Achieving ISO 27001 certification demonstrates to customers, partners, and regulators that your organisation takes information security seriously. But navigating the standard’s requirements without a clear plan can lead to wasted effort, scope creep, and costly delays. This checklist breaks the entire certification journey into 17 actionable steps across four phases, from initial planning through to certification and beyond.
Whether you are pursuing ISO 27001 for the first time or rebuilding your Information Security Management System (ISMS) for recertification, this guide provides practical detail at every stage. Each step explains what to do, why it matters, and how to approach it effectively. Use this as a working checklist to track progress, assign ownership, and ensure nothing is overlooked on your path to certification.
Phase 1: Planning and Preparation
The planning phase establishes the strategic foundation for your ISMS. Rushing past this phase is one of the most common reasons organisations encounter delays and rework later in the process. Investing time here to define scope, assemble the right team, and build an accurate picture of your information assets will pay dividends throughout every subsequent step.
Step 1: Build your certification roadmap
Before any technical work begins, create a high-level roadmap that maps out the entire certification journey from start to finish. Define your target certification date and work backwards to establish milestones for each phase. Identify key dependencies, budget requirements, and resource constraints that could affect the timeline.
Your roadmap should include an executive summary that articulates the business case for certification. Common drivers include contractual obligations from enterprise customers, regulatory requirements, competitive differentiation, or a genuine desire to strengthen the organisation’s security posture. Present this roadmap to senior leadership to secure formal commitment and budget approval. ISO 27001 requires demonstrable top management support, so obtaining this early is not just good practice but a requirement of the standard itself. Document the approved roadmap as a controlled document within your ISMS.
Step 2: Define the ISMS scope
The scope statement is one of the most consequential decisions in your certification journey. It defines which parts of your organisation, which locations, which processes, and which information assets are covered by the ISMS. A scope that is too broad creates unnecessary complexity and cost. A scope that is too narrow may fail to satisfy customer expectations or leave critical assets unprotected.
Start by identifying the products, services, and business processes that handle sensitive or regulated information. Consider physical locations, remote working arrangements, cloud infrastructure, and third-party services that support these processes. Document your scope statement clearly, specifying what is included, what is excluded, and the justification for any exclusions. Your certification body will review this scope during the Stage 1 audit, so it must be defensible and aligned with the organisation’s context. Review ISO 27001 Clauses 4.1 through 4.3, which require you to understand the organisation’s context, interested parties, and their requirements before finalising scope.
Step 3: Assemble the ISMS team
ISO 27001 implementation is a cross-functional effort that requires participation from IT, engineering, HR, legal, operations, and executive leadership. Appoint an ISMS Manager or Information Security Officer who will be accountable for driving the programme day to day. Then identify control owners across each department who will be responsible for implementing, maintaining, and evidencing specific controls.
Create a RACI matrix that maps each Annex A control domain to specific individuals. Hold a formal kickoff meeting to communicate the project scope, timeline, and each person’s responsibilities. Establish a regular cadence of progress meetings and define clear escalation paths for blockers. Organisations that distribute ownership broadly consistently achieve smoother audits than those that centralise all compliance work in a single team.
Step 4: Conduct an information asset inventory
You cannot protect what you do not know about. Build a comprehensive inventory of all information assets within your ISMS scope. This includes data stores, databases, file shares, SaaS applications, cloud environments, physical records, intellectual property, employee data, customer data, and any other information the organisation creates, receives, processes, or stores.
For each asset, record its name, owner, classification level, storage location, and the business processes it supports. Classify assets according to a defined scheme, such as Public, Internal, Confidential, and Restricted. Then map the data flows between assets to understand how information enters, moves through, and exits your environment. This exercise frequently uncovers shadow IT or legacy systems that must be brought into scope or formally decommissioned. Your asset inventory feeds directly into the risk assessment in Phase 2, so accuracy here is essential.
Phase 2: Risk Assessment and Control Implementation
With the planning foundation in place, Phase 2 focuses on identifying and treating information security risks, then implementing the controls needed to address them. This is where the ISMS takes shape as a working system rather than a set of documents.
