If a customer, a tender or an investor has asked whether you are "ISO 27001 certified", you are not alone, and you do not need to be a security expert to understand it. This guide explains what it is, why it matters, and what happens next.
The short version
ISO 27001 is the international standard for managing information security. Think of it as a proven way to organise how your business protects its information, and a way to prove to others that you do it properly.
It is not a piece of software, and it is not a technical checklist for your IT team. It is a management system: written policies, clear responsibilities, regular risk checks and evidence that you follow them. The formal name for that system is an ISMS (Information Security Management System).
Why companies get it
Most organisations start because someone else asked:
- A customer sends a security questionnaire and wants proof, not promises.
- A tender or contract requires certification.
- An investor or board wants assurance before a deal.
- An insurer or partner asks how you protect sensitive data.
A certificate gives you one credible answer to all of these. Without one, each request becomes a fresh scramble, and deals can stall while you answer it.
What it covers
ISO 27001 looks at your whole organisation, not just your computers:
- People: who is responsible, how staff are trained, what happens when someone leaves.
- Processes: how you manage risks, suppliers, incidents and changes.
- Technology and places: how systems, data and offices are protected.
The 2022 version includes 93 security controls, grouped into four themes: organisational, people, physical and technological. You do not have to apply every control the same way. You choose the ones that fit your risks and explain why.
What certification actually means
Certification is an independent audit. An accredited certification body checks that your system works the way you say it does, and then issues a certificate.
- Consultants like VicByte help you prepare. We do not issue the certificate, and no consultant can.
- The first audit has two stages. Stage 1 reviews your documents. Stage 2 checks that you really follow them.
- The certificate lasts three years, with a check-up audit each year.
- You need to be working to the current 2022 version of the standard.
How the journey works
- Find out where you stand. A gap assessment scores your current controls and tells you what is missing.
- Build what is missing. Policies, risk management and controls are put in place and evidenced, which is the work of ISMS implementation.
- Check yourself. An independent internal audit finds problems before the certification body does.
- Get audited. The certification body completes Stage 1 and Stage 2.
- Keep it alive. Yearly check-ups, plus reviews as your business changes.
The time and cost depend on your size, scope and starting point. Our free tools give you an estimate for your situation.
Common misunderstandings
- "It is an IT project." It is a business system. IT is one part of it.
- "Once certified, we are safe." Certification shows you manage security properly. It does not make you unhackable.
- "It is a one-off." The standard expects continuous improvement, which is why there are yearly check-ups.
- "It is the law." Certification is voluntary, but customers, tenders and partners may require it.
Is it right for you?
It is usually worth considering if you sell to larger companies, government or regulated industries, handle other people's data, or keep losing deals to security questionnaires. If none of that is true yet, it is still reasonable to learn what you would need before you do.
Where to start
- Check where you stand. Our free Readiness Score takes about five minutes.
- See your timeline and cost. Our free tools estimate both for your size and scope.
- Talk to us. Book a free 15-minute call and we will walk through your plan.
Glossary
- ISMS: the written system of policies, roles and checks that manages your information security.
- Controls: the specific safeguards, such as access rules, backups and staff training.
- Gap assessment: a scored review of where you are compared with the standard.
- Risk assessment: working out what could go wrong and how serious it would be.
- Statement of Applicability: the document listing which controls you use and why.
- Internal audit: an independent check of your own system before the external audit.
- Certification body: the independent organisation that audits you and issues the certificate.
- Stage 1 and Stage 2: the two parts of the first certification audit.
- Surveillance audit: the yearly check-up during the three years the certificate lasts.
- Nonconformity: a place where you are not doing what the standard or your own rules require.