An ISO 27001 project involves management, IT, HR, procurement and day-to-day operations. Use these steps to agree an owner, outcome and decision point for each stage. Start with the ISO 27001 guide if you are still deciding whether the standard fits your customers' requirements.
1. Define the purpose, scope and ownership
Record the customer requirement or organisational objective behind the project. Then describe the services, locations, systems, teams and suppliers within scope. A certificate should clearly correspond to the services a customer receives.
Also ask at the outset whether the customer requires accredited certification. Make this decision at the start of your project so that you can provide the right evidence.
Management should set the direction, resources and responsibilities. Appoint one coordinator, but assign substantive actions to the people who know the processes. The result is a defined project with decision-makers and allocated time.
2. Compare current practices with the standard
Identify what already works and what is missing. During the initial assessment, look at both implementation and evidence: a written procedure without an owner or records is not yet a demonstrably effective process. Use ISO/IEC 27001:2022 and the applicable amendments as your reference. View the official ISO publication.
Assess risks using consistent criteria, select controls and record who approves the treatment and residual risks. Connect the risk assessment, treatment plan and Statement of Applicability. These are interrelated elements, not separate form-filling exercises. BSI explains these connections in its self-assessment.
Turn the findings into an action list with priorities, owners and the evidence required. This shows which actions need attention first and which depend on a supplier or management decision.
3. Develop controls and gather evidence
For each control, agree what someone will do, how often and where the result will be kept. Reuse existing records, such as tickets, HR arrangements and supplier assessments. Do not store sensitive customer data in a generally accessible audit file.
Practical parts of the evidence file include the scope, policies, risk assessment, treatment plan, Statement of Applicability and records of checks. The ISO 27001 checklist helps you record the owner, status and evidence for each item. With the Compliance Tool you can organise tasks, documents and improvement actions in one place.
4. Assess internally and discuss the findings
Plan an internal audit and management review. The internal audit should examine design and operation; record findings and follow-up. Management reviews the results and decides on the improvements and resources needed. These activities form part of the recurring evaluation of the ISMS. See chapters 9 and 10 of the BSI implementation guide.
Ensure the auditor can assess objectively and does not audit their own implementation work. Explore our internal audit support and agree the scope, independence, reporting and follow-up in advance. An internal audit does not provide a certificate.
5. Choose your certification route and maintain the system
External certification can be accredited or non-accredited. The difference concerns recognition of the certification body. The appropriate route also depends on the requirements of your customer, contract or tender.
Accredited certification
Choose a certification body accredited for ISO 27001 and the relevant certification activities. That body assesses your management system and makes the certification decision. DCA can help you prepare for this audit. Check the accreditation and scope in the RvA register.
On this route, the initial certification audit has two stages. Stage 1 assesses the arrangements and readiness; stage 2 examines implementation and evidence. Agree with the body which records and interviewees are needed. BSI describes the certification process.
Non-accredited certification
DCA can also help with this route. Following a separate assessment, DCA can issue a non-accredited ISO 27001 certificate if sufficient objective evidence is available and any deficiencies have been resolved. This is a separate engagement; implementation support or an internal audit does not automatically provide this certificate. Read about our approach to non-accredited certification.
Agree in advance who provides guidance, who assesses, who decides and how impartiality is safeguarded. Before choosing, check whether this form of certification will be accepted. A non-accredited certificate does not automatically replace a required accredited certificate. Clearly state its status when using it.
ISO explains the distinction; the RvA explains what the scope of accreditation means.
After the audit, plan follow-up of findings, periodic checks and future audits. Certification is not the endpoint of managing the system. Keep changes to services, systems and suppliers within normal working arrangements.
How much internal time and support are needed?
There is no reliable standard number of internal hours for every organisation. Budget time for interviews, gathering information, adapting processes, implementing controls, checks and decision-making. Allocate this across the coordinator, management and process owners. Also allow time for remedial actions.
DCA can support the initial assessment, planning, development and audit preparation, or carry out agreed implementation work. You provide organisational knowledge, carry out the agreed actions and remain responsible for formal decisions. Record the allocation for each work package as part of implementation support.
Support starts at 4 hours per week, at rates from €120 per hour: an average of €2,080 per month excluding VAT. Software, internal hours and external certification are separate budget items. See the prices and calculator and the ISO 27001 cost breakdown.
Frequently asked questions
Which documents should you prepare?+
Start with the scope, policies, risk assessment, treatment plan and Statement of Applicability. Add evidence of implementation, internal audits, management review and improvement actions. The standard and your scope determine the further detail required.
How long does ISO 27001 certification take?+
The duration depends on your starting point, scope, internal capacity and improvements. Plan after an initial assessment and agree audit availability with the certification body; support does not include a guaranteed completion time.
Who decides on the certificate?+
For accredited certification, the decision is made by a certification body accredited for that activity. DCA can also issue a non-accredited certificate following a separate assessment. Agree the scope, roles, conditions and acceptance in advance. Guidance or an internal audit does not itself provide a certificate.
Want to fill in an initial overview? Use the free online audit preparation checklist for scope, ownership and evidence. This general resource is not a full ISO 27001 assessment and does not provide a certificate.
Sources for this article
- ISO: ISO/IEC 27001:2022 and amendmentsAccessed on 19 September 2026
- BSI: ISO/IEC 27001:2022 implementation guideAccessed on 19 September 2026
- BSI: ISMS self-assessmentAccessed on 19 September 2026
- BSI: certification processAccessed on 19 September 2026
- ISO: certification and accreditationAccessed on 7 October 2026
- Dutch Accreditation Council (RvA): accredited bodiesAccessed on 19 September 2026
- Dutch Accreditation Council: certification, accreditation and scopeAccessed on 7 October 2026
Explore this topic further
This is general guidance and does not replace an assessment of your situation or the official standard.