ISO/IEC 27001 certification follows a fixed path: build an information security management system, run it, audit it yourself, then pass a two-stage audit by an accredited certification body. Here is the sequence, the document checklist and the questions auditors ask, from a company that goes through those audits itself.
TL;DR
- ISO/IEC 27001 certification means an accredited certification body has audited your information security management system (ISMS) and found it meets the standard. The audit has two stages: Stage 1 checks you are ready, and Stage 2 checks the ISMS works in practice.
- Before the auditor arrives you need a defined scope, a risk assessment and treatment plan, a Statement of Applicability covering the 93 Annex A controls, records that the ISMS is running, an internal audit and a management review.
- Certificates run on a three-year cycle, with surveillance audits in between and a recertification audit at the end.
- In Australia, check the certification body’s accreditation, usually through JASANZ. A consultant can prepare you, but only a certification body can certify you.
- Most audit pain comes from documents that describe a business that doesn’t exist. Write the ISMS around how you actually work.
Who does what?
Four parties are involved, and mixing up their roles is the most common early mistake.
| Party | Role |
|---|---|
| Your organisation | Owns and runs the ISMS. Top management is accountable for it under clause 5 of the standard. |
| A consultant (optional) | Helps you design, document and prepare the ISMS. It cannot certify you, and it shouldn’t audit work it built. |
| Certification body | Audits your ISMS and issues the certificate. It must stay independent of whoever helped you prepare. |
| Accreditation body | Checks that the certification body itself is competent and impartial. In Australia and New Zealand this is JASANZ, the joint accreditation body for both countries. |
JASANZ makes a point worth remembering: "Not every certificate is created equal. Some are backed by rigorous, independent assessment. Others are simply self-declared." (The JASANZ Mark). Certificates issued under JASANZ accreditation carry its accreditation symbol, and its public register lists accredited bodies and certified organisations.
Check: before you sign with a certification body, search the JASANZ register and confirm its accreditation scope includes information security management systems. Some certification bodies working in Australia are accredited overseas instead, for example by the UK’s UKAS; in that case, check that accreditation body’s register.
We are certified to ISO/IEC 27001:2022 and go through these audits ourselves. That is where the practical notes in this guide come from.
What does the standard actually require?
ISO/IEC 27001:2022, the third edition, was published in October 2022. It was amended in February 2024 (Amd 1:2024, "Climate action changes"), which asks you to determine whether climate change is a relevant issue when you describe your organisation’s context. The standard has two parts.
Clauses 4 to 10 are mandatory. The standard says excluding any of them "is not acceptable when an organization claims conformity".
| Clause | What it covers | In practice |
|---|---|---|
| 4 Context | Issues, interested parties, scope | Who you are, who relies on you, what the ISMS covers |
| 5 Leadership | Commitment, policy, roles | A signed policy, and named owners for security responsibilities |
| 6 Planning | Risk assessment, risk treatment, objectives, planning changes | Your risk method, risk register, treatment plan, Statement of Applicability |
| 7 Support | Resources, competence, awareness, communication, documented information | Training records, a document control approach |
| 8 Operation | Running the risk processes and controls | Doing what the plan says, and reassessing risk when things change |
| 9 Performance evaluation | Monitoring, internal audit, management review | Measures, an audit program, review minutes |
| 10 Improvement | Nonconformity, corrective action, continual improvement | A log of issues and what you did about them |
Annex A is a reference set of 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You don’t have to implement all 93. You must compare your risk treatment against all of them, then justify each one you include or exclude in your Statement of Applicability.
The preparation sequence
This is the order that works for most small and mid-sized organisations. Each step ends with a Check: you can use as a gate before moving on.
- Get a decision and an owner. A director or the CEO approves the project and names someone to run the ISMS day to day. Check: a short, signed decision that names the ISMS owner and says why you are certifying (a client, tenders, or managing risk).
- Define the scope. Name the services, locations, teams and systems covered. Base it on what clients buy, and keep it tight. Check: a one-paragraph scope statement that a client would recognise, with any exclusions and the reason for each.
- Run a gap assessment against clauses 4 to 10 and the Annex A controls. Check: a list of gaps, each with an owner and a priority.
- Set up the risk method, then assess risk. Decide how you rate likelihood and impact, and what level of risk you accept. Then assess risks to the information in scope. Check: a risk register where every risk has an owner and a treatment decision, and the risk owners have approved the treatment plan.
