ISO 27001 step-by-step
The road to ISO 27001 certification can look overwhelming. In the Netherlands, the standard is available through NEN (Dutch standards institute) , and certification runs through an accredited body . There are risk assessments, security controls, a Statement of Applicability, internal audits… where do you start? This step-by-step guide takes you through the whole process.
You will find that implementing ISO 27001 is not purely a technical project. Yes, technical measures play a part, but most of the work is organisational: describing processes, assigning responsibilities, training people, and building a culture where information security is second nature.
The timeline differs per organisation. A small IT company with straightforward systems can be ready in four to six months. A larger organisation with complex infrastructure and several sites often needs nine to twelve months, sometimes longer.
How long does ISO 27001 certification take?
For most organisations, ISO 27001 certification takes four to eighteen months, depending on your size and starting point. The table below gives an indication per company size.
| Company size | Timeline |
|---|---|
| Small (1-25 employees) | 4-6 months |
| Medium-sized (25-100 employees) | 6-9 months |
| Large (100+ employees) | 9-18 months |
These timelines assume a dedicated project manager and enough management attention. If the project is done alongside other duties, it takes longer. The biggest causes of delay are a scope that is too broad, overdue documentation, and a risk assessment that starts too late. You will find a detailed breakdown per phase on the costs and timeline page.
The 10 phases of the ISO 27001 step-by-step
The route from zero to certificate consists of 10 phases. The table below gives you the overview, from orientation to receiving your certificate. We work through each phase below.
| Phase | What do you do? |
|---|---|
| 1. Orientation and commitment | Define the scope, involve the board, create a project plan |
| 2. Gap analysis | Compare the current situation with the standard |
| 3. Risk assessment | Map information assets and threats |
| 4. Statement of Applicability | Assess all 93 Annex A controls for applicability |
| 5. Implement controls | Put technical and organisational security controls in place |
| 6. Awareness and training | Train employees in security awareness |
| 7. Complete documentation | Bring all ISMS documentation together and check it |
| 8. Internal audit | Test your own system before the auditor arrives |
| 9. Management review | Management formally evaluates the ISMS |
| 10. Certification audit | External audit in two stages by an accredited body |
We work through each phase below.
Tip: ISO 27001 is not only about technology. Most of the work is organisational: describing processes, assigning responsibilities and training people. Start with phase 3 (risk assessment), because it determines which controls you need to implement in phase 5.
Phase 1: Orientation and commitment
Before you start, it is essential that the organisation understands what it is starting. ISO 27001 implementation takes time, money and attention from people at all levels. Without support from management, it becomes a battle against the current.
Begin with a conversation with the board. Why do you want this? Is it because clients ask for it, because competitors have it, or because you genuinely want to improve security? All of these reasons are valid, but it is important to have clear expectations.
The International Organization for Standardization stresses the importance of “leadership commitment” in the standard itself. The board must not only approve, but also be actively involved and free up the necessary resources. In practice, this means reserving budget, appointing someone to lead the project, and making time for employees to take part.
In this phase, also decide what the scope of your ISMS will be. Which parts of the organisation fall under it? Which locations, systems and processes? You can choose to start with a limited scope, for example only your software development department, and expand later. A scope that is too broad makes the process unnecessarily complex. A scope that is too narrow may mean your certificate has little value for clients.
Result of this phase: A project plan with scope, budget, timeline and project organisation. Formal commitment from the board.
Phase 2: Gap analysis and current situation
Now that you know you want to go ahead, the next step is to understand where you stand. A baseline measurement and gap analysis compares your current situation with what ISO 27001 requires. This shows you how much work is still to do.
Go through the requirements of the standard systematically. Do you already have an information security policy? Are risks identified and controlled? Are there procedures for incident response? Are employees trained in security awareness?
Also look at the 93 controls in Annex A. Which of them have you already implemented, perhaps without calling them that? Many organisations already have firewalls, antivirus software, access management and backups. The challenge is often not the lack of controls, but the lack of documentation and structure.
Many organisations choose to bring in an external consultant for the gap analysis. This has advantages: a fresh view from someone who knows the standard inside out. But it is not a must. With the standard in hand and enough time, you can do it yourself.
