# ISO/IEC 27001 ISMS implementation and certification readiness

> A certificate is only as useful as its scope. We fix the scope first, build an ISMS that genuinely operates, then hand over to an accredited certification body.

Canonical page: https://assurelane.ai/en/services/iso-27001/
Updated: 2026-10-10 · Sources checked: 2026-10-10

## Deliverables

- ISMS scope and boundaries
- Information security policy and objectives
- Risk methodology, risk assessment and treatment plan
- Statement of Applicability covering the 93 Annex A controls
- Required procedures and record templates
- Internal audit report and management review minutes
- Stage 1 and Stage 2 preparation and nonconformity support

Typical timeline: Commonly 4–9 months to certification

## What we need from you

- Entities, sites, products and services to certify
- A management representative and departmental contacts
- Existing policies, asset and supplier lists, architecture overview
- A period of operation with retained records

## Not included

- Certification body audit and certificate fees (itemised)
- Penetration testing (we can help arrange)
- Any guarantee of certification

## When this fits

- European, Japanese or Singaporean buyers or channels ask for an ISO/IEC 27001 certificate;
- Tenders or supplier onboarding list ISO 27001 as a prerequisite;
- You want a management system that keeps running, not a one-off audit;
- You plan to meet SOC 2 too: one programme, two audits.

## How the engagement runs

| Phase | Work | Typical duration |
| --- | --- | --- |
| 1. Scope & baseline | Define scope (entities, sites, products, processes); gap assessment | 2–3 weeks |
| 2. Design | Policy, objectives, risk method, risk assessment, treatment plan, SoA | 3–6 weeks |
| 3. Operate | Controls in place, training, records | 1–3 months |
| 4. Internal audit & review | At least one internal audit and management review | 2–4 weeks |
| 5. Certification | Stage 1, Stage 2, certification decision | Per certification body schedule |
| 6. Maintain | Annual surveillance; recertification in year three | Yearly |

## Scope makes or breaks the certificate

Buyers check whether the certificate holder is the contracting entity, whether the scope covers the service they buy, and whether an accredited body issued it. See [checking an ISO/IEC 27001 certificate’s scope](https://assurelane.ai/en/insights/iso-27001-certificate-scope/).

## Who does what

Certification is decided independently by an accredited certification body; advisers cannot issue certificates. On AssureLane projects, implementation is delivered by our partner firm; AssureLane scopes, coordinates and manages communication.

## FAQ

### How do we choose a certification body?

Choose an accredited body whose accreditation covers ISO/IEC 27001, and check that your buyers recognise the accreditation body (e.g. UKAS, ANAB, CNAS). Certificates can be verified via the accreditation body or IAF CertSearch.

### Are 2013-edition certificates still valid?

No. The transition to the 2022 edition ended on 31 October 2025.

## Sources

- [ISO — ISO/IEC 27001:2022](https://www.iso.org/standard/27001)
- [ISO — Certification](https://www.iso.org/certification.html)

---
General information only; not legal, audit or certification advice. AssureLane does not issue SOC 2 reports or ISO certificates.