ISO 27001 & 27002, ISMS-grade.
The international standard for an Information Security Management System. ISO 27001 is the certifiable spec; ISO 27002 provides the supporting control set. We build the ISMS, you take the certificate from the registrar.
What ISO 27001 actually requires.
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The standard is risk-based: rather than mandating a fixed control list, it requires you to identify information security risks and apply controls that address them.
ISO/IEC 27002 is the companion guidance document. The 2022 revision restructured the control set into 93 controls across 4 themes (Organizational, People, Physical, Technological), replacing the older 114-control / 14-domain structure. Most organizations now reference 27002:2022.
Certification is a three-stage external audit by an accredited registrar: Stage 1 (documentation review), Stage 2 (implementation review), and ongoing surveillance audits in years 2 and 3, with recertification in year 3.
Organizational (37)
Policies, roles, supplier relationships, incident management.
People (8)
Screening, training, disciplinary process, working remotely.
Physical (14)
Physical security perimeter, equipment, environmental, secure disposal.
Technological (34)
User endpoint, access management, cryptography, secure development, monitoring.
When teams pursue ISO 27001.
ISO 27001 is voluntary, but it's the de facto international standard for vendor assurance. Common drivers:
- International customers require it, especially European buyers.
- Enterprise sales where SOC 2 isn't recognized or trusted (common outside North America).
- Vendors to financial services and telecom, where ISO 27001 is the default expectation.
- Organizations operating across multiple regions who want one certification, not several regional ones.
What we implement.
An ISMS is a documented management system, not a checklist. The work is establishing the system, populating it with real controls, and operating it long enough to demonstrate effectiveness.
ISMS scope and context
Documented scope, interested parties, internal/external context. The first thing the registrar reads.
Risk assessment and treatment
Repeatable methodology, risk register, treatment plan tied to the 27002 controls applied. Statement of Applicability maintained.
Control implementation
The 93 controls of 27002:2022 implemented or formally excluded with rationale. Technical controls operated continuously.
Internal audit program
Documented audit schedule, qualified auditors, findings tracked to closure. The registrar will ask to see this.
Management review
Documented quarterly or semi-annual reviews by leadership. Outputs feed risk treatment.
Continual improvement
Nonconformity tracking, corrective actions, opportunities for improvement. Demonstrates the system actually operates.
Who owns what.
On us
- ISMS documentation drafting and maintenance
- Technical control implementation and operation
- Risk assessment facilitation and risk register
- Internal audit execution (or coordination of independent internal auditors)
- Evidence collection across the surveillance cycle
- Coordination with the registrar during audits
On you
- Selection and engagement of an accredited registrar
- Executive sponsor and ISMS owner roles
- Risk appetite and acceptance decisions
- Policy approval and management review participation
- Final responses to nonconformities
- Certificate distribution to customers
Common pitfalls we see.
Documentation-heavy ISMS with thin operation.
Registrars notice when policies and procedures don't match what people actually do. We build the ISMS from operational reality, not from a template.
Stuck on the 2013 control set.
If your Statement of Applicability still references the old 114 controls in 14 domains, you're working from an outdated version. We move clients to 27002:2022 as part of the engagement.
Scope set too broadly.
An ISMS scope covering the entire enterprise when only a SaaS product needs certification multiplies the audit effort. We scope tightly and grow it intentionally.
Internal audits that are pass-everyone exercises.
An internal audit that finds nothing makes the registrar suspicious. We treat internal audits as the rehearsal that catches issues before the surveillance audit does.
Common questions about ISO 27001.
Do we need ISO 27001 certification?
It is voluntary, but it is the de facto international standard for vendor assurance. The common drivers are international customers, especially European buyers, enterprise sales where SOC 2 is not recognized, and selling into financial services or telecom where ISO 27001 is the default expectation. One certificate also covers multiple regions.
What does ISO 27001 actually require?
It requires a working Information Security Management System: a documented, risk-based program for managing information security. Rather than a fixed control list, it asks you to identify risks and apply controls that address them. ISO 27002:2022 provides the supporting set of 93 controls across organizational, people, physical, and technological themes.
Can a managed IT provider get us certified?
We build and operate the ISMS, draft the documentation, run the risk assessment, implement the technical controls, and execute internal audits. We do not issue the certificate. An accredited registrar performs the external audit and certifies you. We prepare the ISMS so it stands up to that audit and we coordinate with the registrar throughout.
How does ISO 27001 certification work?
Certification is a staged external audit by an accredited registrar: Stage 1 reviews your documentation, Stage 2 reviews implementation, then surveillance audits run in years 2 and 3, with recertification in year 3. The ISMS has to be operating with real evidence before Stage 2, so a first certification typically takes several months to set up and run in.
How is ISO 27001 different from SOC 2?
SOC 2 is an AICPA attestation report from a CPA firm, common in North America. ISO 27001 is an international certification of a management system from an accredited registrar. The underlying controls overlap heavily, so when a client needs both we maintain one control set with mappings rather than running two separate programs.
Related frameworks.
Frameworks that overlap or pair well with ISO 27001.
Let's talk for 30 minutes.
No slides.
Bring your customer questionnaires, your current Statement of Applicability, or your last surveillance audit findings. We'll come back with a written gap analysis, and what it would cost to be ready.
- 30-min discovery, no slide deck
- Free written assessment, yours to keep
- A clear proposal, no pressure
Or call us directly: 904-639-0003
Schedule a call →