ISO 27001 Full ISMS · Stage 1 and Stage 2

A management system, not a folder of templates.

ISO/IEC 27001 is the international standard for managing information security. It is not a checklist of technical controls: it is a structure for deciding which risks matter to your business, doing something about them, and proving that both of those keep happening after the auditor goes home.

Why template packs fail

You can buy a complete set of ISO 27001 documentation for a few hundred pounds. Policies, procedures, registers, the lot, with a space for your logo. Plenty of organisations have done exactly that and then failed Stage 2, which is a genuinely demoralising way to spend a year.

They fail because the standard does not audit your documents. It audits whether the management system described by those documents is the one you are actually running. An auditor asks to see the last management review, the internal audit findings and what you did about them, the risk assessment that led to a decision, and the evidence that a control you claim to operate was operating last Tuesday.

A template cannot produce any of that, because none of it is a document. It is a habit. The job of implementation is building something small enough that your organisation will keep doing it, and real enough that it answers the question.

That is also the honest argument for doing less. A tight scope with a system that genuinely runs will pass, and a sprawling scope with an aspirational one will not.

The short version

Clauses 4 to 10 are the management system. These are the mandatory requirements and they are what gets audited.
Annex A is the control catalogue. 93 controls in four themes. You pick the ones that apply, and justify the ones that do not.
The Statement of Applicability is the pivot. It links your risks to your controls and is the first document most auditors open.
Two audit stages. Stage 1 checks you are ready. Stage 2 checks the system works.
Then it keeps going. Surveillance audits annually, full recertification on a three year cycle.
4 to 9 months to Stage 2 for most small and medium businesses.

The system Clauses 4 to 10

Seven parts, all of them audited.

This is the part people skip towards Annex A and regret. Nothing in the control catalogue saves you if the system underneath it is not there.

Context and scope

What you are certifying, and why

Who your interested parties are, what they require of you, and where the boundary of the management system sits. The scope statement ends up printed on your certificate, so it has to be both defensible and specific enough to answer the customer who asked for it in the first place.

This is the single most consequential decision in the project. Too wide and you are securing things nobody asked about. Too narrow and the certificate does not cover the service your customer cares about, which makes it expensive wallpaper.

Leadership

Owners, not a mention in a policy

An information security policy, roles and responsibilities that are assigned to named people, and demonstrable commitment from whoever runs the business. Auditors test this by talking to those people, so it cannot be delegated entirely to a consultant and it cannot be fictional.

Planning and risk

The engine of the whole standard

A repeatable way of identifying risks, assessing them, deciding what to do and recording why. Out of it come the risk treatment plan, the Statement of Applicability and your security objectives.

Repeatable is the word that matters. Two people assessing the same risk should land in roughly the same place, and you should be able to run the assessment again next year and compare. A one-off workshop that produced a beautiful spreadsheet is not a method.

Support

People, awareness, documents

The resources, competence, awareness training, internal communication and document control that keep the system alive. Document control is unglamorous and it is where tidy projects quietly fall apart: version numbers, approvals, and one unambiguous current copy of everything.

Operation

Actually doing it

Running the processes you designed, carrying out the risk assessment and treatment on the schedule you set, and keeping the records that show it happened. This clause is short to read and is most of the work.

Performance evaluation

Monitoring, internal audit, management review

Measuring whether the controls work, auditing yourself before anybody else does, and a management review where the people in charge look at the results and make decisions that get written down.

An internal audit with no findings is a red flag rather than a good sign. An auditor reads it as either an audit that did not look, or an audit that looked and was not willing to write anything down.

Improvement

What you did when something went wrong

Nonconformities get recorded, their causes get addressed and the fix gets checked. A system with a handful of honestly logged problems and visible corrective action is far more convincing than one that claims a perfect year.

Annex A 93 controls, four themes

The controls, applied to your business.

Annex A is a catalogue to select from, not a list to implement wholesale. The Statement of Applicability records which you apply, how, and why the rest do not apply to you. The second half of that sentence is where honesty pays.

A.5

Organisational

37 controls. Policies, roles, supplier relationships, incident management, continuity, legal and contractual requirements. The largest theme and the one most often underdone, because it is the least technical.

A.6

People

8 controls. Screening, terms of employment, awareness and training, disciplinary process, what happens when somebody leaves, and remote working. Small in number, frequently the weakest in practice.

A.7

Physical

14 controls. Perimeters, entry, equipment, clear desks, secure disposal, and working in places that are not your office. If your team is fully remote this theme needs thought rather than dismissal.