Step 5: Perform the risk assessment
The risk assessment is the engine of your ISMS. ISO 27001 Clause 6.1.2 requires a systematic process for identifying information security risks, analysing their likelihood and impact, and evaluating them against defined criteria. Choose a risk assessment methodology that suits your organisation’s size and complexity, whether qualitative, semi-quantitative, or fully quantitative, and document it in a risk assessment procedure.
Identify threats and vulnerabilities for each information asset in your inventory. Consider categories such as cyber attacks, insider threats, accidental data loss, natural disasters, and supply chain failures. Assess each risk’s likelihood and potential impact on confidentiality, integrity, and availability. Use a consistent scoring framework, such as a 5x5 risk matrix, and define your risk acceptance threshold. Risks that fall above this threshold require treatment. This assessment must be repeatable and auditable, so ensure your methodology is formally documented and consistently applied.
Step 6: Establish the risk register
Your risk register is the central record of all identified risks, their ratings, owners, and treatment decisions. Every risk from your assessment should be logged in the register with a unique identifier, description, asset association, threat and vulnerability pairing, likelihood score, impact score, overall risk rating, and the name of the risk owner responsible for managing it.
Organise the register so that it provides a clear, filterable view of your risk landscape. Senior leadership and your ISMS Manager need to see high-level summaries, while control owners need detailed views of the risks they are responsible for. The register is a living document that must be reviewed and updated regularly, not something you create once and file away. During your certification audit, the auditor will examine the register closely to verify that risks have been identified systematically, rated consistently, and linked to treatment decisions. Maintaining the register in a GRC platform rather than a spreadsheet ensures version control, audit trails, and real-time visibility.
Step 7: Create the risk treatment plan
For each risk that exceeds your acceptance threshold, decide on a treatment option: mitigate, transfer, avoid, or accept. Mitigation is the most common approach and involves implementing controls to reduce the risk to an acceptable level. Transfer involves shifting the risk to a third party, such as through cyber insurance. Avoidance means eliminating the activity that creates the risk. Acceptance means formally acknowledging the residual risk with management approval.
Document each treatment decision in a risk treatment plan that links the risk to the selected treatment option, the specific controls to be implemented, the responsible owner, the target completion date, and the expected residual risk after treatment. This plan must be approved by management and forms a key input to your Statement of Applicability. The auditor will verify that every risk above the acceptance threshold has a documented treatment decision and that treatment actions have been implemented or are in progress with a clear timeline.
Step 8: Prepare the Statement of Applicability
The Statement of Applicability (SoA) is one of the most important documents in your ISMS. It lists all 93 Annex A controls from ISO 27001:2022, states whether each control is applicable or not, provides the justification for inclusion or exclusion, and references the implementation status. The SoA bridges your risk assessment findings to the specific controls you have selected.
Work through each of the four Annex A control themes: Organisational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls). For every control, document whether it is applicable based on your risk assessment and scope, why it is included or excluded, its current implementation status, and where evidence can be found. Controls can only be excluded if you can demonstrate that the associated risks do not apply within your scope. The SoA is a mandatory document that your certification body will review in detail during the Stage 1 audit, so invest the time to make it thorough and accurate.
Step 9: Implement controls
With your SoA finalised, begin implementing the controls you have selected. Prioritise based on risk severity, starting with controls that address critical and high-rated risks. Group related controls into implementation workstreams to create efficiencies. For example, access control implementation might include deploying single sign-on, enforcing multi-factor authentication, establishing periodic access reviews, and documenting the access management policy.
For each control, define the implementation approach, configure the technical or procedural mechanisms, assign the control owner, and establish how evidence of operation will be collected. Ensure that controls are proportionate to the risks they address; over-engineering controls wastes resources, while under-engineering them creates audit findings. Document the implementation of each control with sufficient detail that an auditor can understand what the control does, how it operates, and where to find evidence of its effectiveness. Automation is valuable here: controls that generate evidence automatically, such as automated access reviews or continuous vulnerability scanning, are far easier to sustain than those relying on manual processes.
