ISO/IEC 27001 readiness: prepare for accredited certification

ISO/IEC 27001 certification follows the process rules in ISO/IEC 17021-1:2015, which accredited certification bodies must meet. The initial certification audit has two stages. Stage 1 reviews your management system documentation, evaluates your readiness for stage 2, and gathers what the certification body needs to plan it. Stage 2 evaluates the implementation, including the effectiveness, of your ISMS.

A certification cycle runs three years from the certification decision. Surveillance audits take place in the first and second years, and a recertification audit in the third year, before the certificate expires. Surveillance audits happen at least once a calendar year except in recertification years, and the first one comes no more than 12 months after the certification decision (clause 9.1.3).

European Accreditation's FAQ on that clause states that every calendar year needs at least one audit, whether surveillance or recertification. The certification body plans and performs all of these audits; your part is to keep the ISMS running and producing records between them.

Annex A of ISO/IEC 27001:2022 is a reference list of information security controls drawn from ISO/IEC 27002:2022. It has 93 controls in four groups, down from 114 controls in 14 groups in the previous edition. The four groups, or themes, are organizational, people, physical, and technological controls.

IAF's transition document for the 2022 edition notes that 11 controls are new, 24 were merged from existing controls, and 58 were updated, and that each control now carries attributes and a purpose instead of sitting under a control objective.

Annex A isn't a checklist to adopt wholesale. The standard asks you to determine the controls your risk treatment needs, from any source, then compare them with Annex A to check that nothing necessary has been left out (clause 6.1.3). The standard also notes that Annex A isn't exhaustive, so you can add controls it doesn't list.

The result of that comparison is recorded in the Statement of Applicability, described in the next section.

Two documents anchor an ISO/IEC 27001 certification: the ISMS scope and the Statement of Applicability.

The scope (clause 4.3) sets the boundaries and applicability of your ISMS. When you determine it, the standard asks you to consider the internal and external issues that affect the organization, the requirements of interested parties, and the interfaces and dependencies between your activities and those performed by other organizations. The scope must be available as documented information, and a certificate applies only to what it covers.

The Statement of Applicability (clause 6.1.3 d)) lists the necessary controls and why each is included, whether each is implemented, and the justification for excluding any Annex A control. It ties your risk treatment decisions to your controls. Risk owners then approve the risk treatment plan and accept the residual information security risks (clause 6.1.3 f)).

Both answer a customer's question about how you manage security, but they produce different things, issued by different kinds of organization. Ask your customers and prospects which one they expect before you choose; nothing stops an organization from pursuing both, and a single control set can support each.