- \n
- Organizations get certified<\/strong>; certification bodies get accredited<\/strong>. The distinction is a purchasing criterion, not pedantry.<\/li>\n
- The transition to the 2022 edition closed on 31 October 2025<\/strong>. A 2013 certificate is no longer valid.<\/li>\n
- Annex A is a catalogue of 93 controls<\/strong> in four themes \u2014 a reference list, not a to-do list.<\/li>\n
- What sets the timeline is not writing policies: it is how long the system has been producing records.<\/li>\n<\/ul>\n<\/div>\n
\n93 controls<\/b>in Annex A, across four themes: organizational, people, physical and technological<\/span><\/div>\n31 Oct 2025<\/b>the date the transition from the 2013 edition closed for good<\/span><\/div>\n3 years<\/b>the certification cycle: two surveillance audits and a recertification<\/span><\/div>\n<\/div>\nAccreditation and certification are not the same thing<\/h2>\n
Organizations get certified<\/strong>. Certification bodies get accredited<\/strong>.<\/p>\n
Your company cannot hold an ISO 27001 accreditation. What you can hold is a certificate issued by a certification body that is itself accredited by a national accreditation body \u2014 UKAS, ANAB, ema and their equivalents, all operating under the International Accreditation Forum’s mutual recognition arrangement.<\/p>\n
This is not pedantry, it is a purchasing criterion. Anyone can print a certificate. A certificate issued by a body with no accreditation behind it is worth exactly what your customer decides it is worth, and sophisticated customers check. Two practical consequences:<\/p>\n
- \n
- When you choose a certification body, verify its accreditation<\/strong> and the scope of that accreditation, the same way you would verify an ASV on the PCI Council’s list<\/a>.<\/li>\n
- When a supplier hands you a certificate, look for the accreditation body’s mark and check it. A certificate without one is a claim, not evidence.<\/li>\n<\/ul>\n
What you are audited against in 2026<\/h2>\n
The current standard is ISO\/IEC 27001:2022<\/strong>, plus Amendment 1:2024<\/strong>, which added climate change to the context clauses: you must determine whether it is a relevant issue for your information security management system, and consider that interested parties may have requirements related to it.<\/p>\n
The standard has two halves, and confusing them is the most common source of wasted effort:<\/p>\n
- \n
- Clauses 4 to 10<\/strong> are the management system: context, leadership, planning, support, operation, performance evaluation and improvement. This is what is actually certified.<\/li>\n
- Annex A<\/strong> is a catalogue of 93 controls<\/strong> grouped in four themes \u2014 organizational (37), people (8), physical (14) and technological (34). It is a reference list, not a to-do list. Your risk assessment decides which apply, and the Statement of Applicability records that decision.<\/li>\n<\/ul>\n
If you still hold a 2013 certificate, you have a problem<\/h3>\n
The transition period closed on 31 October 2025<\/strong>. Certificates against ISO\/IEC 27001:2013 that were not transitioned expired or were withdrawn, and accreditation bodies no longer recognise them.<\/p>\n
The practical consequence is worth stating plainly: an organization in that position is not \u00abslightly behind on paperwork\u00bb. It is uncertified, and the route back is a full Stage 1 and Stage 2 audit<\/strong>, not the shorter transition audit that was available until last October. If a supplier sends you a certificate dated against the 2013 version, it is not valid today.<\/p>\n
The ISO 27001 certification process, stage by stage<\/h2>\n
- \n
- Define the scope.<\/strong> Which parts of the organization, which locations, which services and which information. This single decision drives cost, duration and how useful the certificate will be commercially.<\/li>\n
- Gap analysis.<\/strong> Compare what exists against what the standard requires. Optional in theory; in practice it is what turns an open-ended project into a plan with dates.<\/li>\n
- Risk assessment and risk treatment.<\/strong> The engine of the whole system. Identify risks to confidentiality, integrity and availability, decide how to treat each one, and let that drive which controls you implement.<\/li>\n
- Statement of Applicability.<\/strong> For each of the 93 Annex A controls: whether it applies, why, and its implementation status. Auditors read this document closely, and it is where copy-paste shows immediately.<\/li>\n
- Implement and operate.<\/strong> Controls, yes, but also the management system: objectives, competence, awareness, documented procedures.<\/li>\n
- Let it run.<\/strong> This is the step nobody wants to hear about. The system has to produce records for long enough to be auditable.<\/li>\n
- Internal audit and management review.<\/strong> Both are mandatory, and both must happen before<\/em> the certification audit.<\/li>\n
- Stage 1 audit.<\/strong> The auditor reviews documentation and readiness, checks scope and Statement of Applicability, and identifies what would fail in Stage 2. Treat findings here as a gift.<\/li>\n
- Stage 2 audit.<\/strong> The real one. The auditor tests whether the system works in practice, through records, interviews and sampling.<\/li>\n
- Certificate, then the cycle.<\/strong> Certification runs on a three-year cycle: surveillance audits in years one and two, recertification in year three.<\/li>\n<\/ol>\n
\n![\"Timeline](\"https:\/\/nordsterntech.com\/en\/wp-content\/uploads\/2026\/09\/fig-iso-ciclo.jpg\")
Certification is a cycle, not a finish line. Budget for the surveillance audits from day one.<\/figcaption><\/figure>\n The evidence an auditor will actually ask for<\/h2>\n
Beyond the controls themselves, the standard requires specific documented information. If you want a short answer to \u00abare we ready\u00bb, check whether you can produce these today:<\/p>\n
- \n
- The scope<\/strong> of the ISMS.<\/li>\n
- The information security policy<\/strong> and the security objectives<\/strong>.<\/li>\n
- The risk assessment and risk treatment process<\/strong>, and the results of applying it.<\/li>\n
