ISO 27001 Compliance: Requirements, Checklist and Implementation

Timelines vary depending on organisational size, existing security maturity, and scope. Smaller organisations with a defined scope and automated tooling can achieve audit-readiness in three to six months. Larger organisations with complex environments typically take nine to eighteen months. The most common delay is not technical: it is the time required to collect and organise evidence that controls are operational. Starting with a structured gap analysis accelerates every subsequent phase.

ISO 27001 certification is not legally mandated by EU law. However, NIS2 Article 21 requires essential and important entities to implement security measures that closely mirror ISO 27001’s control requirements. Several EU member states and regulated sectors are beginning to reference ISO 27001 in procurement contracts and regulatory guidance. In practice, for B2B companies handling sensitive data, ISO 27001 certification is increasingly a commercial requirement even when it is not a legal one.

ISO 27001 is the standard that specifies ISMS requirements and is the basis for certification. ISO 27002 is a companion guidance document that provides detailed implementation guidance for each of the 93 Annex A controls listed in ISO 27001. You are certified against ISO 27001. ISO 27002 tells you how to implement the controls that certification requires. Both documents are updated in the 2022 revision and should be used together.

The standard requires internal audits at planned intervals and a management review at least annually. Surveillance audits by the certification body occur annually in the years between full recertification cycles, which happen every three years. In practice, risk assessments and control effectiveness reviews should happen continuously, not just at audit time. Changes in your organisation, threat landscape, or supplier relationships should trigger reviews outside the scheduled cycle.

Yes. ISO 27001 is scope-scalable. A small company with a narrow, well-defined scope can implement a compliant ISMS with significantly less effort than a large enterprise. The key is not to over-scope. Define what information assets genuinely need protecting, apply controls proportionate to risk, and evidence what you have done. Small organisations often find that the discipline of ISO 27001 compliance reveals control gaps that were costing them operationally, making the investment worthwhile beyond the certification itself.

If a surveillance audit identifies major non-conformities, the certification body may suspend or withdraw certification until the issues are remediated and verified. Minor non-conformities typically result in a corrective action plan with a fixed remediation window. Repeated minor non-conformities across audit cycles can be escalated to major status. Suspension of certification must usually be disclosed to customers and partners who rely on it for procurement or contractual purposes, which makes maintaining a continuously compliant ISMS a commercial as well as a regulatory priority.