BSI and other certification bodies often offer pre-assessments: an informal audit ahead of the actual certification audit. This can be a valuable checkpoint, although it comes at a cost.
Result of this phase: A gap analysis report that shows where you stand and what still needs to happen. A prioritised action list.
Phase 3: Risk assessment
The risk assessment is the heart of ISO 27001. Other management system standards treat risk-based thinking as a principle. ISO 27001 makes it explicit: you must carry out and document a formal risk assessment.
Start by identifying your information assets: what information does your organisation hold, where is it stored, and how valuable is it? Think of client data, financial information, intellectual property, personnel records and operational data.
Next, identify the threats that could affect these assets. The Nationaal Cyber Security Centrum (Dutch National Cyber Security Centre, NCSC) regularly publishes overviews of current threats that can serve as a starting point. Think of malware, phishing and unauthorised access, but also non-digital threats such as fire, water damage or the departure of a key employee.
For each combination of asset and threat, determine the risk: how likely is it to happen, and what is the impact if it does? Several methods exist for risk assessment. ISO 27005 provides guidance, and frameworks such as OCTAVE or FAIR offer structured approaches. The standard does not prescribe a specific method, as long as your approach is consistent and repeatable.
The result is a risk register with a classification for each risk (for example low, medium, high or critical) and a decision: do you accept the risk, mitigate it, transfer it (for example through insurance), or avoid it by stopping the activity?
A common mistake is treating the risk assessment as a one-off exercise. ISO 27001 requires you to repeat the assessment regularly, and always when there are significant changes in your organisation or environment.
Result of this phase: A documented risk assessment with identified risks, classifications and treatment decisions.
Phase 4: Statement of Applicability (SoA)
The Statement of Applicability is a document that is unique to ISO 27001. It lists all 93 controls from Annex A, and for each control it states whether it applies and, if so, how you have implemented it.
This document makes you think deliberately about each control. Not every control is relevant to every organisation. If you have no physical server room because everything runs in the cloud, certain physical security controls do not apply. But you must explain why you are not applying them.
The SoA is also an important document for the auditor. It shows how you have interpreted and implemented the standard. During the audit, the auditor will check whether reality matches what you wrote in the SoA.
A good SoA is more than a checklist. It also refers to the relevant procedures, work instructions or technical documentation. That way, the auditor and your own employees can quickly find the details.
Result of this phase: A complete Statement of Applicability that covers all 93 controls.
Phase 5: Implement controls
Now the real work begins: implementing the security controls you have selected. This is often the most time-consuming phase, because it can involve both technical and organisational changes.
Technical controls can range from implementing multi-factor authentication, encrypting data, and setting up a SIEM system for security monitoring, to hardening servers and setting up network segmentation. The specific controls depend on your risk profile and your existing infrastructure.
Organisational controls are at least as important. Think of drafting policy documents, setting up a process for access management, training employees in security awareness, and writing procedures for incident response.
Good sources and guidance exist for many controls. The Center for Internet Security (CIS) publishes the CIS Controls, a prioritised list of technical measures. NIST offers the Cybersecurity Framework as a complementary framework. These sources can help you put the ISO 27001 requirements into practice.
Document what you implement. The auditor wants to see not only that you have controls, but also that you can show how they work and who is responsible for them.
Result of this phase: Implemented security controls, documented in procedures and work instructions.
Phase 6: Awareness and training
An ISMS can be designed perfectly, but if employees do not act on it, it is worthless. Security awareness is therefore a crucial part of ISO 27001.
Training should go beyond a one-off presentation at the start of employment. Effective awareness programmes are ongoing and varied: regular communication, phishing simulations, interactive workshops, and reminders at relevant moments.
Make sure employees understand why information security matters, not just what the rules are. Explain the possible consequences of a security incident: for the organisation, for clients, and potentially for themselves. Make it personal and relevant.
SANS and KnowBe4 are well-known providers of security awareness training, but there are Dutch alternatives too. Whichever approach you choose, consistency and relevance matter most.
Result of this phase: An awareness programme with trained employees and records of that training.
Phase 7: Complete ISMS documentation
By now you have probably produced a lot of documentation: policies, procedures, the risk assessment, the SoA. Now is the time to bring everything together and make sure your documentation is complete and consistent.
