A customer or tender asks for ISO 27001. The road to certification, who does what, and the most common mistakes.
Demand for ISO/IEC 27001 usually comes from two places: a large customer's supplier questionnaire or a tender specification. Both ask the same thing: "Has someone independent verified your information security?" This article describes the road to answering yes.
First, be clear about who does what
The certificate is issued by an accredited certification body. A consultant prepares the business for the audit. One firm both preparing and certifying the same client violates the impartiality rule; be wary of anyone offering both.
1. Keep the scope small
For the first certificate, cover the service your customer asks about and the systems behind it, not the whole company. Scope drives time and cost; it can always be extended later.
2. Run a gap analysis
The clauses and Annex A controls are compared with the current state. The result is a prioritised list of gaps: what is not done at all, and what is done but not recorded.
3. Asset inventory and risk assessment
Which information sits in which system, under whose responsibility? For each asset, threat, impact and likelihood are assessed and controls are selected for unacceptable risks. This register is the heart of the system; the auditor looks at it first.
4. Write documents for how you really work
Information security policy, statement of applicability, access, backup, incident, supplier and change procedures. Downloaded templates are spotted at first glance; what is written must match what is done.
5. Actually implement the technical controls
Multi-factor authentication, access matrix, firewall rules, encrypted offline backups, restore tests, log collection, patch tracking, device inventory. The auditor will not accept "we have a backup procedure"; they ask for the record of the last restore test.
6. Training, internal audit and management review
Staff receive awareness training, with records. An internal audit rehearses the certification audit, findings are closed and management reviews the results.
7. Certification audit
The audit has two stages: documents first, then on-site verification. After certification there is a surveillance audit every year; the system has to stay alive.
The three most common mistakes
- Making the scope too large and never finishing.
- Writing the documents but not implementing the controls.
- Stopping record-keeping once the certificate arrives.
SMB Teknoloji runs the preparation part of this road: gap analysis, documentation and technical controls come from the same team. The certificate is issued by the independent body you choose.