ISO 27001 implementation brings together the people, decisions, processes and controls your business uses to manage information security. Done well, it gives leadership a clearer view of risk, helps staff make consistent decisions, and provides evidence customers can rely on when deciding whether to trust you with their information.
Most implementations that stall do not stall on the controls. They stall because nobody agreed why the business was doing it, or because the scope was wrong from the start and every later decision inherited the problem. This guide follows the order that avoids that: why, then scope, then the risks and controls they drive, then the people, cost, certification route and the work of keeping it running afterwards.
What is an information security management system?
An information security management system is the organised way a business manages risks to its information. It brings together responsibilities, policies, working processes, controls and evidence of performance.
It covers information in systems, documents and conversations, including information handled by suppliers. Its purpose is to protect confidentiality, integrity and availability: who can access information, whether it remains accurate, and whether it is available when needed.
ISO/IEC 27001 sets the requirements for establishing, implementing, maintaining and continually improving that system. It is a management system standard rather than a checklist: it does not prescribe particular products or settings, but requires you to understand your risks, treat them proportionately and show the whole arrangement is managed and improved over time. That is why a twelve person consultancy and a two hundred person manufacturer can both be fully compliant with very different controls.
Certification is a separate decision, made by an independent certification body after assessing the system within its defined scope. A business can benefit from implementing the standard before it seeks certification, but where a customer requires a certificate, the scope and certification route need to meet that customer’s requirements.
What are the benefits?
The value comes from how the system changes decisions and working practices.
Better investment decisions. A useful risk assessment shows leadership which issues threaten important services and where spending makes the greatest difference.
Stronger customer assurance. When customers ask how you manage access, suppliers or incidents, an operating management system lets you give consistent answers backed by evidence. Certification can support access to work that requires it, although it cannot guarantee a contract.
More dependable operations. Agreed processes make joiners, leavers, supplier changes and new systems consistent. People know who acts and how completion is checked.
Greater resilience. Clear responsibilities and exercised recovery arrangements help teams respond when something goes wrong, and the lessons feed back into improvement.
Clearer accountability. Risks and actions have owners, and leadership can see what is overdue and resolve competing priorities.
These benefits depend on the system being used. A policy becomes useful when people understand it, can follow it, and know how to raise a problem.
Start with why you are implementing it
Before anything else, write down the problem you are trying to solve. For most organisations it is one of these, or a combination:
- A tender or contract requires it. The most common trigger, and a perfectly good one.
- It helps you win work. You compete against certified organisations, or bid for work where demonstrating how you manage information security is a differentiator.
- Your clients expect it. Supplier assessments keep getting more detailed, and a certified management system answers most of them at once.
- You want genuine assurance. Leadership wants confidence that information security is managed properly, regardless of external demand.
It does not matter which applies. What matters is knowing, because the reason shapes the scope, sets the timeline, keeps leadership engaged, and prevents the most common failure of all: a system built only to obtain a certificate, which nobody runs once it arrives.
Why ISO 27001 needs leadership
ISO 27001 requires active support from top management, not just awareness. Leadership sets the direction, provides resources, and ensures information security is integrated into how the organisation works. In practice that means agreeing the purpose, supporting objectives, assigning responsibilities, giving people time to do the work, and reviewing performance when resources or priorities conflict.
The UK Government’s mapping of its Cyber Governance Code of Practice to ISO 27001 connects leadership, resource allocation and management review directly with effective governance.
An illustrative example: IT identifies that removing a leaver’s access depends on a manager remembering to send an email. Fixing it needs HR, line managers and IT to agree a reliable notification and verification process. Leadership gives that work an owner, resolves disagreements and makes sure departments take part. A consultant can facilitate the discussion and help design the process, but management has to support the decision and see it adopted.
Define your scope properly
Scope is the first real decision you make, and almost everything that follows depends on it. The standard requires you to determine the boundaries of the management system and document them, taking account of the issues that affect you, what interested parties such as customers and regulators require, and the interfaces and dependencies where your activities meet those of other organisations: the cloud platform you host on, the provider running your infrastructure, the outsourced payroll bureau.