ISO 27001 requires specific documented information, including:
- Scope of the ISMS
- Information security policy
- Risk assessment and risk treatment
- Statement of Applicability
- Information security objectives
- Evidence of competence
- Operational planning and control
- Results of risk assessments
- Results of internal audits
- Results of management reviews
In addition, records are needed: evidence that processes are followed, that training took place, and that incidents are handled.
Organise your documentation so that it is easy to find and maintain. Many organisations use a wiki or document management system. Make sure you have version control: the auditor wants to see that documents are controlled and that employees use the current versions.
Result of this phase: Complete, organised ISMS documentation.
Phase 8: Internal audit
Before you invite the external auditor, you carry out an internal audit. This is not only a requirement of the standard, but also a smart move: you find out now what is not right, so you can fix it before it becomes a problem.
The internal auditor must be independent of what is being audited. An IT manager cannot audit their own department. For smaller organisations, this often means bringing in an external party, or training a colleague from another department as an internal auditor.
The internal audit goes through all the requirements of the standard and checks whether your ISMS meets them. As with an external audit, this produces findings: matters that are not in order or can be improved.
Take the findings seriously. Resolve deviations before you schedule the certification audit. Document what you have done to resolve them, because the external auditor will ask about it.
Result of this phase: Internal audit report with findings and corrective actions taken.
Phase 9: Management review
Management must review the ISMS on a regular basis. This is a formal meeting in which management looks at how the system is performing, whether objectives are being met, and what improvements are needed.
The management review must take place before the certification audit. The auditor will ask for the minutes and wants to see that management is actively involved, not just on paper.
In the management review, discuss among other things:
- Results of audits (internal and possibly external)
- Feedback from interested parties
- Status of the risk assessment
- Progress on objectives
- Security incidents and trends
- Required resources and improvements
Record the outcomes, including decisions taken and actions assigned.
Result of this phase: Minutes of the management review with decisions and actions.
Phase 10: Certification audit
Now comes the moment of truth: the certification audit by an accredited certification body. Choose a body accredited by the Raad voor Accreditatie (Dutch Accreditation Council, RvA) or a comparable national accreditation body. Well-known bodies in the Netherlands include Kiwa , BSI , TÜV , DNV , Bureau Veritas , and LRQA .
The audit runs in two stages. In Stage 1, the auditor reviews your documentation: is your ISMS complete and consistent on paper? This can be done remotely or on site and usually takes one day. You receive feedback on any shortcomings that you must address for Stage 2.
In Stage 2, the auditor visits your site to check whether your ISMS also works in practice. The auditor speaks with employees, looks at systems, and asks for evidence. This takes several days, depending on the size of your organisation.
Afterwards, you receive an audit report with findings. If the result is positive, with at most minor deviations, you receive the certificate, usually within a few weeks of resolving any deviations.
Read more about the audit process.
Result of this phase: ISO 27001 certificate.
After ISO 27001 certification: the work continues
The certificate is valid for three years, but that does not mean you can sit back for three years. The certification body returns every year for a surveillance audit to check that you still meet the standard.
Information security is also an ongoing process. New threats emerge, your organisation changes, and laws and regulations evolve. Your ISMS must keep pace. That requires continuous attention, maintenance and improvement.
Read more about maintaining ISO 27001 after certification.
Common mistakes in ISO 27001 implementation
Starting the risk assessment too late. The risk assessment is fundamental to all the next steps. Start it early.
Focusing too much on technology. ISO 27001 is not only about firewalls and encryption. The organisational and human side is at least as important.
Seeing documentation as the goal. The goal is working information security, not thick manuals. Keep documentation practical.
No real involvement from management. If the board sees the ISMS as “an IT thing”, it misses the support it needs to succeed.
Underestimating the time required. Plan realistically. Rushed work leads to superficial implementation that fails at the audit.
More information
- Costs and timeline: How much does ISO 27001 certification cost?
- Requirements of the standard: What exactly does ISO 27001 require?
- Defining the scope: How do you define the scope of application?
- Annex A: The 93 controls explained
- Mandatory documents: Which documents do you create during the process?
- Internal audit: How do you plan and carry out the internal audit?
- The audit process: What can you expect at the audit?