ISO 27001 certification: a step-by-step guide

ISO 27001 certification comes down to five practical steps: define the scope of the Information Security Management System (ISMS), carry out the risk assessment, produce the Statement of Applicability, implement the applicable Annex A controls and pass the two-stage external audit. This guide covers what to do at each step and what the auditor usually checks, so your team reaches certification with less rework.

Key takeaways

ISO 27001 certification follows five steps: scope, risk assessment, Statement of Applicability, implementation of Annex A controls and a two-stage audit.
The Statement of Applicability links the risk assessment to the 93 Annex A controls: it records which are necessary, why, whether they are implemented and why the rest were excluded.
The certification audit has Stage 1 (documentation and readiness) and Stage 2 (implementation and effectiveness), followed by surveillance audits at least once a year over a three-year cycle.
Keeping the certificate is ongoing work: the ISMS requires monitoring, internal audit, management review and evidence that controls operate.
The certificate is issued by the certification body. A GRC platform helps reuse controls and evidence across ISO 27001, the LGPD, SOC 2 and the NIST CSF, but it does not certify.

The standard matters because it turns information security into an auditable process, with owners, records and deadlines, instead of good intentions scattered across spreadsheets. For customers and the board, the certificate is an independent assessment that the organisation manages information risk systematically within the certified scope.

What ISO 27001 is and why it matters

ISO/IEC 27001 is the international standard, published jointly by ISO and IEC, that specifies the requirements for establishing, implementing, maintaining and continually improving an ISMS. The current edition is the 2022 one (ISO/IEC 27001:2022), supplemented in 2024 by Amendment 1, which deals with climate change in the context of the organisation (ISO/IEC 27001:2022/Amd 1:2024). Annex A of the standard itself contains the list of reference controls. If your question is more basic, what the standard requires and what it is for, start with our guide to what ISO 27001 is.

The practical value is straightforward. Under clauses 4 to 10, the organisation has to understand its context and interested parties, identify risks to information and apply controls proportionate to those risks, with formal involvement from top management. The result is a common language between the technical team and leadership: the CISO talks about exposure, the CRO about enterprise risk and the board about decisions, all backed by the same body of evidence.

The numbers help justify the investment. According to the 2026 edition of the IBM Cost of a Data Breach Report, the global average cost of a data breach reached USD 4.99 million, up 12% on the previous year. A working ISMS does not eliminate incidents, but it helps reduce the chance that they happen and improves the response when they do.

Certification is not required by law in Brazil, but it often appears in contracts, public tenders and customer due diligence. It also helps demonstrate the technical and administrative security measures that article 46 of Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018) requires from anyone processing personal data. For the LGPD side, see our LGPD compliance checklist.

Scope, risk assessment and the Statement of Applicability

The first concrete step is to define the scope (clause 4.3). It sets which business units, processes, systems and locations sit inside the ISMS, and it must be documented. A well-designed scope avoids two opposite mistakes: trying to certify the whole company without the maturity to do so, or narrowing it so much that the certificate loses credibility with customers.

With the scope defined comes the risk assessment, the heart of the standard (clauses 6.1.2 and 6.1.3). Before assessing the first risk, the organisation must define in writing its risk assessment and risk acceptance criteria. After that, the work follows a clear sequence:

Identify risks to the confidentiality, integrity and availability of information within the scope, each with an owner (the risk owner). Many teams start from an inventory of assets, threats and vulnerabilities.
Analyse the consequences and likelihood of each risk to estimate its level.
Evaluate the risks against the defined criteria and prioritise them for treatment.
Choose the treatment: mitigate with controls, share or transfer (insurance, contract), accept, or avoid the activity that creates the risk, with risk owners approving the plan and the residual risk.

This prioritisation decides where effort goes. Documented likelihood and consequence criteria, applied consistently, are what separate a defensible assessment from a generic list the auditor will challenge. The standard does not require a specific method; ISO/IEC 27005 describes one possible path, and the 5×5 matrix is a market convention with known limits, discussed in our article on why the 5×5 matrix does not tell you what risk costs.

The end product of this phase is the Statement of Applicability, or SoA (clause 6.1.3 d). It lists the necessary controls, the justification for including them, whether they are implemented and the justification for excluding the Annex A controls left out. In practice, the SoA is one of the first documents the auditor examines: it connects the identified risks to control decisions and serves as the map for the rest of the audit.

Annex A controls and how to implement them

Annex A of the 2022 version contains 93 controls in four themes: organisational, people, physical and technological. Not all of them have to be applied. The selection follows from the risk assessment and is recorded in the Statement of Applicability. The full list, with the count per theme and the eleven controls new in 2022, is in our checklist of the 93 Annex A controls.

A few examples per theme make this tangible:

Organisational: information security policies, information security in supplier relationships and classification of information.
People: screening at hiring, awareness, and responsibilities after termination or change of employment.
Physical: physical entry controls and equipment security.
Technological: management of technical vulnerabilities, use of cryptography, logging and backup.

