Skip to content

Framework

ISO 27001, the information security management standard

Reviewed 6 October 2026

ISO 27001

ISO/IEC 27001 is the international standard for information security management systems. It specifies requirements for establishing, operating and continually improving an ISMS, and is certified by an accredited body following a two-stage audit. Organisations use ISO 27001 certification to satisfy enterprise procurement, regulatory expectation and investor due diligence.

Definition

What is ISO 27001?

ISO 27001 certifies a management system, not a product or a network. What an auditor examines is whether the organisation has a defined scope, understands its risks, has selected proportionate controls, and can show those controls operating over time. A company with modest technical controls and excellent evidence will pass where a company with sophisticated security and no records will not.

The 2022 revision restructured Annex A into 93 controls across four themes - organisational, people, physical and technological - replacing the previous 114 across fourteen domains. It also introduced eleven genuinely new controls, including threat intelligence, cloud service security, data leakage prevention and secure coding. Any organisation certified against the 2013 version has already transitioned or lost its certificate.

Annex A is a menu, not a mandate. Controls are selected on the basis of risk assessment and any exclusion is justified in the Statement of Applicability. That document is the first thing an auditor reads and the thing most often written last.

Who ISO 27001 applies to

  • Software and SaaS companies whose enterprise customers will not sign without it.
  • Any supplier being asked to complete long security questionnaires more than twice a year.
  • Companies raising a funding round where technical due diligence covers security posture.
  • Organisations in regulated sectors using ISO 27001 as the backbone for sector-specific obligations.
  • Businesses that already hold Cyber Essentials and have found it no longer satisfies larger buyers.

The path

How long does ISO 27001 actually take?

Realistic elapsed durations for an organisation starting without a dedicated compliance function. Elapsed time, not effort - the two are routinely confused when this gets scoped.

  1. 012-4 weeks

    Scope and gap analysis

    Define what the ISMS covers - which entities, systems, locations and people - and assess current practice against the clauses and Annex A. Scope is the single biggest cost lever in the whole programme, and scoping too broadly the first time is the most common and most expensive mistake.

  2. 022-3 months

    Risk assessment and ISMS build

    Run the risk assessment, select controls, write the Statement of Applicability, and produce the policy set. Implement whatever technical and process gaps the assessment surfaced. This is where an agile approach pays: remediation lands continuously rather than arriving as one large change at the end.

  3. 032-3 months

    Operate and evidence

    The ISMS must demonstrably run. Access reviews performed, risks reviewed, incidents logged and closed, supplier assessments completed, plus at least one full internal audit and one management review. Auditors sample records across this period, so it cannot be compressed.

  4. 046-10 weeks

    Stage 1 and Stage 2 audit

    Stage 1 is a documentation and readiness review. Stage 2, typically four to six weeks later, tests operation through interviews and evidence sampling. Certification is issued once any non-conformities are closed, with surveillance audits in years one and two and full recertification in year three.

Cost and internal effort figures are being confirmed with the practice before publication: cost and effort figures · Q15

Failure points

Where ISO 27001 programmes usually go wrong

Not the theory. The specific things that cause a delayed audit, a major non-conformity, or a certificate that does not survive its first surveillance visit.

Scoping the whole company by default

Scope drives audit days, evidence volume and cost. A first certification scoped to the product and the teams that build it is faster, cheaper and easier to defend than one scoped to every entity and office. Scope can always be widened at recertification.

A Statement of Applicability written to match the controls, not the risks

The SoA is supposed to follow from the risk assessment. Written the other way round - controls first, risks reverse-engineered - it produces exclusions an auditor can dismantle in minutes, and it is the first document they read.

No operating evidence

The most common cause of a delayed certificate. Policies exist, the ISMS is documented, and there is no record of access reviews being done, risks being reviewed or the management review happening. Evidence accrues over calendar time and cannot be manufactured in the final fortnight.