Phase 3: Documentation and Testing
Phase 3 focuses on ensuring that your ISMS is not only implemented but also documented, understood, and tested. ISO 27001 places significant emphasis on documented information, competence, and internal review. This phase prepares you for the scrutiny of a certification audit.
Step 10: Develop ISMS policies and procedures
ISO 27001 requires a set of mandatory documented information, including the information security policy, risk assessment procedure, risk treatment procedure, and Statement of Applicability. Beyond these mandatories, you will need supporting policies and procedures for each control domain: access management, incident management, business continuity, supplier relationships, asset management, cryptography, and others as applicable to your SoA.
Write policies that are clear, concise, and appropriate to your organisation’s size and culture. Avoid copying generic templates verbatim, as auditors can spot boilerplate documents that do not reflect actual practice. Each policy should state its purpose, scope, roles and responsibilities, and review schedule. Procedures should provide step-by-step instructions that staff can follow. Establish a document control process with version numbers, review dates, and approval records. All documented information must be accessible to those who need it and protected from unauthorised modification.
Step 11: Deliver security awareness training
Clause 7.2 requires that all personnel performing work under the ISMS are competent, and Clause 7.3 requires that they are aware of the information security policy, their contribution to the ISMS, and the consequences of non-conformity. Design a training programme that covers these requirements and is tailored to different roles within the organisation.
All staff should receive baseline security awareness training covering topics such as phishing, password hygiene, data handling, incident reporting, and acceptable use. Role-specific training should be provided to individuals with elevated responsibilities, such as developers receiving secure coding training or IT administrators receiving privileged access management training. Deliver training during onboarding and at regular intervals, at least annually. Record attendance and assessment results as evidence for the audit. Consider supplementing formal training with ongoing awareness activities such as simulated phishing exercises, security newsletters, or lunch-and-learn sessions. The auditor will interview staff during the Stage 2 audit to verify that awareness training is effective, not merely delivered.
Step 12: Conduct management reviews
Management reviews are a mandatory requirement under Clause 9.3 and demonstrate top management’s ongoing involvement in the ISMS. These reviews must be conducted at planned intervals, typically quarterly or semi-annually, and must cover a defined set of agenda items specified by the standard.
Required inputs include the status of actions from previous reviews, changes in external and internal issues, feedback on information security performance (including nonconformities, monitoring results, and audit findings), and opportunities for continual improvement. The output must include decisions and actions related to continual improvement opportunities and any changes needed to the ISMS. Document the minutes of each management review, including attendees, items discussed, decisions made, and action items with owners and deadlines. These records are audit evidence that your certification body will request. Ensure that senior leadership genuinely engages with the review rather than treating it as a rubber-stamping exercise; auditors will probe the depth of management involvement during interviews.
Step 13: Perform the internal audit
Before your certification audit, you must conduct at least one internal audit covering the full scope of your ISMS. Clause 9.2 requires internal audits at planned intervals to verify that the ISMS conforms to the organisation’s own requirements and the requirements of ISO 27001, and that it is effectively implemented and maintained.
Develop an internal audit programme and plan that covers all ISMS processes and Annex A controls within your scope. The auditor must be independent of the activities being audited, so either use staff from a different department, engage an external consultant, or use a combination. Conduct the audit systematically: review documentation, interview staff, observe processes, and examine evidence. Document findings as conformities, observations, minor nonconformities, or major nonconformities. Produce a formal audit report and present findings to management. Any nonconformities must be addressed through corrective actions before the certification audit. The internal audit is your rehearsal; treat it with the same rigour you would expect from an external auditor.
Phase 4: Certification and Beyond
The final phase brings together all your preparation into the formal certification process. Understanding what to expect from each stage of the audit, how to address findings, and how to plan for ongoing compliance will help you approach certification with confidence.
Step 14: Prepare for the Stage 1 audit
The Stage 1 audit, sometimes called the documentation review, is the first formal engagement with your certification body. The auditor reviews your ISMS documentation to assess whether your management system is designed to meet the requirements of ISO 27001 and whether you are ready for the Stage 2 audit. This is typically conducted on-site or remotely and lasts one to two days depending on scope.