Lines of code and data on a screen representing IT systems and technological controls

Implementation does not end when the control is configured. The standard requires documented information as evidence that processes were carried out as planned, and the auditor will ask for records of operation over time: approvals, logs, tickets, reviews and minutes. This is where many teams stumble: the control exists, but the evidence is scattered across emails, spreadsheets and folders with no traceability.

Supplier management deserves special attention. In the 2026 Data Breach Investigations Report, Verizon reports third-party involvement in 48% of the breaches analysed (Verizon DBIR 2026). Structuring this control with clear assessment criteria at contracting and monitoring throughout the relationship gives the auditor something concrete to verify.

Preparing for the ISO 27001 certification audit

The certification audit is carried out by an independent certification body. Choose one accredited by a member of the IAF (International Accreditation Forum): that is what gives the certificate broad recognition. The rules of the process come from ISO/IEC 17021-1, and the audit takes place in two stages.

At Stage 1, the auditor reviews the documentation and readiness of the ISMS: scope, policy, risk assessment criteria and results, Statement of Applicability and the documented information the standard requires. It is a readiness check that flags gaps before the in-depth verification.

At Stage 2, the auditor assesses the implementation and effectiveness of the ISMS, on site or remotely. They select samples, interview owners and confirm that the controls described in the SoA actually operate. Nonconformities are graded as major or minor. For major ones, the certification body must verify the corrections and corrective actions before deciding on certification; for minor ones, it usually only needs to accept the action plan.

Before calling in the certification body, three preparations reduce the risk of surprises:

Run an internal audit covering the whole scope (clause 9.2) and address the findings.
Hold the management review (clause 9.3), with ISMS indicators presented to leadership.
Consolidate evidence that the controls operate in an organised, traceable repository.

The certification cycle lasts three years. During that period there are surveillance audits at least once a year, and recertification takes place before expiry. The transition period for the 2013 version ended on 31 October 2025 and the old certificates are no longer valid, so any new project targets the 2022 version. Maintaining compliance is therefore an ongoing activity that continues after the certificate is issued.

How a GRC platform helps maintain compliance

A large share of the ISO 27001 effort lies in keeping controls operating and collecting evidence year after year, especially when the same organisation also has to meet the LGPD, SOC 2 and the NIST CSF. Doing this in separate spreadsheets duplicates work and creates traceability gaps.

A GRC platform reduces that friction by centralising the control catalogue and reusing it across frameworks. Futture’s Eagle was designed for this: map a control once and reuse it across ISO 27001, the LGPD, SOC 2, the NIST CSF and other frameworks, with traceability down to each requirement. It also helps automate repetitive collection and workflows, monitors controls and evidence continuously and uses a human-in-the-loop model, in which AI suggests relationships and priorities and the decision stays with the team. To be clear: Eagle does not certify anyone or guarantee a pass. The certification body audits and issues the certificate; the platform supports preparing and maintaining the ISMS.

Instead of rebuilding evidence for every audit cycle, the team keeps a continuous flow that is closer to ready when the auditor arrives. For anyone evaluating a tool, the deciding criterion is end-to-end traceability between risk, control and evidence. The points that matter in that choice are in our guide GRC software: what it is and how to choose.

Next step

If ISO 27001 certification is on your horizon, start with the scope and the risk assessment: these two artefacts shape everything that follows and are the ones that delay projects most when left until the end. With the scope set and the risks prioritised, decide how evidence will be collected and stored before engaging the certification body, so the audit finds an ISMS already in operation rather than an effort put together in a hurry.

Further reading: GRC platform in Brazil: how to choose the right one.

Frequently asked questions

How long does ISO 27001 certification take?

It depends on the organisation’s maturity and size. For a mid-sized company with no prior ISMS, the typical range is 6 to 12 months, because the Stage 2 audit requires the system to be already running, with records, at least one internal audit and one management review.

How many controls are in Annex A of ISO 27001:2022?

There are 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). Not all of them have to be applied; the Statement of Applicability records which are necessary, why, whether they are implemented and the justification for each exclusion.

Is ISO 27001 certification mandatory in Brazil?

No law requires it in general. It is often requested in contracts, public tenders and customer due diligence, and the ISMS helps demonstrate the technical and administrative security measures that article 46 of the LGPD, Brazil’s General Data Protection Law, requires from data processing agents.

What is the difference between ISO 27001 and the LGPD?

ISO/IEC 27001 is a voluntary information security management standard; the LGPD (Law No. 13,709/2018) is Brazil’s personal data protection law. Certification is not the same as LGPD compliance, but the ISMS helps demonstrate the security measures the law calls for.

Can a GRC platform certify a company against ISO 27001?

No. Only a certification body, preferably an accredited one, issues the certificate after the audit. A GRC platform supports preparation and maintenance by organising controls, evidence and action plans, but it does not replace the audit or guarantee a pass.

ISO 27001: a step-by-step guide to certification