The road to ISO/IEC 27001:2022 certification
A management system, not a control checklist. What the standard actually requires, why Stage 1 audits fail, and the records auditors ask for that nobody thinks to keep.
The transition window closed on 31 October 2025. Certificates against ISO/IEC 27001:2013 are no longer valid, and every new or renewed certificate is against the 2022 revision: 93 Annex A controls organized into four themes rather than 114 across fourteen domains. If a supplier shows you a 2013 certificate today, it has expired.
ISO 27001 certifies a management system. The 93 controls in Annex A get most of the attention, but they are the appendix. Clauses 4 through 10 are the standard, and they are where certification is won or lost.
Read this if
- You sell into Europe, the UK, or to enterprises that ask for ISO rather than SOC 2
- You want a certificate rather than an attestation report
- You already hold SOC 2 and want to reuse the work
- You are being asked for ISO by a customer who will not accept anything else
What the program actually looks like.
Durations assume a first attempt with a team that has other work to do. They are the numbers we would give you on a call, not the ones in a sales deck.
Define scope and context
3 to 5 weeksClauses 4 and 5. Determine the boundary of the management system, identify interested parties and their requirements, and secure genuine leadership commitment. A scope statement that is too broad is the most expensive mistake available at this stage, and it is nearly impossible to narrow later.
Risk assessment and Statement of Applicability
4 to 6 weeksClause 6. Establish a repeatable risk methodology, run it, and produce a risk treatment plan. The Statement of Applicability then records all 93 Annex A controls with a decision and a justification for each, including the ones you exclude.
Build the management system
6 to 12 weeksClause 7 and the Annex A controls you have accepted. Policies, procedures, competence and awareness, documented information control. This is the bulk of the build, and the point where most organizations discover their existing documentation does not meet the requirement.
Operate and generate records
3 to 6 monthsClause 8 and 9. The system has to run and produce evidence. Auditors will ask what you did, when, and who approved it. Records created retrospectively are visible as such and will be treated accordingly.
Internal audit and management review
3 to 5 weeksClause 9.2 and 9.3. Both are mandatory and both must happen before Stage 2. The internal audit must be performed by someone independent of the area being audited, which usually means not the person who built the ISMS.
Stage 1 audit
1 to 2 days, then 4 to 8 weeksThe certification body reviews your documentation and readiness. Failures here are almost always missing management system records rather than missing technical controls. You then get a gap to close whatever they found.
Stage 2 audit and certification
3 to 5 daysThe full assessment of implementation and effectiveness. Findings are graded as minor or major nonconformities; majors must be closed before the certificate issues.
The five things that consume the calendar.
None of these are the parts people budget for, and all of them are the parts that slip.
- The risk assessment, done properly rather than as a spreadsheet completed in an afternoon.
- The Statement of Applicability, because 93 justifications is genuinely a lot of writing.
- Accumulating operational records, which is calendar time and cannot be compressed.
- Internal audit, which needs a competent and independent person you may not have.
- Certification body scheduling, which can add six to ten weeks if you leave it late.
What moves the number.
Two organizations of the same size can differ several-fold on price. This is usually why.
- Scope: number of locations, legal entities and systems included
- Headcount, which drives certification body audit days directly
- How much documented management system already exists
- Whether you need an external internal auditor
- Certification body choice, where accreditation matters more than price
What you have to produce.
Every one of these will be asked for. Missing any of them is a finding.
| Artifact | What it has to contain |
|---|---|
| Scope statement | The boundary of the ISMS, precise enough to appear on the certificate |
| Information security policy | Approved by top management, not by IT |
| Risk assessment methodology and register | Repeatable, documented, with owners and treatment decisions |
| Statement of Applicability | All 93 Annex A controls, each included or excluded with justification |
| Risk treatment plan | What you are doing about the risks you did not accept |
| Objectives and measurements | Security objectives with actual numbers against them |
| Internal audit program and reports | Independent, covering the whole ISMS over the cycle |
| Management review minutes | Covering every input the standard lists |
| Corrective action records | Findings raised, root cause, action, verification |
Five failures we see repeatedly.
Each of these turns a manageable program into an expensive one. All five are avoidable at the start and very hard to fix in the middle.
Treating Annex A as the standard
Teams implement 93 controls beautifully and fail Stage 1 because there is no management review, no internal audit, and no evidence the risk assessment drove any of it. Clauses 4 to 10 are the certifiable part.
A scope statement written too wide
Certifying the whole organization when the customer only cares about one platform multiplies the audit, the evidence and the ongoing burden. Narrowing scope after certification means a new scope and effectively starting over.
Copying someone else's Statement of Applicability
The SoA has to reflect your risk assessment. An auditor who finds justifications that do not match your own risk register has found a systemic problem, not a paperwork one.
Internal audit performed by the ISMS owner
Clause 9.2 requires objectivity and impartiality. Auditing your own work is a nonconformity in itself, regardless of how well the audit was done.
Retrospective records
A year of management review minutes written the week before Stage 2 is obvious to anyone who has audited before. The dates, the language and the absence of any disagreement all give it away.
What people ask us about ISO 27001.
How long from a standing start?
Is ISO 27001 harder than SOC 2?
Can one program cover both ISO 27001 and SOC 2?
What is the difference between accredited and unaccredited certification?
What happens after we are certified?
Keep reading
The road to a SOC 2 report
What the year actually looks like, where the time really goes, and the five ways companies turn a four-month project into a fourteen-month one.
The road to CMMC, and what the Phase 2 suspension changed
The certification timeline moved. The obligations did not. What defense contractors actually have to do right now, and why pausing your program would be the expensive reading of the news.
Want this run for you?
We run these programs end to end: scoping, control design, evidence, auditor management, and the operating rhythm that keeps year two boring.