What ISO 27001 actually is, in plain English.
A registrar-issued certificate on whether your ISMS conforms to the standard — a true certification, not an attestation. The management system behind the certificate is what creates lasting value; the certificate demonstrates it externally.
The standard, in full
ISO/IEC 27001 is a certification of an Information Security Management System. The certificate, issued by an accredited registrar, says your ISMS conforms to the standard. Buyers see a certificate. What an internal auditor sees is your management review minutes, your risk treatment plan, your nonconformity log, and whether the system actually runs.
The standard is structured in two layers. Clauses 4 – 10 describe the management system itself: context, leadership, planning, support, operation, evaluation, improvement: and they are mandatory. Annex A lists 93 controls in four themes (organizational, people, physical, technological), reorganized in the 2022 revision. Annex A controls are candidates, not requirements: you select what applies in your Statement of Applicability (SoA), justify exclusions, and live with the consequences if the auditor disagrees. The certificate is valid for three years with annual surveillance audits in years 2 and 3, then a recertification audit. Drop a surveillance audit and the certificate suspends.
The certificate is the easy part. The ISMS has to actually run.
Plenty of firms get certified. Fewer maintain an ISMS that does what the standard claims it does. Surveillance audits in year two are where most ISMSs are exposed: management review hasn’t happened, the risk register is stale, internal audits were never run. We design the ISMS for year-three operating cost, not year-one certification.
A claim earns nothing.
“We take security seriously.” Any company can say it. With nothing behind it, a buyer has no reason to believe it.
Trust is built, not claimed.
ISO 27001 transfers trust because an independent body evaluated the system, not the claim.
Build the ISMS for year three, not year one.
- Senior practitioner leads from day one — not a coordinator with stage-gate reviews
- ISMS designed for year-three operating cost, not certification day
- Registrar-independent by policy — no conflict under ISO/IEC 17021
- Coordinator-led with senior review only during the audit window
- ISMS designed to pass Stage 2; surveillance is someone else’s problem
- Some firms bundle consulting and certification (ISO/IEC 17021 conflict)
Independent of the registrar: by design.
We are not an accredited certification body and we do not issue ISO 27001 certificates. That separation is required by ISO/IEC 17021: a registrar that consults and certifies has a conflict that voids the certificate. We run the readiness, you choose the registrar — or we introduce three with active partner relationships. Registrar relationships »
Designed for the registrar
who comes back in year two.
We instrument the ISMS for continuous evidence collection before the engagement is 30 days old. By Stage 2, the audit room is pre-populated. Surveillance year two passes because the system was designed to run — not to certify.
Right edge: active architectural detail required — no dark falloff
Left 20%: quiet and dark — ready for mask gradient transition
Does this apply to you?
ISO 27001 is rarely the first ask in U.S. domestic deals. It becomes mandatory when European procurement, federal frameworks, or insurance underwriters get involved.
ISO 27001 scope check
A first-time certification, realistically: 9 to 14 months.
From kickoff to a certificate in your buyer’s hands. The chokepoint is rarely Stage 2; it’s the three months of operational evidence registrars expect to see before Stage 1.
What this covers
What this covers
What this covers
What this covers
What this covers
Build the ISMS to operate, not to certify.
An ISMS designed only to pass Stage 2 will fail surveillance in year two. Every Nexurion ISO 27001 engagement is led by a senior practitioner who reads risk treatment plans and management-review minutes the way an auditor does: for evidence the system is alive, not laminated. Read our methodology.
From day one we instrument continuous monitoring against the SoA: not a quarterly evidence sweep. Risk register reviews trigger automatically; supplier reassessments queue against contract dates; internal-audit findings post directly into the management-review pack. When Stage 2 starts, we hand the registrar a read-only audit-room with every artifact pre-mapped to the Annex A control it covers. More on ConMon »
Running SOC 2 Type 2 at the same time — which we recommend whenever U.S. and international buyers are both in your pipeline — we sequence the audit period and Stage 2 so one evidence library serves both. ~85% of work is shared; the marginal cost of adding ISO 27001 to a SOC 2 engagement is small. See engagement outcomes.
Independent of the registrar: by design.
We are not an accredited certification body and we do not issue ISO 27001 certificates. That separation is required by ISO/IEC 17021. We run the readiness; you choose the registrar. Registrar relationships »
Six places an ISO 27001 goes sideways.
Surveillance year two is the great revealer. The mistakes that cause majors there were almost always made in the design phase: visible to a senior, invisible to a template.
"The whole company, obviously."
Why it happens
93 controls, 93 "applicable."
Why it happens
Clause 9.3, silently skipped.
Why it happens
An audit run by the team being audited.
Why it happens
Eleven new controls, quietly unimplemented.
Why it happens
An unaccredited certificate.
Why it happens
The system is designed.
Scope, risk methodology, Statement of Applicability, and an ownership model. On paper, the management system exists.
Registrars we work with.
Registrar fit matters more than registrar name. All accredited registrars issue equivalent certificates: what differs is auditor judgment, calendar flexibility, and sector strength. We’ll introduce you to three, calibrated to your timeline.
If you already have a registrar: we run a pre-Stage 1 alignment call to confirm scope and the SoA. We’ve never had a Stage 2 deferred over readiness.
ISO 27001 against the rest of the stack.
ISO 27001 is the most universally portable security framework. Most other audits credit ISO 27001 evidence; the SoA does the heavy lifting. The gaps are usually where you think they are.
ISO 27001 against the rest of the stack.
