ISO 27001 Certification
ISO 27001 sets the requirements for an information security management system covering people, processes and technology.
- Standard
- ISO 27001:2022
- Indicative timeline
- 10-16 weeks, depending on scope and readiness
- Discipline
- ISO Standards
- Assessment type
- Independent third-party assessment
The standard
Overview
ISO 27001:2022 is the international standard for information security management systems. It sets management system requirements in clauses 4 to 10 and lists 93 controls in Annex A, grouped into organisational, people, physical and technological themes. Controls are selected on the basis of a documented risk assessment and recorded, with reasons for inclusion or exclusion, in a Statement of Applicability.
Certification shows that an independent assessor has tested the system against the standard: that risks have been identified and treated, that the selected controls are in place, and that performance is monitored and reviewed. It is commonly requested in supplier due diligence, security questionnaires and contracts involving personal or client data. It supports work on UK GDPR compliance but does not by itself demonstrate compliance.
UKCert assesses in two stages. Stage 1 examines scope, risk method, the Statement of Applicability and the mandatory records. Stage 2 tests the controls in operation and reports findings against the clause or control concerned.
Who this is for
- Software and SaaS firms holding customer data
- Managed service providers, hosting and data centre operators
- Organisations processing personal data under UK GDPR
- Suppliers to financial services, healthcare or government clients
- Organisations repeatedly answering long security questionnaires
What it gives you
Why organisations certify
What a certified ISO 27001:2022 assessment gives you once the certificate is issued.
Answers due diligence
A current certificate and Statement of Applicability replace much of the evidence gathering that supplier security questionnaires demand, shortening procurement and vendor review cycles.
Risk decisions recorded
Every control is chosen against an identified risk, so security spending, exclusions and accepted risks can be explained to a board, a client or a regulator.
Incident readiness
The standard requires defined reporting, assessment, response and learning for security events, so incidents are handled by process rather than improvisation.
Access under control
Identity, privilege and authentication controls are defined and reviewed on a schedule, reducing the standing access that causes much avoidable data exposure.
Supply chain assurance
Supplier screening, contract clauses and monitoring of cloud and outsourced services are treated as security controls in their own right, not procurement formalities.
Supports data protection
The controls address much of what UK GDPR expects of technical and organisational measures, giving documented evidence for your accountability obligations.
Scope
What the assessment covers
The areas an assessor works through. Your final scope is confirmed in writing before any audit is booked.
- Scope statement and asset inventory
- Information security risk assessment and treatment plan
- Statement of Applicability across 93 Annex A controls
- Access control, identity and privileged access management
- Cryptography and key management
- Supplier and cloud service security controls
- Security incident management and threat intelligence
- ICT readiness for business continuity
How it runs
The assessment, stage by stage
From first enquiry to certificate. Each stage is agreed with you before it starts.
-
Scope and quotation
We agree what is in scope: legal entities, locations, services, systems and cloud platforms. Audit duration and the quotation follow from that scope and your headcount.
-
Risk and gap review
An optional review of your risk assessment, Statement of Applicability and control evidence before formal assessment, identifying gaps in the Annex A controls you have declared applicable.
-
Stage 1 assessment
We examine scope, risk method, the Statement of Applicability, policies and mandatory records, and confirm that internal audit and management review have taken place. Readiness gaps are reported in writing.
-
Stage 2 assessment
We test controls in operation, sampling access reviews, change and incident records, supplier agreements, monitoring output, backups and continuity tests against your Statement of Applicability.
-
Certification decision
Findings are closed with corrective action and supporting evidence. An independent reviewer then decides on certification, and the certificate names the agreed scope and runs for three years.
-
Surveillance and renewal
Surveillance audits during the cycle check the risk assessment, scope changes and control performance. A full recertification audit is carried out before the certificate expires.
Questions
ISO 27001:2022 — frequently asked
Anything here that does not cover your situation, put it to an assessor rather than guessing at it.
Same discipline
Other schemes in ISO Standards
Certifying against more than one standard?
Where you hold several standards, shared clauses are assessed once in a combined visit rather than as separate audits. Talk it through with an assessor before you decide what ISO 27001:2022 should sit alongside.