Questions organizations ask when a customer, contract or regulator asks for ISO 27001: cost, timeline, the certification process, scope, Statement of Applicability, risk assessment, audits and choosing or checking a certification body.
What ISO 27001 certification costs and why it varies: certification body audit fees across the three-year cycle, how audit time scales with the people in scope, internal effort, implementation and tooling, and how to keep each cost down.
The steps from deciding to certify to holding an ISO 27001 certificate: building the ISMS to clauses 4 to 10, the Statement of Applicability, choosing a certification body, the two-stage initial audit, the certification decision and the three-year cycle that follows.
How the two stages of the ISO 27001 initial certification audit work: what stage 1 checks and reports, the interval before stage 2, what stage 2 tests, how nonconformities are closed, and why pre-audits are not a substitute for stage 1.
How long ISO 27001 certification takes and what sets the pace: the work needed before stage 1, the gap between stage 1 and stage 2, the 6-month limit for closing major nonconformities, and the annual audits across the three-year cycle.
What happens after the ISO 27001 certificate is issued: an audit in every calendar year, what surveillance audits must cover, the recertification audit before the three-year cycle ends, and what happens if a certificate lapses or moves to another certification body.
How to choose an ISO 27001 certification body and check a certificate: what accreditation means, the standards accredited ISMS bodies follow, the Global ACI arrangement that replaced IAF in 2026, verifying certificates in IAF CertSearch, impartiality rules and switching bodies.
What the ISO 27001 Statement of Applicability is and what auditors check in it: the necessary controls, the comparison with all 93 Annex A controls, justification for inclusions and exclusions, implementation status, and keeping it in step with the risk treatment plan.
How an ISO 27001 gap analysis or readiness assessment works: comparing current practice with clauses 4 to 10 and the 93 Annex A controls, who can perform it, why a certification body's pre-audit has limits, and how the findings feed the implementation plan.
How ISO 27001 risk assessment and treatment work: the clause 6.1.2 and 6.1.3 requirements, performing assessments at planned intervals under clause 8.2, the link to the Statement of Applicability, ISO/IEC 27005 guidance and what auditors look for.
What ISO 27001 clause 9.2 asks of an internal audit and how to run one that a certification body accepts: the audit programme, independence from the certification body, guidance in ISO/IEC 27007 and ISO 19011, and how findings flow into management review.
How to set the scope of an ISO 27001 ISMS: the clause 4.3 requirement, which clauses cannot be excluded, how scope drives audit time through the people in scope, multi-site and remote organizations, and why the certificate's scope is what customers check.
Whether to implement ISO 27001 with a consultant or in-house: what the standard requires the organization itself to own, the guidance standards an in-house team can use, the separation rules between consultants, internal auditors and certification bodies, and how to judge outside help.
How ISO 27001 certification and a SOC 2 report differ for buyers: a certified management system versus a CPA's attestation report, who issues each, the cycles, the control sets, how customers verify them, and when organizations pursue both.
Whether any law requires ISO 27001 and who ends up needing it anyway: certification as a voluntary choice, customer and contract demands, how NIS2 and DORA relate, how bank regulators treat ISO reports, and when implementing without certifying is enough.
What ISO 27001 certification actually certifies and what it does not: a management system rather than a product, who issues certificates, accredited versus unaccredited bodies, the three-year cycle, the scope on the certificate and how buyers verify it.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.