What a scope statement should settle
- Which parts of the organisation are included: the whole business, particular divisions, services or products
- Which locations are included, including remote and home working arrangements
- Which information and systems are within the boundary
- Which people are covered, including contractors
- What the exclusions are, and why they are justified
The three most common scope mistakes
Too broad, too soon. Certifying the entire organisation on the first attempt is admirable and frequently the reason projects run for eighteen months. A well-defined scope covering the services your customers care about can be certified first, then expanded.
Too narrow to be useful. A scope drawn so tightly that it excludes the systems your customers actually rely on. The certificate exists but does not answer the question the customer was asking, and because the scope statement is visible on the certificate, the carve-out is obvious.
Ignoring the dependencies. Outsourced services do not leave scope because someone else operates them. You remain responsible for managing the risk they introduce, through supplier assessment, contractual security requirements and evidence that you monitor them.
Your reason defines your scope. Scope defines what you are protecting. What you are protecting defines your risks. Your risks define which controls you need. Every later decision inherits the first ones, which is why an hour spent on the reason and the scope saves weeks of implementing controls that do not fit.
Understand the standard before building the system
The implementation team needs to understand how the requirements fit together.
Clauses 4 to 10 cover the management system itself: organisational context, leadership, planning, support, operation, performance evaluation and improvement. These cannot be excluded when claiming conformity, as the IEC’s description of ISO/IEC 27001 explains.
Annex A provides a reference set of 93 controls, organised in four themes:
| Theme | Controls | Examples |
|---|---|---|
| Organisational | 37 | Policies, roles, supplier relationships, incident management, threat intelligence |
| People | 8 | Screening, awareness and training, terms of employment, remote working |
| Physical | 14 | Secure areas, equipment protection, clear desk, physical security monitoring |
| Technological | 34 | Access control, secure configuration, logging, backup, secure development |
Not every Annex A control is compulsory. Controls are selected to treat your risks and meet relevant legal, contractual and organisational requirements, then compared against Annex A to check nothing important has been overlooked. Additional controls may also be needed.
The result is recorded in a Statement of Applicability: every Annex A control, whether it applies, its implementation status, and the justification for including or excluding it. A control is included because a risk in your scope requires it and excluded because none does. “Not applicable” without a reason is one of the most frequent findings at certification, and the Statement of Applicability is also the document customers most often ask to see.
Give staff clear roles and appropriate training
People need to understand how their work contributes to information security.
| Role | Practical responsibilities |
|---|---|
| Directors and senior managers | Set direction, provide resources, review performance and support decisions about significant risks |
| Management system lead | Coordinate the system, maintain visibility of actions and report issues requiring decisions |
| Line managers | Authorise appropriate access, communicate staff changes and ensure their teams follow relevant processes |
| HR | Coordinate joining, role changes, departures and relevant training records |
| Procurement and supplier owners | Set security requirements and monitor important supplier relationships |
| IT and system owners | Operate assigned controls, manage changes and retain evidence that processes work |
| Staff and relevant contractors | Handle information appropriately, follow applicable procedures and report concerns promptly |
Training should reflect those responsibilities. A new employee needs to know how to share information safely and report a suspected incident. A risk owner needs to understand how to evaluate and treat a risk. An internal auditor needs the competence to plan an audit, assess evidence and report objectively.
Not every employee needs a formal ISO 27001 qualification. Determine the competence each role requires, recognise existing experience, and provide training where gaps exist. Then check the learning has landed: ask a manager to demonstrate how they approve access, or a team to explain what they would do after sending sensitive information to the wrong recipient. Attendance records tell you who was in the room; practical checks tell you what they understood.
How to implement ISO 27001, step by step
1. Agree the purpose and scope
As above: the reason first, then the services, information, locations, people and dependencies the system needs to cover, including the interfaces with suppliers.
2. Assess your starting point
Review existing policies, controls, working practices and evidence. Identify what can be reused, what needs improvement and who will own the work, then turn it into a prioritised plan with resources, responsibilities and realistic milestones.
3. Assess and treat information security risks
Use a defined, repeatable method so results are consistent over time. Identify and evaluate risks, assign owners and agree treatment, then obtain approval for treatment plans and acceptance of residual risk. Forty carefully considered risks relevant to your business are worth more than four hundred copied from a template, and they are far easier to maintain.