A.8

Technological

34 controls. Access, cryptography, logging, malware, backups, secure development, network security and change control. This is the theme that overlaps most with Cyber Essentials, which is why doing that first is rarely wasted.

The route 4 to 9 months

Gap analysis, build, Stage 1, Stage 2.

The timeline varies with how much exists already and how quickly your own people can turn things around. Nothing here can be compressed past the point where the system has to have been running long enough to produce evidence.

Gap analysis and scope

Two to four weeks. What you already have against what the standard needs, and the scope decision made properly rather than assumed. You get a plan with an order and an honest view of the date.
Build the system

Two to six months. Risk method, risk assessment, treatment plan, Statement of Applicability, the policies and the controls, all written about how your business actually runs. The parts your staff have to live with get designed to be liveable.
Run it, then Stage 1

The system has to operate before it can be audited: an internal audit done, a management review held, records accumulating. Stage 1 is a documentation and readiness review by the certification body, and its findings are a gift rather than a setback.
Stage 2, and after

The full audit against the standard, including interviews with your people and sampling of evidence. Then surveillance audits annually and recertification on a three year cycle, which is why the system had to be liveable.

I am not the certification body and I am not your auditor. Stage 1 and Stage 2 come from an accredited certification body, independent of the person who built the system, which is what makes the certificate worth anything to the customer who asked for it. I prepare you for both and am there through them. See why that separation matters.

The work Consultant or implementer

Direction, or the whole thing.

As a consultant

The method and the scope, set properly at the start, with the risk approach designed to be repeatable by your own team.
Policies drafted, your team adapts them to how you actually work, and I review what comes back before it is relied on.
Internal audit and management review run with you the first time, so the second time you can do it yourselves.
Through both audit stages, including the questions nobody prepared for.

As the implementer

I build the management system, rather than hand you a list of documents to write while you also run a business.
Technical controls configured, not just specified: access, logging, backups, device management, the lot.
The evidence trail established, so the records exist for the period the auditor will sample.
Handed over working, with somebody in your team who knows how it runs and what they owe it each month.

How long: 4 to 9 months; To Stage 2, for most small and medium businesses. The floor is set by needing the system to have genuinely operated, so a tender closing in six weeks is a conversation about Cyber Essentials instead.
How it is priced: Scoped, then fixed; A scoping call and a look at what exists, then a fixed number for the implementation. Scope is the biggest variable by a distance, which is why it is decided before a price rather than after.
The certificate: Paid direct, not marked up; The audit fee goes to an accredited certification body at their price, paid by you direct. Budget for the surveillance audits too: this is an ongoing commitment rather than a one-off purchase.

FAQ ISO 27001

Do you do ISO 27001 implementation?

Yes, and I have taken organisations through it before. It is a full information security management system rather than a document pack: scope and context, the risk assessment and treatment plan, the Statement of Applicability, the Annex A controls applied to how your business actually works, and the internal audit and management review an auditor will ask to see. For most small and medium businesses it runs 4 to 9 months to Stage 2. The certification audit itself comes from an accredited certification body rather than from me, so the evidence has to stand up on its own.

Are you a certification body or an assessor?

No, and it is worth being clear about it. Cyber Essentials certificates are issued through IASME by a licensed certification body, and ISO 27001 certificates by an accredited certification body. I am the person who gets you ready for them, and in the hands-on version the person who does the work that gets you ready. You pay the certifying body their fee direct, at their price, with nothing added by me. Anybody who implies they can both prepare you and hand you the certificate is worth a second question.

We have a tender deadline. Can you work to it?

Often, yes, and the date belongs in the first email rather than week three. Cyber Essentials is usually 2 to 4 weeks, so a tender closing next month is realistic. Cyber Essentials Plus has to follow within 3 months of the Cyber Essentials pass, which fixes the order those two happen in. ISO 27001 is 4 to 9 months for most small and medium businesses, so if a contract closes in six weeks and the form asks for ISO 27001, the useful conversation is about what you can honestly say by then, not about compressing a management system into a fortnight.

Cyber Essentials, the quicker route

Contact Let's talk

Thinking about
ISO 27001?

It is the biggest piece of work on this site and the one most often started for the wrong reason. Tell me who is asking for it and by when, and I will tell you honestly whether it is the right target, or whether Cyber Essentials answers the question you have actually been asked.

dave@daveellis.dev

Edinburgh · Working with businesses across Scotland, the UK and worldwide

LinkedIn GitHub