For a CTO, ISO 27001 reduces to three artifacts you must be able to defend: the scope of the ISMS, the risk assessment and treatment process, and the Statement of Applicability. Controls come from that chain, not the other way around. Get those three right and the audit is a test of reality.
What are you actually building?
The standard asks for an information security management system, or ISMS, a managed set of policies, processes and controls that is established, implemented, maintained and continually improved. Its requirements run through clauses 4 to 10, from the context of the organization and leadership to operation, performance evaluation and improvement. An annex lists reference controls, with ISO/IEC 27002 supplying purpose and guidance. The edition is 2022, amended in 2024.
How should you set scope?
Scope should match what customers rely on. Draw the line around the production service, the pipeline that changes it, the identity systems, and the offices and vendors that touch customer data. A narrow scope is allowed, but the certificate then covers only that, and customers can see it. A scope that is too wide creates audit work for systems nobody cares about.
What does risk assessment require?
The organization must define and apply a risk assessment process that identifies risks to confidentiality, integrity and availability within scope, analyses their consequences and likelihood, and evaluates them against criteria. Then a risk treatment process chooses options and controls. The point for an engineering leader is that controls should trace to a risk you actually named.
Constructed example: a team enables full disk encryption on all laptops because a control list says so, but never records why. When an auditor asks about the risk behind it, nobody can answer. A better record says: risk of source code exposure through a lost laptop, likelihood medium, treated with disk encryption and remote wipe, owner is IT, reviewed twice a year. One line each, and the control survives scrutiny.
What is the Statement of Applicability?
It records the controls the organization has determined to be necessary, the justification for including them, whether they are implemented, and the justification for excluding any reference controls. The organization may draw controls from any source and compares them with the annex to be sure none was overlooked. Treat it as a living table owned by the security lead and reviewed by you.
What does the audit cycle look like?
An external audit has two stages, followed by a certification decision. Surveillance audits follow, the first within twelve months, then at least yearly, with recertification inside a three year cycle. In between, the standard expects internal audits, monitoring and management review, so the evidence trail has to be continuous.
Where do engineering systems provide evidence?
Access records, change history, vulnerability scan results, backup tests, incident tickets and training logs all support the controls in the Statement of Applicability. Decide which system is the system of record for each, and make exports easy.
What do teams get wrong?
They start with the control list and work backward. The result is a Statement of Applicability that claims controls nobody operates, which is worse than a short honest one. The other common error is scope drift: a certificate scoped to one product while new services quietly handle the same customer data. Revisit scope at every planning cycle, and ask whether a customer would be surprised to learn what sits outside it.
How to apply this
- Write the scope statement and get the CEO and CISO or equivalent to approve it.
- Define the risk criteria and run a first risk assessment with engineering, IT and product in the room.
- Build the Statement of Applicability from the risk treatment plan, not from a generic list.
- For each applicable control, name an owner and an evidence source.
- Schedule an internal audit before the external one and fix what it finds.
- Calendar the surveillance audit dates and the management review.
Quick check
What does the Statement of Applicability contain?
The controls determined necessary, the justification for including them, whether they are implemented, and the justification for excluding any reference controls.
How long is a certification cycle?
Three years, with surveillance audits at least once each calendar year and a recertification audit at the end of the cycle.
Sources
Last reviewed: 18 October 2026.
