you require accredited certification, verify
the body’s accreditation for the relevant service.
Initial certification normally involves a Stage 1
assessment of readiness and a Stage 2 assessment
of implementation and effectiveness.
The certification body explains its process for
addressing findings and making a certification
decision. Certification is followed by ongoing
assessment and periodic recertification.
Continue operating and improving the ISMS between
assessments. Certification is a milestone in
maintaining the system.
How Long Does ISO 27001 Certification Take?
The timescale depends on your scope, existing
controls, organisational complexity, available
resources and the gaps that need to be addressed.
Begin with a realistic gap assessment and an
implementation plan. Allow time to operate the
controls, collect evidence, complete internal audit
and management review, and address findings.
Agree assessment availability with your certification
body rather than relying on a generic promise
of certification within a fixed period.
How Zebsoft Can Support Your ISMS
Zebsoft can support configured records and workflows
connecting information security risks, responsibilities,
controlled information, audits and actions.
- Organise risk assessments and treatment activity.
- Maintain control decisions and supporting evidence.
- Coordinate document review and approval.
- Plan audits and retain findings.
- Assign improvement actions and review their progress.
- Support information for management review.
The required configuration should reflect your
ISMS scope, control arrangements and permissions.
Zebsoft provides software, not ISO certification.
Your organisation remains responsible for interpreting
requirements and operating the ISMS. An independent
certification body makes certification decisions.
Common Questions
Is ISO 27001 only for IT companies?
No. It can be applied by organisations of different
sizes and sectors. The scope and controls should
reflect the information and activities involved.
Do we need to implement all 93 Annex A controls?
Determine necessary controls through risk treatment,
then check Annex A for omissions. Justify exclusions
and include additional controls where required.
Can we use existing policies and systems?
Yes, where they are suitable and meet the applicable
requirements. Review existing arrangements and evidence
before deciding what needs to change.
Does ISO 27001 certification guarantee there will be no incidents?
No. The ISMS provides a structured approach to
managing information security risk. It does not
eliminate every risk or guarantee that incidents
will never occur.
Does using Zebsoft make us certified?
No. Software can support implementation and
ongoing management. Certification requires an
independent assessment and certification decision.
What Do You Need Help Managing?
If risks, controls, evidence and actions are
scattered across documents and spreadsheets,
tell us what you are trying to improve.
Use the floating Request more information
button to ask a question, or book a demonstration
to discuss your ISMS management needs.
