Information Security Management Systems
Protect the confidentiality, integrity and availability of data through controls, policy and secure practice.
Who it is for: SaaS, fintech and any organisation that holds client data or has to answer security questionnaires.
- Standard
- ISO/IEC 27001
- Edition
- 2022
- Abbreviation
- ISMS
- Discipline
- Information, privacy & AI
- Certification cycle
- 3 years
What ISO/IEC 27001 is actually made of
Like the other standards here, ISO/IEC 27001 follows Annex SL, the common high-level structure. Clause 8 is where it becomes specific to information security; the rest is the spine you would build for any of them.
- 4Context of the organisationIssues, interested parties, scope, and the system itself.
- 5LeadershipCommitment, policy, and assigned roles and authorities.
- 6PlanningRisks and opportunities, objectives, and planning for change.
- 7SupportResources, competence, awareness, communication, documented information.
- 8OperationFor ISO/IEC 27001: Information security risk assessment and treatment, applied through the 93 Annex A controls.
- 9Performance evaluationMonitoring, internal audit, management review.
- 10ImprovementNon-conformity, corrective action, continual improvement.
Four stages to ISO/IEC 27001:2022
Each stage has one defined output. You always know what has been produced and what is next.
- 1Findings report
Gap analysis
Every clause assessed against how you work today, delivered as a written finding list with owners and effort.
- 2Documented system
Documentation
Manual, procedures, forms and records written around your operation. Auditors sample records, not documents.
- 3Audit evidence
Implementation and training
Staff trained, controls in use, the internal audit run and the management review held.
- Certificate issued
Certification audit
Stage 1 and Stage 2 with the registrar, and support closing any non-conformities they raise.
Notice: WCA Global is a consultancy and advisory firm. We prepare your organisation for certification against ISO/IEC 27001:2022; the certificate is issued independently by an accredited third-party registrar.
ISO/IEC 27001, answered
The questions we are asked most before an engagement starts.
Ask something elseHow long does ISO/IEC 27001 certification take?
For a single site, typically eight to twenty weeks from gap analysis to Stage 2, depending on the package and your size. The variable is almost never us. It is how quickly your team can produce the records the standard requires, because several clauses need evidence accumulated over weeks.
Do you issue the certificate?
No, and no consultancy should. WCA Global prepares your organisation; an accredited third-party registrar audits it and issues the certificate. Anyone offering to consult and certify is offering a certificate that a serious customer will not accept.
Which edition applies? Is 2022 current?
ISO/IEC 27001:2022 is the edition we implement against. Where a newer edition is published mid-engagement there is normally a transition period, and the documented system is built so the change is a revision rather than a rewrite.
What happens after the certificate?
The certificate runs on a three-year cycle: surveillance audits in years one and two, recertification in year three. A system that stops being used between audits fails surveillance, which is why the retainer exists.
Can we certify against more than one standard at once?
Yes, and it is usually cheaper than doing them in sequence. The shared clauses reuse the context, leadership, planning, support and evaluation work already done. We quote additional standards at 55% for that reason.
Usually certified alongside
Privacy Information Management System
Extends ISO/IEC 27001 and 27002 with requirements for managing privacy information.
Artificial Intelligence Management System
Govern AI systems — manage risk, and demonstrate transparency, ethics and responsible use.
Business Continuity Management Systems
Prepare for disruption, maintain operations, and recover quickly when something goes wrong.
Get a figure for ISO/IEC 27001.
The quote builder uses our published multipliers: package, headcount, sites and deadline. Additional standards are priced at 55%.