How to implement ISO 27001: a practical step-by-step guide

ISO 27001 is the most widespread information security standard in the world and one of the most searched-for by IT and compliance leaders. That is no coincidence: customers, insurers and regulators increasingly ask for it as proof that security is managed with method. But if you want to implement ISO 27001, filling in templates will not get you there. It is about building a management system that works when nobody is auditing it.

After many years supporting organisations in banking, insurance, energy and public administration, this is the practical guide I wish I had the first time.

What ISO 27001 is and what it is not

ISO/IEC 27001 sets out the requirements for an Information Security Management System (ISMS). The current version is 2022, and the deadline for organisations certified against the 2013 version to transition ended on 31 October 2025. In 2024 an amendment was added requiring climate change to be considered when analysing the organisation’s context.

The standard has two parts that should not be confused:

• Clauses 4 to 10: the management system requirements. Context, leadership, planning, support, operation, performance evaluation and improvement. They are mandatory without exception.
• Annex A: a catalogue of 93 controls grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological. Not all are mandatory: you apply those your risk analysis justifies.

ISO 27001 is neither a technical checklist nor a project that ends with the certificate. It is a way of governing security continuously.

How to implement ISO 27001 step by step

1. Management commitment and scope

Without management on board, the ISMS dies at the first budget round. The first deliverable is a clear scope: which processes, locations, systems and services are included. A scope that is too broad makes the project unmanageable; one that is too narrow leaves out what the customer wanted to see certified.

2. Context and interested parties

Which legal, regulatory and contractual requirements apply to you. In regulated sectors, ISO 27001 coexists with NIS2, DORA, Spain’s ENS or the GDPR. Designing it with that overlap in mind saves a lot of work, as I explained in the article on the regulatory overlap between DORA, NIS2, ENS and the AI Act.

3. Asset inventory and risk analysis

This is the heart of the system. You identify assets, threats and vulnerabilities, assess the risk and decide how to treat it: mitigate, transfer, avoid or accept. The methodology matters less than consistency and traceability. I covered this in cybersecurity risk management.

4. Statement of Applicability

The Statement of Applicability lists the 93 Annex A controls and, for each one, whether it applies, why and its status. It is the document auditors look at most, because it links risks to measures.

5. Treatment plan and control implementation

This is where the real work is: policies, procedures, technical controls and training. Access management, backups, vulnerability management, suppliers, continuity, incident response. Prioritise by risk, not by ease.

6. Training and awareness

People are part of the system. Every employee must know what is expected of them and how to report an incident. A generic annual course is not enough.

7. Measurement, internal audit and management review

Before calling the certification body, the system must have been running: indicators measured, a full internal audit, nonconformities addressed and a formal management review.

8. Certification

The certification audit has two stages. The first reviews documentation and readiness. The second checks that the system works in practice. The certificate runs on a three-year cycle, with annual surveillance audits and recertification at the end.

How long it takes and what it costs

In my experience, a mid-sized organisation with some prior maturity needs between six and twelve months to reach certification with a real system. Less time usually means a paper ISMS that crumbles at the first surveillance audit. The cost depends mainly on scope, starting point and how much of the work is done in-house.

Mistakes I often see

• Buying a template pack and thinking that is the ISMS. Generic documents do not survive an interview with the auditor.
• Leaving everything to IT. Information security includes HR, procurement, legal and the business.
• Forgetting suppliers. Much of your risk sits outside your network. See how to assess suppliers in your supply chain.
• Treating continuity as an annex. Continuity controls fit naturally with ISO 22301 and with sound immutable backups.

ISO 27001 in a world with AI

If your organisation uses or develops AI systems, the ISO 27001 ISMS is the natural foundation for adding ISO 42001, the AI management system standard. They share a structure, which allows one integrated system instead of two parallel bureaucracies. And in the public sector, the relationship with Spain’s National Security Framework (ENS) deserves its own analysis.

ISO 27001 consulting: how I can help

If you would rather not do it alone, I run the ISO 27001 implementation as what it is: a project with a scope, a plan and owners. My work covers:

• Gap analysis against the standard and scope definition.
• Asset inventory, risk analysis and Statement of Applicability.
• Treatment plan and prioritisation of the Annex A controls.
• Internal audit and management review before certification.
• Support during the certification body’s audit.

I also design the system so it works for the ENS, NIS2 or DORA when they apply to you, without duplicating controls or evidence. If you want to assess your case, get in touch and we can discuss it in a 20-minute call.

Conclusion: a system, not a certificate

The ISO 27001 certificate opens commercial doors, but its real value lies in what it forces you to do: know your risks, decide with judgement and prove you comply. If you implement ISO 27001 properly, it becomes the skeleton on which NIS2, DORA, the ENS and AI governance rest.

If you are considering certification or your ISMS needs a serious review, I can help you lead the project with method. Let’s talk.

Frequently asked questions about implementing ISO 27001