In brief
ISO/IEC 27001:2022 is the international standard with requirements for an information security management system. Our implementation runs in five phases – from gap analysis to support during the certification audit – and the certificate is issued by an independent accredited certification body. For entities under NIS2, the system is a systematic and demonstrable basis for most risk management measures.
Who is ISO 27001 implementation for?
- companies required to certify by customers, tenders or insurers;
- entities under NIS2 that need a demonstrable risk management system;
- software companies and cloud service providers;
- manufacturing companies with interconnected IT and OT environments.
How does ISO 27001 implementation work?
The project runs in five phases. Each ends with the handover of defined deliverables; workshops take place at your premises, with regular coordination meetings in between.
-
Current state analysis
Review of documentation, processes and systems, interviews with management and key staff, context of the organisation, interested parties and system scope.
Deliverable: gap analysis report with an action plan and a defined ISMS context and scope.
-
Processes and asset inventory
Inventory of business processes and information assets (hardware and software, data, services, people, locations), assignment of owners, valuation by confidentiality, integrity and availability, and a technical review.
Deliverable: asset register, process inventory and summary of the technical review findings.
-
Risk assessment
Assessment methodology, likelihood and impact assessment, acceptable risk levels and selection of Annex A controls.
Deliverable: methodology, risk register, risk treatment plan and Statement of Applicability (SoA).
-
Documentation
Top-level policy, ISMS manual, objectives and indicators, and the policies and procedures for Annex A controls – from access management to incident and supplier management.
Deliverable: ISMS documentation ready for management approval.
-
Implementation and certification readiness
Implementation of controls, training of staff and management, internal audit, management review, correction of nonconformities and support during the certification audit (stage 1 and stage 2).
Deliverable: internal audit report, management review minutes and readiness for the certification audit.
What do you get?
| Deliverable | Phase |
|---|---|
| Gap analysis report with an action plan | 1 |
| Information asset register and process inventory | 2 |
| Summary of the technical review findings | 2 |
| Risk assessment methodology and risk register | 3 |
| Risk treatment plan and Statement of Applicability (SoA) | 3 |
| ISMS policies and procedures | 4 |
| Internal audit report and management review minutes | 5 |
| Support during the certification audit and response report | 5 |
Why does implementation include a technical review?
A certification auditor checks not only documents but also whether controls work in practice. In the second phase we therefore carry out a technical review: vulnerability scanning, discovery of shadow IT, checks of network equipment configurations and segmentation, backups and privileged access, and a review of supplier contracts. The findings feed directly into the risk assessment and the selection of controls.
How does ISO 27001 relate to NIS2, the CRA and other standards?
- NIS2: a system to ISO/IEC 27001 covers most risk management measures; self-registration, reporting of significant incidents and management accountability must be handled separately. ISO 27001 and NIS2 compared
- CRA: the controls for technical vulnerability management (A.8.8) and secure development (A.8.25–A.8.29) are the starting point for the processes the Cyber Resilience Act requires for products. More on the CRA
- ISO 22301 and ISO 9001: the same structure of requirements allows one integrated management system with one internal audit and one management review.
- ISO/IEC 27701:2025: for privacy management, available since the 2025 edition as a stand-alone standard that can be certified.
What happens after certification?
The certificate is valid for three years. During this period the certification body carries out a surveillance audit at least once a year, and a recertification audit before it expires. The system must be maintained throughout: risks reassessed, internal audits and management reviews carried out and staff trained. We can take this over as maintenance or vCISO.
How much does ISO 27001 implementation cost?
The price depends on the scope of the system, your current maturity and the availability of your people. We prepare a proposal with phases, deliverables and a timeline after the initial consultation. The certification body's fees are not part of our proposal. The cost structure is explained in detail in How much does ISO 27001 cost in Slovenia.
Frequently asked questions about ISO 27001
Who issues the ISO/IEC 27001 certificate?
An independent accredited certification body of your choice. The audit has two stages: in the first, the body reviews documentation and readiness; in the second, how the system works in practice.
Is an ISO 27001 certificate mandatory under NIS2?
No. NIS2 does not require a certificate, but it does require risk management measures and evidence that they work. A system to ISO/IEC 27001 is a systematic basis for this, and the certificate independently confirms that the system works.
What is the Statement of Applicability (SoA)?
A document that states, for each Annex A control of the standard, whether it applies, why it is included or excluded, and whether it has been implemented. It is one of the key documents reviewed by the certification auditor.
How long is an ISO 27001 certificate valid?
Three years. During this period the certification body carries out a surveillance audit at least once a year, and a recertification audit before the certificate expires.
Do we have to write all documentation from scratch?
No. We review existing policies and procedures – for example from an ISO 9001 system or from data protection – integrate them into the system and add only what is missing.
Sources
- ISO/IEC 27001:2022 – Information security, cybersecurity and privacy protection – Information security management systems – Requirements (ISO)
- Directive (EU) 2022/2555 (NIS2), EUR-Lex
Last updated: · Prepared by the Regulus Ai team
Would you like an estimate of scope and timeline for your organisation?
Book an initial consultation