- Write the Statement of Applicability. For each of the 93 controls, record whether it applies, why, and how it is implemented. Check: pick any five "applicable" controls at random and find real evidence for each within ten minutes.
- Write the policies and procedures you actually need. Start with the documents the clauses require, then add the procedures your applicable controls call for, such as access control, incident response, supplier security and acceptable use. Check: a staff member can tell you, in their own words, what the incident procedure asks them to do.
- Run the ISMS and keep records. Training, access reviews, risk reviews, incident logs, supplier checks and change records. Auditors certify a system that operates, not a set of documents. Check: each applicable control has at least one dated record produced since the ISMS went live.
- Measure. Set objectives and a few measures that show whether security is improving, such as training completion, patch status or phishing reports. Check: a simple measures sheet with real numbers in it.
- Run an internal audit. Use someone competent and objective who didn’t build the area they are auditing. Cover every clause and the applicable controls. Check: an internal audit report with findings, and corrective actions logged under clause 10.
- Hold a management review. Top management reviews the inputs clause 9.3 lists, including audit results, risk status, objectives and feedback, and makes decisions. Check: signed minutes recording decisions and actions, not just "noted".
- Book the certification body. Agree the scope with them, along with the sites and the audit dates. Check: the scope in your contract matches your ISMS scope statement word for word.
The document checklist
These are the documents and records that the clauses themselves require (clause numbers from ISO/IEC 27001:2022). Documents for Annex A controls are needed only where those controls apply to you.
| Document or record | Clause | What auditors look for |
|---|---|---|
| ISMS scope | 4.3 | Clear boundaries, and interfaces with things outside scope |
| Information security policy | 5.2 | Approved by top management, communicated, includes objectives or a framework for them |
| Risk assessment process | 6.1.2 | Repeatable criteria; the same risk gives the same result twice |
| Risk treatment process | 6.1.3 | How options are chosen, and who approves residual risk |
| Statement of Applicability | 6.1.3 d) | All 93 controls addressed, justifications that make sense, matches reality |
| Risk treatment plan | 6.1.3 e), 8.3 | Owners, actions and status, with risk owner approval |
| Information security objectives | 6.2 | Measurable, with owners and plans |
| Evidence of competence | 7.2 | Training records and qualifications for people with security roles |
| Risk assessment results | 8.2 | Assessments repeated at planned intervals and after significant change |
| Risk treatment results | 8.3 | Evidence that treatment actually happened |
| Monitoring and measurement results | 9.1 | Real data, analysed, feeding decisions |
| Internal audit program and results | 9.2 | Coverage of the whole ISMS, auditor objectivity, findings followed up |
| Management review results | 9.3 | All required inputs considered, decisions recorded |
| Nonconformities and corrective actions | 10.2 | Root cause, action taken, effectiveness checked |
Annex A documents that most small organisations end up writing include an asset inventory (A.5.9), acceptable use rules (A.5.10), an incident response procedure (A.5.26), a register of legal, regulatory and contractual requirements (A.5.31), operating procedures (A.5.37) and logging (A.8.15). This list draws on a summary of mandatory documents. Confirm it against your copy of the standard.
Working towards ISO 27001? As an ISO/IEC 27001:2022 certified company ourselves, we help you build an ISMS that works and prepare for your accredited body’s audit.
Stage 1: are you ready?
Stage 1 is the certification body’s readiness review. It checks that your ISMS is designed properly and that you are ready for a full audit (Amtivo, a UKAS-accredited certification body, on the certification cycle). Its outcome decides whether Stage 2 goes ahead as planned.
Expect questions like these:
- Walk me through your scope. Why are these services in and those out?
- Who are your interested parties, and what do they require from you on security?
- Show me your risk method. How did you decide this risk is "medium"?
- Why is this Annex A control excluded?
- Has the ISMS been running long enough to produce records? Show me the internal audit and the management review.
- Which legal, regulatory and contractual requirements apply, and where are they recorded?
The auditor reports any findings so you can deal with them before Stage 2. Close them, and keep evidence that you did.
Stage 2: does it work in practice?
Stage 2 is the full audit. The auditor tests whether the ISMS is implemented and effective, by interviewing people, sampling records and observing controls in operation. It is typically held in the months after Stage 1.
