Quick answer
To pass ISO 27001 certification first time, define a realistic ISMS scope, run a documented risk assessment, select Annex A controls in a Statement of Applicability, collect evidence that the controls operate, and complete an internal audit and management review before the certification body's stage 1 audit.
What changed in ISO 27001:2022?
The 2022 edition kept the management system clauses largely the same but restructured Annex A.
| Area | ISO 27001:2013 | ISO 27001:2022 |
|---|---|---|
| Number of Annex A controls | 114 | 93 |
| Control grouping | 14 domains | 4 themes: organisational, people, physical, technological |
| New controls | None | 11, including threat intelligence and cloud security |
| Attributes | Not used | Optional attributes such as control type |
How should you define the ISMS scope?
Scope is the first decision and the one that most affects cost and timeline. Base it on what customers and contracts require: specific products, locations, teams and supporting infrastructure.
A scope that is too broad slows down certification. A scope that is too narrow may be rejected by customers. Document interfaces and dependencies such as cloud providers and outsourced teams.
How do you run an ISO 27001 risk assessment?
The risk assessment is the heart of the standard. Auditors will ask to see your methodology and how it drives control selection.
- Build an inventory of information assets and owners
- Identify threats and vulnerabilities for each asset
- Rate likelihood and impact on a consistent scale
- Decide treatment: reduce, avoid, transfer or accept
- Record decisions in a risk treatment plan
- Map selected controls in the Statement of Applicability
Which Annex A controls do auditors check most closely?
All applicable controls need evidence, but some are reviewed in depth because they are frequent sources of incidents.
| Control area | What auditors expect | Typical evidence |
|---|---|---|
| Access control | Least privilege and timely revocation | Quarterly access reviews, joiner-mover-leaver records |
| Vulnerability management | Regular scanning and testing | VAPT reports and remediation tickets |
| Supplier security | Vendor risk assessed | Vendor questionnaires and contracts |
| Logging and monitoring | Events reviewed | SIEM alerts and review records |
| Awareness training | All staff trained | Training completion reports |
What does the certification process look like?
Certification is performed by an accredited certification body in two stages. Knowing what each stage covers helps you prepare.
- Gap assessment and ISMS implementation (2 to 4 months)
- Internal audit by a competent, independent auditor
- Management review of ISMS performance
- Stage 1 audit: documentation and readiness review
- Stage 2 audit: evidence that controls operate in practice
- Close any non-conformities and receive the certificate
What are the most common reasons organisations fail?
The biggest problems are copied policy templates that do not match reality, missing evidence for controls, an incomplete risk register and internal audits done at the last minute.
Treat ISO 27001 as an operating system for security, not a project. Keep metrics, incident logs and corrective actions up to date between surveillance audits.
How KCyber Experts helps with ISO 27001
KCyber Experts supports ISO 27001 programmes end to end: gap assessment, risk assessment workshops, policy writing, VAPT and technical control testing, internal audits and audit-day support. As a CERT-In empanelled firm, our technical testing evidence is accepted by certification bodies and regulators alike.
Which documents does ISO 27001 require?
ISO 27001 requires a defined set of documented information. Keeping documents short, practical and owned by named people makes audits far easier than a large folder of generic templates nobody reads.
Auditors will sample these documents and then interview staff to confirm that what is written matches what actually happens. Where there is a mismatch, update the document to reflect reality or change the practice, then record the change.
- Name an owner for every policy
- Review documents at least annually
- Keep version history and approvals
| Document | Clause | Purpose |
|---|---|---|
| ISMS scope | 4.3 | Defines boundaries of the ISMS |
| Information security policy | 5.2 | States management intent and objectives |
| Risk assessment and treatment process | 6.1 | Explains how risks are rated and treated |
| Statement of Applicability | 6.1.3 | Lists Annex A controls and justification |
| Internal audit results | 9.2 | Proves independent review |
| Management review results | 9.3 | Shows leadership oversight |
Frequently asked questions
How long does ISO 27001 certification take?
Most mid-size organisations achieve certification in 3 to 6 months, depending on existing security maturity and scope.
Is ISO 27001 mandatory in India?
It is not legally mandatory, but many enterprise customers, government tenders and regulators expect it.
Does ISO 27001 require penetration testing?
The standard does not name pentesting directly, but technical vulnerability management controls are usually evidenced with VAPT reports.
How long is an ISO 27001 certificate valid?
Three years, with surveillance audits each year and a recertification audit at the end of the cycle.
Can a small startup get ISO 27001?
Yes. A focused scope and cloud-native controls make certification achievable for startups with small teams.
What is a Statement of Applicability?
The Statement of Applicability lists every Annex A control, states whether it is applied, and gives the justification for including or excluding it based on your risk assessment.
What is the difference between stage 1 and stage 2 audits?
Stage 1 reviews your documentation and readiness. Stage 2 tests whether controls actually operate, through interviews, sampling of records and observation of practices.
Can the same firm do our internal audit and implementation?
The internal auditor must be objective and impartial, so the people who built a control should not audit it. Many organisations use an independent external firm for the internal audit.