- The Statement of Applicability<\/strong> and the risk treatment plan<\/strong>.<\/li>\n
- Evidence of competence<\/strong> of the people with security responsibilities.<\/li>\n
- Results of monitoring and measurement<\/strong>.<\/li>\n
- The internal audit programme<\/strong> and its results.<\/li>\n
- Results of the management review<\/strong>.<\/li>\n
- Records of nonconformities and corrective actions<\/strong>.<\/li>\n<\/ul>\n
Notice how many of those are records rather than documents. Policies can be written in a week. Evidence that the system has been operating cannot, which is why the honest answer to \u00abcan we certify by next quarter\u00bb usually depends on when you started generating records, not on how fast you can write.<\/p>\n
How long ISO 27001 certification takes, and what makes it slower<\/h2>\n
For an organization with a defined scope and reasonable security maturity, a first certification typically takes somewhere between a few months and a year. The variance comes from a short list of factors:<\/p>\n
- \n
- Scope size and number of sites.<\/strong> Broad scopes are slower to build, slower to audit and harder to keep alive.<\/li>\n
- Whether a real risk assessment already exists.<\/strong> Most organizations have a spreadsheet of threats. That is not the same thing.<\/li>\n
- How much of the operation already produces records<\/strong> \u2014 access reviews, log monitoring, incident tickets, supplier assessments.<\/li>\n
- Internal audit capacity<\/strong>, including someone independent enough to run it.<\/li>\n
- Certification body scheduling<\/strong>, which is outside your control and routinely underestimated in project plans.<\/li>\n<\/ul>\n
\nPolicies can be written in a week. Evidence that the system has been operating cannot.<\/p>\n<\/div>\n
ISO 27001 or SOC 2?<\/h2>\n
Both answer the same commercial question \u2014 prove your security to a customer \u2014 through different mechanisms, and organizations selling on both sides of the Atlantic often end up with both.<\/p>\n
\n\n
\n \n<\/th>\n ISO\/IEC 27001<\/th>\n SOC 2<\/th>\n<\/tr>\n<\/thead>\n \n What it is<\/td>\n Certification of a management system against an international standard<\/td>\n An attestation report issued by a CPA firm against the AICPA Trust Services Criteria<\/td>\n<\/tr>\n \n What you receive<\/td>\n A certificate<\/td>\n A report, which the reader must actually read<\/td>\n<\/tr>\n \n Who issues it<\/td>\n An accredited certification body<\/td>\n A licensed CPA firm<\/td>\n<\/tr>\n \n Period covered<\/td>\n Three-year cycle with annual surveillance<\/td>\n A point in time (Type I) or a period, typically 3 to 12 months (Type II)<\/td>\n<\/tr>\n \n Where it is expected<\/td>\n Global, strong in Europe and Latin America<\/td>\n Predominantly the United States<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n The work underneath overlaps heavily. If both are on your roadmap, build the risk assessment and the control evidence once and map it twice, rather than running two disconnected projects.<\/p>\n
The mistakes that cost the most time<\/h2>\n
- \n
- A scope drawn to look impressive.<\/strong> Certifying the whole company when the customer only cares about one platform multiplies effort for no commercial gain.<\/li>\n
- A Statement of Applicability that does not match reality.<\/strong> If it says a control is implemented and the auditor finds otherwise, you have converted a gap into a credibility problem.<\/li>\n
- Annex A treated as a checklist.<\/strong> Controls chosen without a risk behind them are expensive to justify and impossible to defend in an interview.<\/li>\n
- Internal audit run by the person who built the system.<\/strong> Independence is a requirement, not a formality.<\/li>\n
- Starting the audit before the records exist.<\/strong> The single most common reason a Stage 2 gets postponed.<\/li>\n<\/ul>\n
One thing to know before you pick a partner<\/h2>\n
The organization that helps you build the ISMS cannot be the one that certifies it. Accreditation rules keep consultancy and certification apart precisely so that nobody audits their own work \u2014 which means a serious consultant will tell you this up front rather than promising a certificate.<\/p>\n
What a consultant can do is everything up to the audit: define a scope that is defensible and commercially useful, run the gap analysis and the ISO 27001 work<\/a>, build a risk assessment that survives questioning, and make sure the operation actually produces the evidence \u2014 which is where continuous monitoring<\/a> and a working incident response process<\/a> stop being a security nicety and start being audit evidence.<\/p>\n
And if PCI DSS is also on your list, sequence them deliberately: the two standards share risk assessment, access control, logging and supplier management, and doing them together is considerably cheaper than doing them a year apart. Our PCI DSS<\/a> work runs on the same foundations.<\/p>\n
- A Statement of Applicability that does not match reality.<\/strong> If it says a control is implemented and the auditor finds otherwise, you have converted a gap into a credibility problem.<\/li>\n
- Whether a real risk assessment already exists.<\/strong> Most organizations have a spreadsheet of threats. That is not the same thing.<\/li>\n
- The information security policy<\/strong> and the security objectives<\/strong>.<\/li>\n
- Gap analysis.<\/strong> Compare what exists against what the standard requires. Optional in theory; in practice it is what turns an open-ended project into a plan with dates.<\/li>\n
- Annex A<\/strong> is a catalogue of 93 controls<\/strong> grouped in four themes \u2014 organizational (37), people (8), physical (14) and technological (34). It is a reference list, not a to-do list. Your risk assessment decides which apply, and the Statement of Applicability records that decision.<\/li>\n<\/ul>\n
- When a supplier hands you a certificate, look for the accreditation body’s mark and check it. A certificate without one is a claim, not evidence.<\/li>\n<\/ul>\n
- The transition to the 2022 edition closed on 31 October 2025<\/strong>. A 2013 certificate is no longer valid.<\/li>\n