Build trust with ISO 27001 in 2024

ISO 27001 is an international standard for information security management systems (ISMS). It provides a framework for organisations to establish, implement, maintain and continually improve their information security processes and controls. The standard was developed by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).

The main objective of ISO 27001 is to help organisations protect the confidentiality, integrity and availability of their information assets. It provides a systematic approach to managing sensitive company information including financial data, intellectual property, employee details and customer information. The standard applies to all types and sizes of organisations, whether private, public, for-profit or non-profit.

The ISO 27001 standard is a set of requirements for operating an effective information security management system (ISMS). That management system is assessed and must adhere to those requirements to achieve certification. Those requirements extend to the implementation of specific information security controls, which can be selected from a prescribed appendix A in the ISO 27001 standard. The controls selected and implemented are included in a Statement of Applicability (SoA) to demonstrate how that mix of controls supports the ISMS objectives and forms a key part of meeting the ISMS requirements.

A Stage 1 audit should be commenced once you’ve implemented the mandatory requirements of the ISO 27001 standard; namely the ISMS framework. That will give you feedback on how it is set up, to ensure you’re on track for the Stage 2 audit and can address any identified non-conformities prior.

Stage 2 should commence once you’ve implemented all controls in the Statement of Applicability, or justified their exclusion. Any major non-conformities from the Stage 1 should have been remediated. You should also complete at least one cycle of the information security management system, including a management review and internal audit.

Major non-conformities are where your ISMS doesn’t meet the requirements of the ISO 27001 standard. Generally, these are significant gaps in the management system's overall design or the controls in the statement of applicability. In contrast, minor non-conformities may undermine the effectiveness of the ISMS or have a minor impact on the requirements of the ISO 27001 standard but don’t prevent it from achieving its goals or meeting the key requirements of the ISO 27001 standard.

Yes, it is possible to get certified with open non-conformities. That will generally only include minor non-conformities with a clear and reasonable action plan for when and how those non-conformities will be remediated. If there are a high number of minor non-conformities or major non-conformities, you are given up to 90 days to remediate those before the certification decision.

ISO 27001 follows a 3-year certification cycle. In the first year is the full certification audit. That’s either an initial certification audit when it’s the first time, or a re-certification audit if it’s following a previous 3-year certification cycle. These full certification audits cover all areas of your ISMS and review all controls in your Statement of Applicability. In the following two years, surveillance audits (scaled-down audits) are conducted to review the operation of the ISMS and some areas of the Statement of Applicability.