ISO 27001 is the broadest foundation.
| Framework | Overlap with ISO 27001 | What you still need to do |
|---|---|---|
| SOC 2 Type 2 | ~85%: Annex A maps cleanly to the Common Criteria. | System description, AICPA-style report writing, U.S. CPA firm engagement, complementary user-entity controls. |
| ISO 27017 (cloud) | ~90%: extends Annex A with cloud-specific controls. | Cloud customer / provider role split, ICT supply chain, virtualization controls. |
| ISO 27018 (PII in cloud) | ~85%: PII-specific extension. | PII processor obligations, public cloud customer notice, transfers, retention. |
| ISO 27701 (privacy) | Built on top of ISO 27001: PIMS extension. | Privacy roles, lawful basis, DPIAs, DSAR workflow, sub-processor inventory. |
| HIPAA Security Rule | ~70%: administrative / technical safeguards align. | BAAs, breach notification, minimum necessary, OCR-specific risk analysis. |
| NIST 800-171 | ~75%: most controls have an Annex A equivalent. | CUI marking, SSP, POA&M, supply-chain controls, federal-specific. |
| ISO 42001 (AI) | ~30%: mgmt-system structure mirrored, controls orthogonal. | AIMS, AI impact assessments, model lifecycle, third-party AI inventory. See governance » |
§ IV · Stage 1 vs Stage 2 — the two assessments +
Stage 1 vs Stage 2: both are needed.
Unlike SOC 2, ISO 27001 certification involves two sequential audit visits before a certificate issues. Stage 1 is documentation; Stage 2 is operation. Both are mandatory; failing Stage 1 means Stage 2 is rescheduled.
Stage 1
A documentation review. The registrar reads your ISMS: SoA, risk treatment plan, internal audit program, management review records: and confirms the system could work as designed. Half the time clients fail Stage 1 because management review hasn’t happened yet.
See full comparison
- FormatDocumentation review · mostly remote
- Duration1 – 2 days
- TestsISMS design, SoA, mandatory records
- OutcomeFindings list · readiness for Stage 2
- Typical fee$8 – 15k registrar (varies by accreditation)
- Failure modeStage 2 deferred · ISMS hasn’t run long enough
- Time to Stage 24 – 12 weeks after Stage 1
Stage 2
An on-site (or hybrid) operational audit. The registrar tests whether your ISMS is actually running: sampled controls, walk-throughs of incidents, evidence of management review having occurred, evidence of internal audits, evidence of risk treatment progress.
See full comparison
- FormatOn-site / hybrid · walkthroughs & sampling
- Duration2 – 5 days · scaled to org size
- TestsOperating effectiveness across all in-scope SoA controls
- OutcomeCertificate · valid 3 years
- Typical fee$20 – 60k registrar · plus surveillance years 2 & 3
- Failure modeMajor NC · must close before certificate
- Renews asSurveillance audit yr 2 & 3 · recert yr 4
The four Annex A control themes.
The 2022 revision collapsed Annex A from 14 domains / 114 controls into 4 themes / 93 controls. Eleven new controls were added (threat intel, cloud security, ICT readiness for BC, secure coding, etc.). Click each theme to drill in.
37 controlsOrganizational: policies, roles, governance
The largest theme. Policies, roles, threat intel, supplier relationships, ICT readiness for business continuity, classification, identity management, incident response. This is the bulk of the SoA work and where most clients have something already: just not labeled the right way.
8 controlsPeople: screening, training, terms
The smallest theme but the one most often under-evidenced. Pre-employment screening, terms & conditions, awareness, disciplinary, off-boarding, NDAs, remote working, reporting events.
14 controlsPhysical: perimeter, equipment, media
For cloud-native firms, most of this is inherited from your IaaS provider’s SOC 2 / ISO 27001 and excluded with justification on the SoA. For firms with offices, data centers, or on-prem hardware, this is real work.
34 controlsTechnological: where the audit lives
The longest theme and the heaviest evidence area. Includes new 2022 controls for cloud services, secure coding, data masking, configuration management, deletion, and monitoring activities.
RequiredStatement of Applicability: the auditor’s map
The single most-read document in the audit. For each of 93 Annex A controls you state: applicable / excluded; justification; implementation status. Excluded controls require defensible reasoning. The SoA is what the registrar reads first: we draft it surgically, not exhaustively.
What changed in 27001:2022.
The third edition (October 2022) restructured Annex A and added eleven new controls reflecting how security has actually evolved since 2013. The transition deadline was 31 October 2025: certificates against the 2013 standard no longer issue. If yours was certified pre-transition, your next surveillance or recertification audit is against 2022.
- 14 domains → 4 themes. Easier to read; same controls, regrouped. SoA mapping is mechanical with the published transition tables.
- 114 controls → 93. Some merged, some renumbered, none deleted. The reduction is an organizing change, not a relaxation.
- Eleven new controls. Threat intelligence (A.5.7), cloud services (A.5.23), ICT readiness (A.5.30), config mgmt (A.8.9), info deletion (A.8.10), data masking (A.8.11), DLP (A.8.12), monitoring activities (A.8.16), web filtering (A.8.23), secure coding (A.8.28), test data masking (A.8.33).
- AI risk under clause 6.1. Registrars increasingly probe how AI was handled in risk assessment: even where Annex A doesn’t name it. Our AI Governance practice handles the bridge to ISO 42001.
Read our deeper take in Field Notes Vol. III: "Surveillance year two: where the eleven new controls catch transitioned firms."
ISO 27001 is rarely the last framework.
The standard is a chassis. Most clients add at least one extension to satisfy a specific buyer or regulator.
Frequently asked.
Are we certified when the audit is complete? +
How long does the first certification take? +
What does it cost? +
Should we run ISO 27001 and SOC 2 at the same time? +
Can we be certified by an unaccredited registrar? +
What happens if we miss a surveillance audit? +
Is ISO 27001 enough for EU GDPR compliance? +
Field notes on ISO 27001.
Pieces from Nexurion Field Notes directly relevant to the standard.