What is ISO 27001?
ISO/IEC 27001 is an international standard published by ISO and IEC. It defines the requirements for an Information Security Management System (ISMS): an organisational framework for protecting the confidentiality, integrity and availability of information through a continuous-improvement approach.
The current version is ISO/IEC 27001:2022, accompanied by an Annex A grouping 93 security controls across 4 themes (organisational, people, physical, technological). Certification is delivered by an independent accredited body, not by ISO itself.
Why pursue ISO 27001 certification?
Pursuing ISO 27001 certification means, above all, turning security into a commercial advantage and a mark of trust. For a growing number of organisations, certification is no longer a luxury: it conditions access to certain markets, because enterprise clients now require it in their RFPs and supplier questionnaires. Beyond the commercial case, the standard forces you to structure risk management for the long term rather than stacking up technical measures case by case. It reassures investors, partners and cyber insurers, and eases compliance with other frameworks (NIS2, GDPR, SOC 2) with which it shares many requirements. The benefits are both external — credibility, shorter sales cycles — and internal, with a real reduction in the likelihood and impact of incidents:
- Meet the requirements of enterprise clients who mandate it in their RFPs
- Stand out commercially and shorten sales cycles (fewer security questionnaires)
- Reassure investors, partners and cyber insurers
- Structure security sustainably rather than reacting case by case
- Ease compliance with other frameworks (NIS2, GDPR, SOC 2) that share many requirements
- Concretely reduce the likelihood and impact of security incidents
The steps to obtain ISO 27001
Obtaining ISO 27001 follows a clear, sequential approach, from initial scoping to the certification audit. You start by delimiting the ISMS scope, then run a risk analysis that serves as the foundation for everything else: the risks you identify determine which of the 93 Annex A controls to deploy, formalised in the Statement of Applicability. The system is then implemented and kept under tension by internal audits and a management review, because the standard rests on a logic of continuous improvement. Finally, an independent accredited body carries out the certification audit in two stages — documentation review then on-site audit — after which certification is granted for three years. Here are the six steps in detail:
1. Define the scope and context
Determine which services, sites and systems are in the ISMS, and identify interested parties and their requirements.
2. Perform the risk analysis
Map assets, identify threats and vulnerabilities, assess risks (EBIOS Risk Manager method or a scenario-based approach) and define acceptance criteria.
3. Build the risk treatment plan
Select the relevant Annex A controls, write the Statement of Applicability (SoA) and plan the treatment of residual risks.
4. Deploy the ISMS
Put in place policies, procedures and technical and organisational measures: access management, backups, incident management, awareness, etc.
5. Keep the system alive (internal audits, management review)
Conduct internal audits, address nonconformities and hold a management review — continuous improvement is at the core of the standard.
6. Pass the certification audit
The certification body runs a two-stage audit: documentation review (stage 1) then on-site implementation audit (stage 2). On success, certification is granted for 3 years.
How long and how much does it cost?
The timeline depends on your starting maturity: generally count 6 to 12 months for a first certification, sometimes more for a broad scope or an unstructured organisation.
The cost has two parts: the support (risk analysis, ISMS build-out, preparation) and the certification audit billed by the accredited body (varying with size and scope). Certification is valid for 3 years, with annual surveillance audits and a renewal audit in year 3. Well-run support strongly reduces the risk of audit failure, and therefore the total cost.
ISO 27001 for SMBs and startups: is it realistic?
Yes. The standard is deliberately adaptable to the size and context of the organisation: the scope, level of formality and chosen controls are proportionate to your real risks. An SMB or a SaaS startup can absolutely get certified, provided pragmatic support that avoids over-documentation.
The most common mistake is trying to document everything at once. An effective approach starts with a controlled scope, an honest risk analysis and controls that are actually applied — not a library of policies nobody reads.
My ISO 27001 support
NagaShield supports you end to end, as an outsourced CISO or on a dedicated engagement. I am a certified ISO 27001 Lead Implementer and have steered ISMS programmes in enterprise environments.
- Gap analysis against the standard’s requirements
- EBIOS risk analysis and prioritised treatment plan
- ISMS build-out: policies, procedures, Statement of Applicability
- Preparation for internal audits and the certification audit
- Proportionate documentation, designed to actually be used