ISO 27001 compliance guide: how to achieve compliance?

What is ISO 27001?

ISO 27001 describes how to govern information security in a systematic manner. The core of the standard is not a list of tools, but a process: understanding your context, identifying your assets and risks, deciding how to treat them, implementing the measures and verifying that they work.

The standard distinguishes between the ISMS requirements (clauses 4 to 10, mandatory for certification) and the security measures in Annex A (a catalogue of controls to be selected according to risks). This architecture makes the approach adaptable to any organisation.

The 2022 version modernised Annex A: 93 controls grouped into four themes (organisational, people, physical, technological), with new controls reflecting the cloud, cyber threats and data protection.

Who is affected?

ISO 27001 is aimed at any organisation wishing to structure and demonstrate its information security. It is particularly relevant for organisations that handle sensitive data or sell to demanding clients.

• Software publishers and SaaS companies, for whom certification is often a commercial prerequisite.
• IT services companies, hosting providers and IT suppliers managing their clients' systems.
• Organisations subject to NIS2 or DORA, which leverage their ISMS.
• Any organisation handling sensitive or strategic data.

The Annex A controls (2022 version)

The 93 controls in Annex A are grouped into four themes. You do not apply all of them blindly: you select those that address your risks and justify your choices in the SoA.

The Statement of Applicability (SoA) lists all controls and justifies each inclusion or exclusion.

The key documents of the ISMS

ISO 27001 requires a precise documentary foundation, which forms the core of audit evidence.

• The ISMS scope and security policy.
• The risk assessment method and results.
• The risk treatment plan.
• The Statement of Applicability (SoA).
• Operational procedures and evidence of implementation.
• Internal audit reports and management review records.

What penalties apply in the event of non-compliance?

ISO 27001 is a voluntary standard: no fines, but major commercial and regulatory stakes. Certification is increasingly becoming a market access criterion.

How to achieve compliance: the 7-step roadmap

Step 1 — Define the context and scope

Identify internal and external issues, interested parties and their expectations, then delimit the scope of the ISMS. A well-defined scope (one entity, one product, one site) makes initial certification achievable.

The scope must be coherent: only include what you can genuinely control and demonstrate.

• Analyse the context and interested parties.
• Define a realistic scope.
• Identify applicable legal and contractual requirements.

Step 2 — Secure management commitment

Management must champion the security policy, set objectives, allocate resources and assign responsibilities. Without this sponsorship, the ISMS remains theoretical and fails at audit.

Formalise governance: a security committee, defined roles, and regular reporting.

• Have the security policy validated by management.
• Set measurable security objectives.
• Assign roles and allocate resources.

Step 3 — Conduct the risk assessment

Choose a methodology, inventory your assets, identify threats and vulnerabilities, then evaluate and prioritise risks. This is the core of the standard: everything else flows from it.

Document the methodology and risk acceptance criteria, as auditors will require both.

• Inventory your information assets.
• Identify and evaluate threats and vulnerabilities.
• Prioritise risks against documented criteria.

Step 4 — Establish the risk treatment plan and the SoA

Decide, for each risk, whether to treat, accept, transfer or avoid it. Select the relevant Annex A controls and formalise the Statement of Applicability (SoA), which justifies each inclusion or exclusion.

The SoA is a central document that auditors examine in depth.

• Formalise the risk treatment plan.
• Select the relevant Annex A controls.
• Draft and justify the Statement of Applicability.

Step 5 — Deploy the controls

Implement the organisational, human, physical and technological measures selected: policies, awareness, access control, encryption, logging, incident management and supplier management.

Document the implementation: in an audit, evidence is what counts, not intentions.

• Deploy the selected controls and their procedures.
• Raise awareness and train staff.
• Build a body of evidence of effective operation.

Step 6 — Audit and review

Conduct internal audits to verify the effectiveness of the ISMS, hold a management review and correct any gaps. This is the engine of continual improvement required by the standard.

These exercises directly prepare you for the certification audit.

• Plan and conduct internal audits.
• Hold a management review.
• Correct non-conformities and track corrective actions.

Step 7 — Achieve and maintain certification

Choose an accredited certification body, undergo the Stage 1 audit (documentary review) and then the Stage 2 audit (implementation review), close any non-conformities and obtain the certificate, valid for three years.

Maintain it through annual surveillance audits and a renewal audit: security is a continuous effort.

• Select an accredited certification body.
• Undergo the Stage 1 and then Stage 2 audits.
• Maintain the certificate through surveillance audits.

Common mistakes to avoid

• Targeting too broad a scope for an initial certification, which lengthens and complicates the process.
• Treating the ISMS as a documentary project disconnected from actual practices.
• Rushing through the risk assessment, which nevertheless underpins the entire coherence of the system.
• Neglecting the SoA or providing weak justifications for control exclusions.
• Forgetting awareness-raising, even though the human factor is central.
• Viewing certification as a finishing line rather than a cycle to be maintained.