How to prepare for ISO 27001

Reaching ISO 27001 certification requires an organization to understand its risks, decide which controls apply, assign responsibilities and maintain evidence.

Preparing for ISO 27001 certification means being able to identify risks, explain why particular controls were selected and demonstrate with evidence that those controls are implemented and work in practice.

At Talsoft, our role is to help the organization prepare so that, when the certification body arrives, it can show that it has an Information Security Management System (ISMS) that is implemented, documented and operating.

The organization should be able to answer three questions clearly:

• What security risks does it face?
• Which controls has it chosen to treat those risks?
• What evidence can it present to show those controls work?

Much of the preparation follows from those three questions.

Define the scope of the ISMS

One of the first steps is deciding which parts of the organization fall within the ISMS. The scope establishes which processes, services, systems, people and assets are involved and therefore which environment will be assessed. This decision shapes the rest of the work.

Before focusing on individual controls, the organization needs to understand what it is protecting, which processes are part of the ISMS and where its main dependencies lie.

Identify assets and assess risks

Once the scope is defined, the next step is to identify relevant assets and assess risks that could affect the confidentiality, integrity or availability of information. The organization should also have a defined method for evaluating and treating those risks. This prevents implementation from becoming a generic checklist of controls.

There should be a clear relationship between the identified risks, the decisions made to treat them and the controls ultimately implemented. That is why risk assessment is central to the ISMS.

Assign owners and define security objectives

Implementation also requires clear responsibilities. The organization should be able to identify who owns each process, control or ISMS activity, who monitors progress and who participates in risk decisions. It should also define security objectives and a way to track them.

The goal is to avoid informal ownership or leaving security entirely with the technical team. An ISMS needs a governance structure that sustains decisions and controls over time.

Prepare the Statement of Applicability

Another important element is the Statement of Applicability (SoA). It documents which Annex A controls — the standard's reference set of security controls that an organization can consider when treating risks — apply to the organization, which do not and why.

The SoA should not be treated as a standalone checklist. The decisions it records should relate to the identified risks, the chosen treatment and the organization's context.

An ISMS connects risks, decisions, controls, owners and verifiable evidence.

Review the Annex A controls

ISO 27001:2022 groups Annex A controls into four broad categories.

Organizational controls

These cover security governance and management, including policies, roles and responsibilities, segregation of duties, asset management, suppliers, cloud services, incident management, continuity and legal compliance.

People controls

These concern security responsibilities before, during and after employment. They also cover awareness and training, confidentiality agreements, remote working and reporting security events.

Physical controls

These address the protection of facilities, equipment and physical assets. Examples include physical access control, secure offices and areas, storage, secure disposal of assets and protection against physical threats.

Technological controls

These include many technical cybersecurity measures: identity and access management, authentication, privileges, endpoints, vulnerabilities, secure configuration, backups, logging and monitoring, network security, cryptography, secure development and change management.

Demonstrate that controls are implemented

One important difference between having security measures and being ready for an audit is the ability to show how those measures work.

If the organization makes backups, it should have execution records and restoration test results. If it has a vulnerability management process, it should be able to show scans, findings, owners, remediation and follow-up.

Evidence connects documentation to what actually happens in operations. It should not be collected only when the audit is near. It should be generated as part of the normal operation of the ISMS.

Conduct the internal audit and management review

Before the certification audit, the organization should also have completed an internal audit and a management review. These activities help identify deviations and determine whether additional action is needed. When nonconformities are found, corrective actions should be recorded and followed up.

If your organization is considering ISO 27001 and needs to understand its current position, identify gaps or build a roadmap before certification, contact us to discuss how we can help.

Frequently asked questions

Is ISO 27001 certification mandatory for every organization?

ISO 27001 certification is not mandatory for every organization. However, it may become a condition for working with certain clients, bidding on contracts or meeting specific regulatory or contractual requirements. Many organizations also pursue it voluntarily to strengthen their information security management.

How long does it take to prepare for ISO 27001 certification?

The time needed depends on the organization's size, the defined scope and its current cybersecurity maturity. Preparation can take several months or more than a year, especially when controls must be implemented, procedures formalized and evidence generated from scratch.

How much does ISO 27001 certification cost?

The cost varies with each organization's circumstances and needs. Factors include the ISMS scope, improvements required, internal resources assigned to the project, external advisory support and the certification body's fees. Ongoing maintenance and follow-up costs should also be considered.

Can an organization that uses cloud services become ISO 27001 certified?

Yes. ISO 27001 does not require an organization to own its technology infrastructure. Organizations that use cloud services or external providers can also be certified, provided they manage the associated risks, establish clear responsibilities and can show that applicable controls operate within the defined scope.

How long does ISO 27001 certification last, and what happens afterward?

ISO 27001 certification generally follows a three-year cycle, with surveillance audits usually conducted annually. At the end of that period, the organization undergoes a recertification audit. Throughout the cycle, it must keep its ISMS operating, reassess risks and demonstrate that its controls continue to work.