ISO 27001 Implementation Steps: 8 Stages from Scoping to Certification Audit

What is ISO 27001?

ISO/IEC 27001 is the international standard for information security management systems (ISMS). It specifies how an organisation establishes, implements, maintains and continually improves its information security management. The current version is the 2022 edition, whose Annex A lists 93 controls grouped into four themes: organisational, people, physical and technological. The transition period for 2013-edition certificates ended on 31 October 2025.

The 8 stages of ISO 27001 implementation

1. Secure management commitment: confirm the purpose, budget, owner and timeline, and have senior management approve the direction of the information security policy.
2. Define the ISMS scope: decide which departments, locations, systems and services are covered, taking into account internal and external issues and the requirements of interested parties.
3. Asset inventory and risk assessment: inventory information assets and assess threats, vulnerabilities, likelihood and impact using a defined method.
4. Risk treatment and the SoA: decide how each risk will be treated and produce the Statement of Applicability (SoA), stating for each Annex A control whether it applies and why.
5. Build the documentation: write the information security policy, procedures, work instructions and forms, commonly organised as a four-tier document set.
6. Implement and train: put the controls into practice and make sure the people involved understand their information security responsibilities.
7. Internal audit and management review: have independent staff carry out an internal audit, then have management review the ISMS's performance and improvement actions.
8. Certification audit: the certification body conducts Stage 1 (document and readiness review) and then Stage 2 (audit of actual operation), and issues the certificate once you pass.

The 4 most common sticking points

• Scope too large: covering the whole company from day one makes the risk assessment and document volume balloon.
• Risk assessment as a paper exercise: forms get filled in but are never linked to actual controls.
• Documents disconnected from practice: procedures are thorough on paper, but the site does not follow them and no records can be found at audit time.
• Evidence patched together at the last minute: records are not kept day to day and are gathered in a rush before the audit, which is slow and error-prone.

How long does implementation take?

The timeline varies widely with the organisation's size, the scope and its existing foundation. Organisations that already have established practices or another management system (such as ISO 9001) can reuse their existing documents and audit mechanisms. A better way to estimate is to run a gap analysis once the scope is defined, then schedule the work around the gaps.

How NOVARK helps

NOVARK ISO management system and audit uses five-stage agents to help organisations build or import their management system, completing ISMS scope, risk assessment, the SoA and four-tier document mapping. The audit assistant provides mock Q&A, document citation, evidence inventory, corrective-action tracking and audit pack generation, and the solution can extend into compliance monitoring and AI governance. Organisations that already have an ISO foundation can start by importing existing policies or preparing for audit.

• NOVARK Audit

FAQ

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 sets out the management system requirements you can be certified against. ISO 27002 is implementation guidance for the controls, explaining how each one can be put into practice; it is not used for certification itself.

What is a Statement of Applicability (SoA)?

The SoA is a document required by ISO 27001. It lists every Annex A control, whether it applies, the justification for including or excluding it, and its implementation status. It is one of the key documents in a certification audit.

What is a four-tier document structure?

A common document architecture has four tiers: tier 1 is policies and the manual, tier 2 is procedures, tier 3 is work instructions or standards, and tier 4 is forms and records. Tier 4 records are the main evidence at audit time.

This article is general guidance. Adapt the approach to your organisation's size, industry regulations and data. NOVARK is an enterprise AI agent platform.