You can implement ISO 27001 yourself by working through ten steps: get leadership commitment, set scope, assess risk, choose controls, write the Statement of Applicability, implement and document, train people, run an internal audit, hold a management review, then book the two stage audit with a certification body. Plan on several months and a named owner.
What does the standard require?
ISO/IEC 27001:2022 specifies an information security management system. Clauses 4 to 10 are mandatory: context, leadership, planning, support, operation, performance evaluation and improvement. Annex A lists 93 reference controls in four themes, which you select from based on risk. Certification is granted by an accredited certification body after an audit, normally in two stages: a documentation review, then an assessment of whether the system is implemented and operating. The ISO page returned a 403 to our fetch, so this plan follows the published structure and common practice. Read the licensed text before you write documents.
What are the ten steps?
Step 1, commitment and owner. Top management approves the effort and names an ISMS owner. Clause 5 puts leadership accountability on them. Output: an approved ISMS policy.
Step 2, scope. Define products, locations, people, systems and suppliers inside the boundary, plus exclusions with reasons. Output: a scope statement and interface list.
Step 3, risk method. Decide how you identify, score and treat risk, who accepts it and at what level. Output: a risk assessment procedure.
Step 4, risk assessment. List assets, threats and weaknesses, score them and decide treatment. Output: a risk register and treatment plan.
Step 5, controls and the Statement of Applicability. For each Annex A control record whether it applies, why, and whether it is implemented. Output: the SoA.
Step 6, implement and document. Write short policies and procedures that match what people do, and apply the technical controls. Output: policies, configurations and records.
Step 7, awareness and competence. Train staff, record role competence and communicate the policy. Output: training records.
Step 8, measure and audit internally. Define what you measure, then have someone independent of the work audit the ISMS against the standard and your own documents. Output: internal audit report and corrective actions.
Step 9, management review. Top management reviews performance, audit results, risks and resource needs, and records decisions. Output: minutes.
Step 10, certification audit. Choose a certification body, pass Stage 1 on documentation, then Stage 2 where operation is examined. Fix any nonconformities and track the surveillance cycle after.
Who does what?
The owner coordinates. Engineering implements technological controls. HR handles screening, terms and training. Facilities or office leads handle physical controls. Finance or procurement handles supplier reviews. Top management signs off scope, policy, risk acceptance and the review.
What evidence will the auditor sample?
Scope, policy, risk method and results, the treatment plan, the SoA, competence and training records, internal audit results, management review minutes and corrective action records. For controls, expect samples such as an access review, a change, a backup restore and an incident.
What mistakes cost time?
- Copying a template pack that describes controls you do not run.
- Scoping to avoid the real production system.
- Skipping the internal audit or doing it as a formality.
- Running the management review as a status meeting with no decisions recorded.
- Leaving operation too late, so Stage 2 finds too little history.
What to do
- Get management sign off and name the ISMS owner.
- Draft scope and risk method in the first month.
- Complete the risk assessment and SoA.
- Implement controls, starting with access, logging and backups.
- Run training, then the internal audit, then the management review.
- Book Stage 1 and Stage 2 with a certification body once you have operating evidence.
Quick check
Can a company implement ISO 27001 without a consultant?
Yes, if someone is accountable and reads the standard. The audit is done by a certification body either way.
What is the Statement of Applicability?
A document listing every Annex A control, whether you apply it, why, and its implementation status.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires. Instead of screenshots, evidence is collected from connected systems and code, and technical proof such as vulnerability management comes from your real dependencies through scans, SBOMs and reachability. Monitoring runs between audits, so surveillance visits find fewer surprises and your team keeps time for other work. Safeguard's agent can open tested fix pull requests for vulnerable dependencies. It is off by default, every category starts on Manual, and you choose which categories run automatically and the approval level. An accredited certification body decides certification. Safeguard helps you prepare and keep evidence ready. Book a call to see it.
Sources
- ISO/IEC 27001 page on iso.org, not retrievable (HTTP 403) on 18 October 2026, so claims are kept general
Last reviewed: 18 October 2026.
