How to Implement ISO 27001 Step by Step: A Practical Guide

What are the steps to implement ISO 27001?

Every implementation follows the same ten steps, whatever the size of the organisation. The order matters: leadership and risk come before controls, and checking comes before certification.

• 1. Score where you stand: rate each practice from 0 (not done) to 4 (improving) and set a target.
• 2. Decide: build a business case with low, likely and high cases and get leadership to sign it.
• 3. Context and scope: list issues (including climate where relevant), interested parties and their requirements, and write a scope a client would recognise.
• 4. Policy and roles: one page of policy approved by top management; a RACI with one owner per activity.
• 5. Risk criteria: likelihood and impact scales, score bands and risk appetite, approved before any scoring.
• 6. Risk assessment: start from information and work, name a specific vulnerability for each risk, score it and name an owner.
• 7. Treatment and Statement of Applicability: choose modify, retain, avoid or share; walk all 93 Annex A controls; record status and evidence; get owners to accept residual risk.
• 8. Build and run: short documents, awareness training, supplier checks, incident handling, continuity tests, objectives and monthly metrics.
• 9. Check: internal audits by objective auditors, a management review that makes decisions, and corrective action.
• 10. Certify and keep going: Stage 1, Stage 2, then surveillance audits in years two and three and recertification.

What does ISO 27001:2022 actually require?

ISO/IEC 27001:2022 is the third edition of the standard, published in October 2022, with Amendment 1 published in February 2024 to add climate change considerations to the context clauses. ISO's own page for the standard cites more than 70,000 certificates in 150 countries, drawing on the ISO Survey 2022. The transition from the 2013 edition ended on 31 October 2025.

The requirements sit in clauses 4 to 10, which follow the plan, do, check, act cycle: context and scope, leadership, planning (including risk assessment, treatment and objectives), support (resources, competence, awareness, communication, documented information), operation, performance evaluation (monitoring, internal audit, management review) and improvement (nonconformity and corrective action).

Annex A lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. You compare your chosen controls with Annex A so nothing necessary is missed, and you record the result in the Statement of Applicability. The standard is copyrighted: buy it from ISO or your national standards body, and paraphrase rather than copy it.

How do you run a risk assessment auditors accept?

Auditors do not mind which method you use. They check that it is written, approved by top management, followed every time and repeatable, so that two people scoring the same risk with your criteria get roughly the same answer. That means agreeing the criteria before anyone scores anything: a likelihood scale and an impact scale with plain descriptions, score bands for high, medium and low, and a risk appetite, the residual score you accept without escalating.

Then start from the information and the work, not from the control list. List the information each team creates and relies on, the systems and suppliers that hold it, and what could go wrong. Write the vulnerability, not just the threat: 'some staff sign in without multi-factor authentication' is testable and almost writes its own treatment, while 'ransomware' is not. Bring recent incidents and near misses into every workshop, because they are the best evidence of likelihood you have.

Give every risk a named owner with the authority to accept it and fund its treatment. Score each risk again as it will be once the planned controls work, and record the owner's acceptance of that residual score. Anything above your appetite goes to top management with options. Repeat the assessment at planned intervals and after significant change, and keep each version.

How do you write a Statement of Applicability?

The Statement of Applicability (SoA) lists every Annex A control, whether it applies, why it is included or excluded, and whether it is implemented. Auditors read it first and test it throughout the audit, so every line must be true today.

Work through the four themes in turn. Physical controls are usually quickest to decide, so many teams start there and build confidence before the longer organisational and technological sections. For each control, choose a reason for inclusion (risk treatment, a legal or contract requirement, a client requirement or good practice), a status (implemented, partial, planned or not started), an owner and an evidence reference that points to a register an auditor can open.

Write short, specific justifications. 'Not applicable' on its own is weak; 'Excluded: we do not outsource any software development; reviewed yearly' is testable. Inclusions are stronger when they point to the risks they treat or the contract that requires them. Planned controls are acceptable at Stage 1 when they have an owner and a date in the treatment plan. Controls marked implemented without evidence are not.

Worked example: what does the business case look like?

Here is the sample from a fictional 220-person engineering consultancy in Auckland, built with the toolkit's calculator. Every figure is an estimate for illustration, in New Zealand dollars, over one three-year certification cycle.

