ISO 27001 Readiness: What Gets You Certified

Radiatus Engineering Security Published 28 May 2026 Updated 4 Oct 2026 4 min read

ISO/IEC 27001 certification signals to customers and partners that you manage information security systematically — and increasingly it's a procurement requirement. But the standard is about building a real, working Information Security Management System (ISMS), not producing a binder of policies nobody reads. Here's what actually gets you through certification, based on how we run ISO 27001 readiness programs.

Know which version you are implementing

The current edition is ISO/IEC 27001:2022. Its Annex A contains 93 controls grouped into four themes — organisational, people, physical and technological — replacing the 114 controls of the 2013 edition. The transition period for 2013 certificates ended on 31 October 2025, so any new program should target the 2022 edition directly. The supporting guidance standard, ISO/IEC 27002:2022, explains each control in more detail.

1. Define your scope honestly

Scope determines everything that follows. Be precise about which products, locations, teams, systems and data are in and out, and document the interfaces with things outside the scope (shared IT, outsourced services). An over-broad scope makes certification harder than it needs to be; an artificially narrow one undermines the trust the certificate is meant to convey — customers do read scope statements.

2. Run a gap assessment

Compare what you do today against both the management-system clauses (4–10: context, leadership, planning, support, operation, performance evaluation, improvement) and the Annex A controls. The output is a prioritised list of what exists, what's partial and what's missing. Teams are often further along than they think on technical controls such as access and backups, and further behind on the management-system parts: risk methodology, internal audit and management review.

3. Build the risk engine

Risk assessment and treatment are the heart of ISO 27001. You need:

• A documented, repeatable method to identify, analyse and evaluate risks
• A risk treatment plan with owners and due dates
• A Statement of Applicability (SoA) listing every Annex A control, whether it applies, why, and whether it is implemented
• Evidence that you revisit risks on a schedule and when things change — not just once for the audit

Spreadsheets work for a while, but they get painful at the first surveillance audit. Our GRC Platform keeps the risk register, SoA, policies and control evidence together; our GRC & risk management service helps you set up the method itself.

4. Close gaps with real controls

• Access control, MFA and joiner/mover/leaver processes, with periodic access reviews
• Logging, monitoring and an incident response process you've actually exercised
• Change management and secure development practices
• Vulnerability management, including regular scanning and penetration testing
• Supplier and third-party risk management (including cloud providers)
• Business continuity and backups you've verified by restoring
• Security awareness training with records of completion

Most of these are engineering work, not paperwork — which is why we pair compliance people with cloud and security engineers rather than handing you templates.

5. Collect evidence continuously

Auditors want proof that controls operate over time, not a snapshot taken the week before. Automating evidence collection — access reviews, backup restore tests, vulnerability scan results, training records — turns audit preparation from a fire drill into a routine export.

6. Run the management-system loop before the audit

Two requirements are routinely left too late: an internal audit of the ISMS (by someone independent of the work being audited) and a management review where leadership looks at the results and decides on improvements. Both must have happened, with records, before the certification audit.

7. Understand how certification works

Certification is carried out by an accredited certification body — not by a consultant, and not by Radiatus. It usually happens in two stages: a Stage 1 review of your documentation and readiness, then a Stage 2 audit of whether the ISMS is implemented and effective. Certificates are typically valid for three years, with surveillance audits in between and a recertification audit at the end.

Certification is a milestone, not the goal. The goal is an ISMS that genuinely reduces your risk — the certificate is external confirmation that it works.

A structured readiness program typically takes a few months, depending on scope and how much already exists. Starting with a gap assessment tells you how long yours will take. If you also handle health data or EU personal data, see how ISO 27001 overlaps with HIPAA, GDPR and SOC 2 — much of the evidence can be reused.