Supplier assessment left until the end

Clause 5.19 to 5.22 controls on supplier relationships need actual evidence from actual suppliers, and suppliers respond on their own schedule. Started a month before Stage 2, this consistently becomes the item that delays the audit.

Internal audit performed by the person who built the ISMS

Internal audit must be independent of the activity audited. The person who wrote the controls cannot credibly audit them, and an auditor will raise it. It needs either a different internal person or an external one.

Certification body chosen on price alone

Only certificates from bodies accredited by a recognised national accreditation body - UKAS in the UK - carry weight in enterprise procurement. Unaccredited certificates are cheaper, faster, and routinely rejected by exactly the customers the certificate was obtained to satisfy.

How we run it

ISO 27001, delivered in sprints

  • 01Scope defined against commercial need first, so you certify what your customers are asking about rather than everything you own.
  • 02Risk assessment run as a working session with the people who know the systems, not as a questionnaire sent to a mailbox.
  • 03Remediation delivered as a sprint backlog with named owners, visible to you throughout, rather than a findings report.
  • 04The policy set written to your actual operating model, because a policy that describes a process nobody follows is a non-conformity waiting to happen.
  • 05Internal audit run independently, giving you a genuine dry run of Stage 2 rather than a formality.
  • 06Stage 1 and Stage 2 attended with you, including handling auditor questions and closing non-conformities.

Choosing between them

ISO 27001 or SOC 2?

ISO 27001 is a certification against an international standard; SOC 2 is an attestation report written by a CPA firm against the AICPA Trust Services Criteria. ISO 27001 produces a certificate that is recognised globally and is what European and UK enterprise buyers usually ask for. SOC 2 produces a detailed report that is what North American buyers usually ask for, and a Type II report covers a defined observation window rather than a point in time. The underlying control work overlaps heavily, so organisations selling into both markets frequently run one programme and produce both outputs. If you are choosing one, choose the one your pipeline is asking for by name.

SOC 2

FAQ

ISO 27001: questions people actually ask

How long does ISO 27001 certification take?

Six to nine months of elapsed time is realistic for an organisation starting without an existing management system. The constraint is rarely the amount of work - it is that an auditor needs to see the ISMS operating over a period, which means access reviews, risk reviews, an internal audit and a management review all have to have actually happened. Four to five months is achievable with a narrow scope and dedicated internal capacity, but timelines under three months usually signal an unaccredited certification body.

How much does ISO 27001 cost?

Cost has two parts. The certification body charges for audit days, driven by scope and headcount, and that is the smaller figure. The larger figure is the internal or consulting effort to build and operate the ISMS. Cloudgap publishes indicative figures only where they reflect delivered engagements, and those figures are being confirmed before publication rather than estimated here.

Do we need ISO 27001 or Cyber Essentials?

They answer different questions. Cyber Essentials verifies five specific technical controls and is achievable in weeks, which is why it is mandated for many UK public sector contracts. ISO 27001 certifies an entire management system and takes months. Enterprise buyers asking detailed questions about governance, risk and supplier management want ISO 27001; Cyber Essentials will not satisfy them. Many organisations hold both, and Cyber Essentials is a sensible first step while an ISO 27001 programme runs.

What happens if we fail the Stage 2 audit?

Outright failure is rare. What normally happens is that the auditor raises non-conformities, classified as minor or major. Minor non-conformities are closed with a corrective action plan and certification proceeds. A major non-conformity means the certificate is withheld until it is closed and evidenced, which typically delays certification by four to twelve weeks rather than requiring the audit to be repeated in full.

Does ISO 27001 cover GDPR?

Partially. ISO 27001 covers the security of processing, which is one article of the UK GDPR. It does not cover lawful basis, data subject rights, records of processing, international transfers or data protection impact assessments. ISO 27701 extends ISO 27001 to privacy information management and is the closer fit. An ISO 27001 certificate is useful evidence of security measures and is not a defence to a data protection complaint.

Related

ISO 42001SOC 2NIST AI RMFNIST 800-53Cyber EssentialsPCI DSSGDPR

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours