ISO/IEC 27001 ISMS implementation and certification readiness
A certificate is only as useful as its scope. We fix the scope first, build an ISMS that genuinely operates, then hand over to an accredited certification body.
By · AssureLane ResearchUpdated · Sources checked · 2026-10-10
Risk methodology, risk assessment and treatment plan
Statement of Applicability covering the 93 Annex A controls
Required procedures and record templates
Internal audit report and management review minutes
Stage 1 and Stage 2 preparation and nonconformity support
What we need from you
Entities, sites, products and services to certify
A management representative and departmental contacts
Existing policies, asset and supplier lists, architecture overview
A period of operation with retained records
Not included
Certification body audit and certificate fees (itemised)
Penetration testing (we can help arrange)
Any guarantee of certification
When this fits
European, Japanese or Singaporean buyers or channels ask for an ISO/IEC 27001 certificate;
Tenders or supplier onboarding list ISO 27001 as a prerequisite;
You want a management system that keeps running, not a one-off audit;
You plan to meet SOC 2 too: one programme, two audits.
How the engagement runs
Phase
Work
Typical duration
1. Scope & baseline
Define scope (entities, sites, products, processes); gap assessment
2–3 weeks
2. Design
Policy, objectives, risk method, risk assessment, treatment plan, SoA
3–6 weeks
3. Operate
Controls in place, training, records
1–3 months
4. Internal audit & review
At least one internal audit and management review
2–4 weeks
5. Certification
Stage 1, Stage 2, certification decision
Per certification body schedule
6. Maintain
Annual surveillance; recertification in year three
Yearly
Scope makes or breaks the certificate
Buyers check whether the certificate holder is the contracting entity, whether the scope covers the service they buy, and whether an accredited body issued it. See checking an ISO/IEC 27001 certificate’s scope.
Who does what
Certification is decided independently by an accredited certification body; advisers cannot issue certificates. On AssureLane projects, implementation is delivered by our partner firm; AssureLane scopes, coordinates and manages communication.
Who does what
01
AssureLane
Scoping, proposal coordination and project follow-through — your single point of contact.
02
Delivery partner
Professional delivery: gap assessment, policies and controls, evidence preparation, readiness review and coordination with the external auditor.
03
Independent firms
Independent CPAs issue SOC 2 reports; accredited bodies make ISO certification decisions. Advisers never issue either or guarantee outcomes.
Choose an accredited body whose accreditation covers ISO/IEC 27001, and check that your buyers recognise the accreditation body (e.g. UKAS, ANAB, CNAS). Certificates can be verified via the accreditation body or IAF CertSearch.
Are 2013-edition certificates still valid?
No. The transition to the 2022 edition ended on 31 October 2025.
General information only; not legal, audit or certification advice. Applicability, scope and professional responsibilities depend on your circumstances.