ISO 27001 Certification Project: From Gap Assessment to Audit

ISO/IEC 27001 certification is a project with a fixed end point: an accredited certification body audits your information security management system (ISMS) in two stages and, if it holds up, issues a certificate valid for three years. The work before that audit is where most of the effort goes.

A common starting point is a downloaded policy template pack with the company name filled in. It feels like progress, but it misses what the auditor is there to test. The standard certifies a management system: a defined scope, a risk assessment that drives decisions, controls that are actually in place, and records showing the system runs from month to month. Templates can help with the wording. They cannot supply the evidence.

The short answer

Treat ISO/IEC 27001 as a project with owners, a timeline and deliverables. Start with a gap assessment, set the scope, assess and treat your risks, write the Statement of Applicability, put the controls in place, collect evidence, rehearse with an internal audit and management review, and then book the certification audit. After the certificate is issued, plan for a surveillance audit every year and a recertification audit before the three years are up.

What the standard actually asks for

The current edition is ISO/IEC 27001:2022. Its requirements sit in clauses 4 to 10, which cover the context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. These clauses are mandatory. Annex A lists 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). You compare your risk treatment against Annex A and record which controls apply and why.

The transition from the 2013 edition has ended, so new certifications and renewals are against the 2022 edition. A 2024 amendment also asks organisations to consider whether climate change is a relevant issue when they define their context.

Who issues the certificate

Certification is carried out by an accredited, independent certification body. A consultant or IT provider can prepare you, but cannot certify you, and no software tool can either. When you choose a certification body, check its accreditation and whether its scope covers ISO/IEC 27001.

This is also why we describe our role carefully. We help you build and run the ISMS and get ready for the audit. The certification body decides the outcome.

The project, step by step

1. Gap assessment. Compare how you work today against clauses 4 to 10 and the Annex A controls. The output is a list of gaps with owners and a realistic plan.
2. Scope and context. Decide which business units, locations, systems and services are in scope. A tight, honest scope is easier to certify and easier to keep.
3. Risk assessment and treatment. Identify the risks to the information in scope, rate them with a method you can repeat, and decide how each one is treated. Each risk needs an owner.
4. Statement of Applicability. List all 93 Annex A controls, mark each one applicable or not, give the reason, and record its status. The certification body will study this document closely.
5. Policies and procedures. Write the core policy set in plain language that matches how the organisation really works, then get it approved by management.
6. Putting the controls in place. This is where the IT work happens: identity and access, multi-factor authentication, device management, endpoint protection, email security, backup and recovery, logging and supplier controls. Where Microsoft 365 and Azure are in scope, a large part of this work happens there.
7. Awareness. Staff need to know the policies that affect them and what to report. Keep records of who attended.
8. Internal audit and management review. The standard requires both before certification. Internal auditors must be objective and impartial, so the person who built a control should not be the one auditing it.
9. Certification audit. Stage 1 reviews your documentation and readiness. Stage 2 checks that the ISMS is in place and working, through interviews, sampling and evidence.

Where Microsoft 365 evidence fits

Auditors sample. They will pick a control, such as multi-factor authentication for administrators or external sharing in SharePoint, and ask you to show how it is configured and when you last checked it. Screenshots pasted into a document rarely hold up: they are undated, incomplete and hard to repeat.

Posturis is our own Microsoft 365 security posture assessment, available by arrangement. It is read-only and makes no change to your tenant. It checks 46 security controls across identity and access, device management, email and collaboration, sharing and tenant governance, and maps each finding to ISO/IEC 27001 as well as other frameworks. Each run delivers an HTML report, a Word evidence pack you can annotate and an Excel control sheet into your own SharePoint, with step-by-step guidance for every finding.

Posturis produces evidence. It is not an audit report and it does not certify anyone. In a certification project it covers the Microsoft 365 part of the scope, so the team can spend its time on risk, policy and the controls a scan cannot see.

After the certificate

A certificate lasts three years, but only if the ISMS keeps running. The certification body returns for surveillance audits in the following years and samples controls, risk treatment and improvement records. Before the three years end, a recertification audit reviews the whole system again. If records slip after the first audit, the gap shows at the next surveillance visit. A regular rhythm of risk review, internal audit, management review and evidence collection avoids that.

Common mistakes that slow certification

• Scope too wide. Putting the whole group in scope at once multiplies the evidence needed.
• Controls listed but not running. A policy that says MFA is enforced, while some accounts are excluded, is a finding waiting to happen.
• No owners. Risks and controls without a named owner tend not to be reviewed.
• Evidence gathered the week before. Auditors look for records over time, not a single burst.
• The consultant audits their own work. Internal audit needs to be impartial.

Frequently asked questions

How long does ISO 27001 certification take?

It depends on the scope, how mature your current controls are and how quickly decisions are made. A gap assessment gives a realistic timeline for your organisation before you commit to an audit date.

Can an IT provider certify my company for ISO 27001?

No. Only an accredited certification body issues the certificate. An IT provider or consultant helps you design the ISMS, put the controls in place and prepare for the audit.

What is a Statement of Applicability?

It is the document that lists every Annex A control, states whether it applies to your organisation, explains why, and shows its implementation status. It links your risk treatment to the controls you run.

Does Posturis make us ISO 27001 compliant?

No. Posturis gives you dated, repeatable evidence for the Microsoft 365 part of your scope, mapped to ISO/IEC 27001. Compliance and certification depend on your whole management system and the certification body's audit.

What happens after we are certified?

The certificate is valid for three years, with a surveillance audit each year and a recertification audit before it expires. The ISMS has to keep running throughout.

Where to start

Begin with a gap assessment and an honest view of scope. That tells you how far you are from Stage 1 and what the work will involve.

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. We support ISO/IEC 27001:2022 certification projects from the gap assessment through to the certification audit and the surveillance audits after it. Read about our cybersecurity services, see Posturis on our software page, or contact us to discuss your certification plans. For more on audit evidence, read Microsoft 365 evidence reports for ISO work.