ISO/IEC 27001 Certification

What does ISO/IEC 27001 cover?

ISO/IEC 27001 concerns an information security management system, or ISMS. It addresses how an organisation identifies and manages information-security risks through people, processes and technology. The intended scope should describe the relevant services, information and activities rather than simply listing the organisation’s computers.

Preparation needs to connect identified risks with decisions, implemented controls and evidence of review. Policies explain expected behaviour, while operating records show how those arrangements are used. A technical scan or a collection of security tools can contribute information but does not alone demonstrate a complete management system.

Applicability and system scope

Organisations handling information, delivering information-dependent services or responding to customer-assurance requests can explore this service. Define the business and information boundaries without sending confidential files through the initial enquiry.

Start by describing the work actually performed and the boundaries you intend to present for assessment. Identify outsourced activities and interfaces with other teams. A scope should be understandable to the people implementing the system and to the customers or other parties who will read the resulting certificate.

Key management-system areas

The table is an orientation for preparation, not a reproduction of the standard’s clauses. Use the applicable edition and the organisation’s facts to identify detailed requirements. The system should connect these areas with responsible people, operating methods and the evidence showing that the methods are used.

Documented information and evidence

Documents describe intended arrangements; completed records show what happened. Both should remain identifiable and controlled. Use actual operating examples to check whether information is current, accessible and suitable for the work.

Preparing for the certification journey

1. Define the business purpose and information boundary.

   Use the original requirement and business facts to agree the starting point. Record assumptions as questions rather than treating them as confirmed requirements.

2. Review current risk-management and control arrangements.

   Separate what is known from what needs authority, laboratory, assessment-body or competent professional confirmation. This avoids building the preparation around an unsupported route.

3. Identify preparation tasks and responsible owners.

   Identify document owners and use reviewed versions. A simple evidence index helps the team see both the information available and the gaps that still need action.

4. Implement suitable arrangements and organise evidence.

   Keep preparation tasks connected to actual implementation. Where a technical judgement is needed, identify the competent reviewer instead of treating an administrative check as a technical decision.

5. Review readiness and coordinate independent assessment.

   Record the question, owner and response evidence together. If a response changes the scope or an important fact, check the implications for the rest of the submission.

6. Address findings and keep information-security decisions current.

   Review the actual result, not just the fact that a submission was made. Retain its scope, conditions and the next action relevant to the applicant.

Potential benefits for your organisation

• Clearer ownership of information-security decisions.
• Better links between risk assessment and operational controls.
• An organised evidence set for customer-assurance discussions.
• A structured way to review changes and incidents.

The value comes from applying the system to the organisation’s real decisions and operations. Set preparation objectives that can be reviewed, such as clarity of responsibilities, usable instructions and evidence of actions being completed. External certification is a separate assessment decision.

An example of the system in practice

A service provider follows the information used in a customer project from receipt to delivery and retention. It identifies access owners, storage arrangements and relevant suppliers. Gaps are recorded for action, and existing controls are linked to evidence. The example does not require disclosure of customer data or prove that a security incident cannot occur.

For your own review, follow one comparable activity from planning through execution and checking. Identify the inputs, responsible people, operating evidence and response when something does not go as intended. That provides a more useful preparation discussion than asking whether a blank template has been completed.

Readiness questions and common gaps

• Treating penetration testing as a substitute for the ISMS.
• Defining a scope that omits important service dependencies.
• Sharing sensitive operational evidence before agreeing an appropriate review channel.

For each identified gap, agree the action, owner and evidence of completion. An internal review should also consider whether the change works in use. Closing an item administratively is different from demonstrating that the underlying issue has been addressed.

Certification scope and other requirements

ISMS certification is different from a penetration-test report, privacy-law compliance determination or guarantee against cyber incidents. Each addresses a different question and may require separate expertise.

If a customer or tender requires a particular accreditation arrangement, standard edition or scope, share the wording before selecting an assessment route. Do not assume that a familiar standard number by itself answers every procurement or regulatory question.

Maintaining the system after assessment

Review system changes, access arrangements, supplier dependencies and incidents. Keep the risk decisions and evidence connected to the services actually delivered.

Keep the system in normal use between assessments. Maintain the relevant records, review findings with responsible people and consider significant changes before presenting the earlier scope as unchanged. A management review should help the organisation decide what needs attention, not merely complete a scheduled form.

Plan your first discussion

Start with the outcome you need and the evidence you already hold. Bring the exact buyer clause, authority request or assessment enquiry where available, together with a short description of the product, activity or site. This makes the conversation more useful than asking for an unspecified certificate.

TenderCert’s consultancy scope can then identify the preparation and coordination tasks to discuss, the person responsible for each input and the questions for the relevant decision-maker. The applicant should review information and declarations before any external submission. Keep the final reviewed version and the acknowledgement together so later follow-up begins from the same record.

Common questions