The cost of doing it, including internal time, came to NZ$557,740, with NZ$271,700 in year 1. Internal time was the largest single category at NZ$307,840. Benefits combined expected loss avoided from four loss scenarios with the contribution margin on fees protected or won. The low case was negative, and the likely and high cases were positive. Showing all three is what made the case credible to the finance director.

How long does ISO 27001 implementation take, and what does it cost?

There is no fixed timeline. It depends on your starting maturity, your scope, the people you can give it and how quickly leadership decides. In the worked example, a firm starting with an average maturity of 0.66 out of 4 planned 40 weeks from kick-off to the Stage 2 audit, and reached an average of 2.57 ten days before Stage 1.

Costs fall into internal time, the standard and training, tools, any outside help, testing and the certification audits. Certification bodies quote from your scope, headcount and sites, and their rules for audit time come from ISO/IEC 27006-1:2024, the requirements for bodies that certify information security management systems. Get at least three quotes from accredited bodies and compare audit days by stage, the day rate and other fees.

Before you ask for quotes, have four facts ready: a draft scope statement, the number of people in scope, the sites (including whether remote workers count as a site for your certification body) and the main technology, especially the cloud services that hold your information. Ask each body which parts can be audited remotely, how long after Stage 2 they usually make the certification decision, and what their deadlines are for corrective action plans. A clear, comparable set of answers is worth more than the lowest day rate, because a delayed decision can cost you a tender.

What happens at the Stage 1 and Stage 2 certification audits?

Stage 1 reviews your design and readiness: scope, policy, risk method and results, Statement of Applicability, internal audit and management review records. It usually raises areas of concern to close before Stage 2.

Stage 2 tests whether the system works in practice. The auditor samples evidence, interviews people from top management to the front line and tests controls. Findings are graded as major or minor nonconformities, or recorded as observations or opportunities for improvement. Minor findings usually need a correction, root cause and corrective action plan by an agreed date; a major finding normally needs follow-up before certification. The certification decision belongs to the certification body.

Since 1 January 2026, the Global Accreditation Cooperation Incorporated has carried out the international activities that IAF and ILAC used to perform. In practice, check that your certification body is accredited by a recognised accreditation body such as UKAS, ANAB, the Standards Council of Canada or JAS-ANZ, and verify certificates on registers such as UKAS CertCheck.

Can one ISMS also cover SOC 2, NIS2, Cyber Essentials and Essential Eight?

Largely, yes. Most frameworks ask the same questions in different words: who is accountable, what are your risks, who has access, are systems patched, can you recover, do suppliers protect your data and what happens in an incident. An ISMS holds the answers once.

Each framework then adds its own rules. SOC 2 is an attestation report by a CPA firm against the AICPA Trust Services Criteria. The NIST Cybersecurity Framework 2.0, released in February 2024, organises outcomes into six functions including Govern. NIS2 is applied through national laws with management duties and incident reporting deadlines. UK Cyber Essentials checks five technical control areas. Australia's Essential Eight sets maturity levels for eight mitigation strategies. Map each one to your ISMS areas and keep the specifics, such as deadlines and thresholds, in one dated register that you check every quarter.

What are the most common ISO 27001 implementation mistakes?

These come up again and again in internal audits and certification audits.

• Treating a set of downloaded documents as the ISMS.
• A scope so narrow it does not answer clients' questions.
• Scoring risks before agreeing criteria, so results cannot be repeated.
• A Statement of Applicability with no reasons, or with controls marked implemented that have no evidence.
• Policies nobody has read, and awareness training that is only a link.
• Metrics reported every month with no decisions recorded.
• Internal auditors auditing their own work.
• Back-dated records created the week before the audit.
• Accepting an offer from a body that will write your ISMS and certify it.
• Treating the certificate as the finish line instead of the start of a three-year cycle.

How do you keep people and skills ready?

Awareness is tested at every audit: auditors stop people at their desks. A 45-minute briefing built around your own near misses, followed by a short scenario-based knowledge check, works better than a long slide deck. Keep attendance and results as evidence.

For a wider view of where your people stand, the Workplace Cybersecurity Awareness Assessment on AssessAll checks staff judgement on everyday security decisions. ISMS leads themselves benefit from a written development plan for the competences the role needs, and Jobulary's individual development plan guide is a practical place to start. The ISO 27001 Implementation Toolkit from Bodhih Training includes the briefing plan, the knowledge check and every template in this guide.