4. Implement processes and build capability
Put the agreed controls into operation, document what the standard requires, and train the relevant people. Document what you actually do: a policy describing an ideal nobody follows becomes a nonconformity the moment anyone checks. Keep the distinction between policy and procedure clear, too. A policy states what the organisation intends and why; a procedure states how, when and by whom it is done. Mixing them produces documents too detailed to approve and too vague to follow.
5. Operate the system and gather evidence
Evidence should come from normal work: access reviews, supplier decisions, training, recovery exercises, risk reviews and corrective actions. It should show what happened, who was responsible and how problems were handled.
6. Audit, review and improve
Internal audits must be planned and carried out so that they are objective and impartial. In practice, the people auditing a process should not be the people who operate it day to day. Top management then reviews the system’s performance and decides on improvements and resources. Findings are addressed, and corrective actions checked to confirm they worked.
7. Proceed to independent certification
Certification is carried out by the accredited certification body you choose, not by your consultant. It happens in stages.
Stage 1: readiness review. The certification body reviews your documentation and confirms the management system is in place: the scope, risk assessment and treatment, Statement of Applicability, policies, internal audit and management review. It is often carried out remotely. Any concerns are reported back for you to address before Stage 2, and the auditor uses Stage 1 to plan the next stage.
Stage 2: implementation and effectiveness. Usually a few weeks after Stage 1, the auditor examines whether the system is genuinely operating: sampling records, interviewing staff at different levels, and checking that controls work as your documentation says. This is where evidence from normal working, rather than documents written for the audit, matters most.
Findings and the certification decision. Problems are raised as nonconformities, typically graded as major or minor. Major nonconformities must be resolved, with evidence, before certification can be granted; minor ones need an agreed corrective action plan. The certification body then makes the certification decision.
Surveillance and recertification. In each of the two years after certification, the certification body returns for a surveillance audit, and a recertification audit in year three renews the certificate for a further cycle.
How long does ISO 27001 implementation take?
Plan in months, with the schedule driven by your starting position and your scope. An organisation with established controls, available people and a contained scope can move considerably faster than one introducing new processes across several locations. Leadership availability, supplier dependencies, corrective work and certification body scheduling all affect the timetable.
Ask any adviser for milestones covering implementation, staff preparation, operating evidence, internal audit, management review and both certification stages, and for clarity on what your own team must deliver at each point. A credible plan shows your effort as well as theirs.
How much does ISO 27001 implementation cost in the UK?
There are three parts to the budget: implementation, independent certification, and the ongoing operation of the system.
For a small organisation with fewer than 50 staff and a relatively straightforward scope, the following are indicative planning allowances for external services, before VAT. The consultancy line reflects how we price implementation support; the certification lines are typical certification body fees, which you agree directly with your chosen body.
| Cost component | Indicative allowance |
|---|---|
| Consultancy and implementation support, typically 7.5 to 20 days at £800 + VAT per day depending on scope and the level of support you need | £6,000 to £16,000 |
| Outsourced internal audit, where commissioned separately | £1,000 to £4,000 |
| Initial certification through a UKAS-accredited body, Stage 1 and Stage 2 | Approximately £6,000 to £10,000 |
| Combined allowance for those external services | Approximately £13,000 to £30,000 |
Certification fees vary for a structural reason: the number of audit days a certification body must spend is set by the accreditation rules for information security certification, and scales mainly with the number of people within scope and the complexity of the organisation. That is why two quotations for the same scope tend to land close together, and why scope decisions affect certification cost directly.
Budget separately for internal staff time, training, copies of the standard, any software you choose, and the improvements identified during implementation. Larger or more complex organisations can spend substantially more; organisations with capable internal teams may need less external support. Dedicated management system software is optional: what matters is a system you can maintain and evidence with tools that suit your size.
When comparing proposals, check what each includes. Gap analysis, training, audit support and corrective action assistance may be bundled or charged separately, so avoid counting the same activity twice.
Ongoing costs
Allow for annual surveillance audits, internal audits, staff development, reviews and improvement work. For a small organisation, surveillance audit fees are typically in the region of £1,500 to £3,500 a year before VAT and expenses. Budget for recertification before the certificate expires at the end of the three year cycle, and ask the certification body for the complete cycle of fees, including travel and additional audit work. The system also needs staff time between audits, which belongs in the affordability decision.
