Guide 02

Prepare for ISO/IEC 27001

Most first ISO/IEC 27001 projects fail on scope and evidence, not on technology. This is the order the work actually goes in.

Independent guidance from Synergy. ISO/IEC 27001 and ISO 22301 are published by ISO/IEC, which has no affiliation with Synergy and has not reviewed this material. This material is provided for informational purposes only and does not constitute compliance or legal advice. Always work from the published text of the standard.

A certification project has a shape. Five steps, in this order, and the order is not negotiable — the Statement of Applicability cannot be written before the risk assessment, and the internal audit cannot test controls that were never implemented.

Steps one to three are a few weeks of work for one person. Steps four and five are where the timeline actually goes, and by then you will know exactly why.

1. Scope the ISMS — Decide what the certificate will actually cover, before you write a single policy.
2. Assess the risk — A risk assessment that produces a list nobody acted on is worse than none, because it is evidence against you.
3. Write the Statement of Applicability — The SoA is the most-read document in your audit pack. It is also the one most often filled in carelessly.
4. Implement and evidence — This is the step that takes the time. Everything before it was preparation for it.
5. Run the internal audit and review — The dry run is not a rehearsal for the auditor. It is the last moment you can find out something is missing cheaply.