Expect questions like these:
- (To a staff member) What would you do if you clicked a suspicious link?
- Show me the last access review for this system. Who approved it? What changed as a result?
- Pick a leaver from the past few months. When was their access removed?
- Show me a recent change to a production system and its approval.
- Show me the last restore test.
- Pick a supplier that handles your data. What did you check before you engaged them, and since?
- Show me an incident or near miss and what you learned from it.
- How do you know your security objectives are being met?
Findings are graded. A minor nonconformity is an isolated lapse, and you submit a corrective action plan. A major nonconformity means a requirement isn’t met or a process has broken down, and it generally has to be corrected, with the certification body satisfied with the fix, before the certificate is granted. The auditor may also note opportunities for improvement, which are advice, not findings.
The certification body then makes its certification decision and issues the certificate.
After the certificate: surveillance and recertification
Certification bodies work to an international standard of their own (ISO/IEC 17021-1), and accreditation bodies check that they do. In practice, a certificate is valid for three years, subject to the results of annual surveillance audits, and a recertification audit at the end of the three years renews it.
Surveillance audits are shorter and sample part of the ISMS each time, but some areas come up at every visit. Amtivo, for example, lists system performance and maintenance, preventive and corrective actions, and the effectiveness of your internal audits. Expect questions on management review and on how you handled changes and incidents too. The fastest way to get a nonconformity at surveillance is to let the ISMS go quiet after certification.
What keeps it alive between audits:
- A calendar of ISMS activities (risk review, access reviews, internal audit, management review, training) with owners.
- A single log for incidents, nonconformities and improvements.
- Reassessing risk when something significant changes: a new system, a new office, a merger or a new AI tool.
- Updating the Statement of Applicability when your controls change, not just before the auditor arrives.
What we’ve learned from holding the certificate
- The Statement of Applicability is the document auditors read most closely. If it says a control is implemented, they will ask to see it working.
- Small, honest scopes certify more smoothly than ambitious ones. You can extend the scope at recertification.
- Policies written from templates generate findings. If a policy says something happens and staff say it doesn’t, that’s a nonconformity.
- Technical evidence makes audits easier. Vulnerability scans, penetration test reports, backup restore tests and sign-in reports answer several Annex A controls at once. The same evidence also counts towards ASD’s new framework: ASD’s ASD Essentials FAQ says its evidence guide references controls from other frameworks. See SMB1001 vs ASD Essentials vs ISO 27001 for how they overlap.
- Internal audit is a tool, not a formality. Finding your own issues first means the certification audit is a confirmation, not a discovery.
Not sure where you stand? Ask for a free security health check. We look at your setup and tell you, in plain English, what to fix first. Complimentary, at our discretion.
Key takeaways
- An accredited certification body issues ISO/IEC 27001 certification after a Stage 1 readiness review and a Stage 2 effectiveness audit. In Australia, check its accreditation on the JASANZ register (or the overseas accreditation body’s register).
- Clauses 4 to 10 are all mandatory. Annex A’s 93 controls are selected through risk assessment and justified in the Statement of Applicability.
- The ISMS has to be running, with records, an internal audit and a management review, before Stage 2.
- Certificates run on a three-year cycle with annual surveillance audits, so plan to operate the ISMS, not just launch it.
- Write documents around how you really work, and back them with technical evidence.
- If you want help preparing, see our ISO 27001 readiness service and how we run our own certification. We prepare you, and an accredited body certifies you.
Sources
- IEC Webstore, ISO/IEC 27001:2022 listing and abstract (edition, date, scope; Amd 1:2024 publication date)
- SIS (Swedish Institute for Standards), ISO/IEC 27001:2022 listing (amendment status, replaced editions)
- ISO, ISO/IEC 27001:2022
- JASANZ, home page, The JASANZ Mark and register
- JASANZ, Business & Innovation schemes (information security management scheme)
- Amtivo (UKAS-accredited certification body), The three-year certification cycle (secondary source)
- Advisera, List of mandatory documents required by ISO 27001 (secondary source)
- ASD’s ACSC, ASD Essentials frequently asked questions
Want a second pair of eyes?
Catharsis Cyber Security is a Sydney cyber security company, certified to ISO/IEC 27001:2022. We help organisations protect, test and run their technology, and explain it in plain English.
