ISO 27001 certifies a management system, not a product. If you are the first security hire, your month-one job is to decide the scope, the risk assessment method and who owns what, then choose an accredited certification body. The control list comes after those choices, not before.
What is the standard actually asking for?
ISO/IEC 27001 asks an organization to run an information security management system (ISMS): define scope, assess risks, choose controls, operate them, audit yourself, and have leadership review the results on a schedule. The 2022 edition keeps that structure and reorganizes the Annex A control list into four themes (organizational, people, physical, technological).
The standard text is sold by ISO and national standards bodies, so this post describes the structure only. Confirm clause details against your own copy before you write policy.
Which decisions can you not undo cheaply?
Three choices shape everything that follows.
Scope. Scope is the boundary of what the certificate covers: products, sites, teams, and the systems that support them. A narrow scope (one SaaS product and its production environment) is faster to certify. A wide scope is more convincing to some buyers. Write down what is out and why, because an auditor and your customers will both read it.
Risk method. You need a repeatable way to score risks and a threshold for acceptance. A spreadsheet with likelihood and impact on a five-point scale is acceptable if you apply it the same way every time. Changing the method halfway through is what creates audit findings.
Ownership. Each risk and each control needs a named owner who is not you. If the security hire owns everything, the ISMS stops working the day they go on leave.
What does the Statement of Applicability do?
The Statement of Applicability lists every Annex A control, says whether you apply it, and gives a reason. It is the document auditors read first. An honest "not applicable, we have no physical server room" is better than a control claimed with no evidence behind it.
A constructed example: a 40-person SaaS company excludes controls on secure areas for offices because staff work remotely and the data lives with a cloud provider. The exclusion is written down, tied to the scope statement, and reviewed yearly. That is a passing pattern.
How does certification work in practice?
You hire a certification body, ideally one accredited by a national accreditation body. The audit usually runs in two stages: a documentation review, then an assessment of whether the system operates. Certificates are generally issued for a cycle of several years with annual surveillance audits in between. Ask your chosen body to confirm the exact cycle and fees in writing.
Run an internal audit and a management review before the external audit. Both are required, and both are cheap ways to find gaps while they are still private.
How to check or apply this
- Write a one-page scope statement: products, locations, systems, exclusions.
- Choose and document a risk scoring method. Run it once on your top 20 assets.
- Assign an owner for every risk and every applicable control.
- Draft the Statement of Applicability. Give a reason for every exclusion.
- Collect evidence as you go: access reviews, change tickets, training records, backup tests.
- Schedule the internal audit and management review at least a month before the external audit.
- Ask two accredited certification bodies for quotes and sample audit plans.
If your evidence lives in tickets, repositories and cloud consoles, tooling that collects it automatically saves real hours. Safeguard offers compliance automation and dependency inventory that can feed an evidence trail, but the certificate comes from an auditor, never from software.
Quick check
Can one person implement ISO 27001 alone?
They can drive it, but they cannot own it. The standard expects leadership commitment and named control owners across engineering, HR and IT.
Does ISO 27001 prescribe specific technical controls?
No. It requires you to choose controls based on your risk assessment and justify the choice. Annex A is a reference list, not a mandatory checklist.
Sources
- ISO/IEC 27001:2022, published by ISO and national standards bodies (paywalled; not fetched for this post, so clause-level details need checking against your copy).
- NIST Cybersecurity Framework, for how a framework differs from a certifiable management system standard.
Last reviewed: 18 October 2026.