Ensure the following are complete and available: ISMS scope statement, information security policy, risk assessment methodology and results, risk treatment plan, Statement of Applicability, internal audit report, management review minutes, and evidence of corrective actions from internal audit findings. The auditor will also confirm the scope, review the organisational context, evaluate resource allocation, and identify any areas of concern that must be resolved before Stage 2. Stage 1 findings are typically documented as opportunities for improvement rather than formal nonconformities, but significant gaps may require resolution before the Stage 2 audit can proceed.
Step 15: Complete the Stage 2 audit
The Stage 2 audit is the main certification audit where the auditor evaluates whether your ISMS is effectively implemented and operating as documented. This audit is conducted on-site (or via a combination of on-site and remote methods) and typically lasts three to five days, depending on the size and complexity of your scope.
The auditor will interview staff at all levels, observe processes in action, examine evidence of control operation, and verify that the ISMS is functioning as a coherent system rather than a collection of isolated controls. Expect questions about how risks were identified and treated, how incidents have been managed, how changes are controlled, and how the organisation monitors and measures information security performance. Be prepared with evidence that is organised, accessible, and traceable to specific controls and requirements. A GRC platform like Prova provides auditors with a structured view of controls, evidence, and risk treatment, significantly reducing the time spent locating and presenting documentation during the audit.
Step 16: Address nonconformities
If the Stage 2 auditor identifies nonconformities, you must address them before certification can be granted. Minor nonconformities typically allow certification to proceed, provided you submit a corrective action plan within a defined timeframe, usually 90 days. Major nonconformities generally require resolution and verification before certification is awarded, which may involve a follow-up audit visit.
For each nonconformity, conduct a root cause analysis to understand why the issue occurred, not just what the issue is. Develop a corrective action that addresses the root cause, not merely the symptom. Document the corrective action, assign an owner, set a completion date, and provide evidence of implementation to your certification body. Track all nonconformities and corrective actions in a central register. The rigour of your corrective action process itself demonstrates ISMS maturity, so treat nonconformities as improvement opportunities rather than failures. Organisations that respond to findings with thorough root cause analysis and systemic corrections consistently build stronger management systems.
Step 17: Plan for surveillance and continual improvement
Certification is not the finish line; it is the beginning of a three-year cycle. Your certification body will conduct surveillance audits, typically annually, to verify that your ISMS continues to conform to ISO 27001 requirements. At the end of the three-year cycle, a full recertification audit is required to renew your certificate.
Establish a continual improvement programme that includes regular internal audits, periodic risk reassessments, ongoing control monitoring, and scheduled management reviews. Track key performance indicators such as the number of security incidents, control effectiveness rates, risk treatment completion, and audit finding trends. Feed these metrics into your management review process to drive evidence-based decisions about where to invest in improvement. Build a calendar of recurring ISMS activities, including internal audit schedules, risk review dates, policy review cycles, training refreshers, and surveillance audit windows. Organisations that embed ISMS activities into their operational rhythm rather than treating them as periodic compliance exercises achieve significantly better outcomes at each surveillance audit and recertification.
Bringing it all together
Working through these 17 steps systematically transforms ISO 27001 from an abstract standard into a practical, operating management system. The key to success is treating certification not as a documentation exercise but as a genuine opportunity to strengthen your organisation’s information security posture.
Start early, scope carefully, and invest in the risk assessment process, as it drives every subsequent decision. Distribute ownership across the organisation rather than concentrating it in a single team. Use automation to reduce manual evidence collection and maintain continuous visibility into your control environment. And remember that the real value of ISO 27001 lies not in the certificate itself but in the disciplined, risk-based approach to information security that the standard demands.
Prova GRC helps organisations move from planning to certification faster by automating risk assessments, mapping controls to Annex A requirements, collecting evidence continuously, and providing audit-ready reporting. If you are ready to start your ISO 27001 journey, get in touch to see how Prova can help.