UKAS vs non-UKAS ISO 27001 certification
UKAS accredits certification bodies; those bodies certify organisations’ management systems. Accreditation provides independent assurance of the certification body’s competence, impartiality and operation. When choosing one, verify that its accreditation specifically covers ISO 27001 certification.
“Non-UKAS certification” needs care, because it describes different arrangements:
| Route | What it means |
|---|---|
| UKAS-accredited certification | The certification body holds UKAS accreditation covering the relevant certification activity |
| Certification under another recognised accreditation body | An overseas certification body may hold accreditation recognised through international arrangements. Check the scope and that your customers accept it |
| Unaccredited certification | The certificate does not carry the assurance that recognised accreditation of its issuer provides |
UKAS explains international recognition and the arrangements supporting equivalence between recognised accreditation systems. A certificate issued outside the UKAS route is therefore not automatically unaccredited. Equally, an accreditation logo alone proves little: verify the accreditation body’s recognition, the certification body’s scope and the certificate itself.
Will an unaccredited certificate be accepted?
That depends on the organisation relying on it. UKAS’s guidance explains that unaccredited certification is not automatically unlawful, but that without impartial evaluation there is no assurance of the certification body’s competence. Before buying certification, get your customer’s exact requirement in writing. If it specifies UKAS-accredited certification, or an expressly accepted equivalent, an unaccredited certificate may not satisfy it. Check also that the certificate covers the services the customer is buying from you.
For a UK organisation seeking certification to support commercial opportunities, a UKAS-accredited certification body is the sensible starting point.
How do you know the system is working?
Use measures that help people make decisions: overdue risk treatments, whether access is removed within your agreed timescales, whether recovery exercises meet business needs, repeated audit findings, and whether corrective actions prevent recurrence.
Investigate what the numbers mean. A low number of reported incidents could reflect effective controls, or staff who do not know how to report. Use management review to decide what changes, assign actions and follow them through. That is how the system stays useful as the organisation changes.
Maintaining it after certification
The certificate is not the finish line; it starts the three year cycle of surveillance and recertification described above. Surveillance audits look for evidence that processes have continued, not merely that they existed on the day of certification, so in between, the system has to keep running:
- Keep the scope current. New services, locations, suppliers and acquisitions all change it.
- Revisit risks at planned intervals and whenever something significant changes. The risk register is a working document, not an archive.
- Run the internal audit programme across the cycle, so every part of the system is examined, not just the easy parts.
- Hold management reviews at planned intervals, with leadership genuinely engaged.
- Manage nonconformities and corrective actions as they arise, rather than saving them for the audit.
Organisations that treat ISO 27001 as a project to finish tend to struggle at their first surveillance audit, because the system stopped running the week after certification. Organisations that treat it as the way they manage information security find the audits largely take care of themselves, because the evidence is being produced as a matter of course.
Where ISO 27001 sits alongside Cyber Essentials
They answer different questions. Cyber Essentials certifies five technical controls across your organisation; ISO 27001 certifies how you manage information security as a whole. Many organisations hold both, and Cyber Essentials frequently provides useful evidence for several Annex A technological controls. We compare them in Cyber Essentials vs IASME Cyber Assurance vs ISO 27001.
How an ISO 27001 consultant can help
A good consultant helps you understand the requirements, establish a suitable scope, assess gaps and build a practical plan, through risk workshops, documentation, leadership briefings, staff development and preparation for certification. The aim should be to leave your own people able to run the system with confidence. When comparing consultants, ask how they will build your team’s capability, what you must provide, and how they will handle audit impartiality.
Malwise is not an ISO 27001 certification body, and does not issue ISO 27001 certificates. We work with you to get you ready, so that when your chosen certification body carries out its audits, your management system is operating and your evidence is in place.
That support can run through every stage: a gap analysis and scoping to establish where you stand, implementation support to build the system, a readiness review before Stage 1, and help addressing any Stage 1 concerns or nonconformities before the certification decision.
Once the system is implemented, we can act as your internal auditor, provide ongoing support between audits, or carry out an independent health check before a surveillance or recertification audit.
Planning ISO 27001, or improving an existing system?
We can help you establish your starting point, agree the purpose and scope, clarify responsibilities, and scope the support your organisation actually needs.