ISO 27001,
without the spreadsheet.

Turn ISO 27001 requirements into a working management system

A useful ISO 27001 programme starts with business decisions, not document templates. Which services must remain available? Who can accept an information security risk? What evidence shows that a safeguard works? Answering these questions creates a management system that people can operate between audits, rather than a folder assembled for an assessment.

This guide explains how to implement ISO/IEC 27001:2022, prepare credible audit evidence and maintain the information security management system, or ISMS, as the organisation changes.

Who should use ISO 27001?

The standard can be used by organisations of any size and in any sector. A manufacturer protecting production information, a charity handling sensitive records and a software provider operating customer services can all use its risk-based approach. Information security extends beyond servers to people, premises, paper records and outsourced processes.

Adoption is generally voluntary, although a customer contract or procurement process may require certification. Keep that commercial requirement separate from legislation. An ISO 27001 certificate does not establish compliance with GDPR or every sector-specific rule.

Scope is a business decision with consequences. A certificate may cover a particular service or business unit rather than the whole organisation. Specify activities, locations, information flows and interfaces. If a shared identity service or external supplier supports the certified service, its dependencies still need attention even when it sits outside the organisational boundary.

What the requirements mean in practice

Clauses 4 to 10 cover organisational context, leadership, planning, support, operation, performance evaluation and improvement. Together, they require a repeatable management process. Buying security tools is not a substitute for assigning responsibility, evaluating risks and reviewing results.

A practical baseline includes:

• an approved policy and clear security responsibilities;
• consistent criteria for assessing and accepting risks;
• a risk treatment plan with accountable owners;
• measurable objectives and suitable resources;
• controlled documented information;
• internal audit, management review and corrective action.

Use Annex A to check that necessary controls have not been overlooked. It is not a demand to implement every listed control without considering relevance. The Statement of Applicability, or SoA, records the necessary controls, reasons for inclusion, implementation status and justification for excluding Annex A controls.

Make the link between decisions and evidence explicit. If access reviews are a selected control, identify who reviews which accounts, how often the review occurs and what happens to exceptions. A written procedure alone does not demonstrate that the review took place.

The 2024 amendment also requires an organisation to determine whether climate change is a relevant issue in its context. Record that determination and consider relevant interested-party requirements. This does not automatically turn the ISMS into an environmental management programme.

Preparation timeline and certification cycle

There is no universal implementation deadline in the standard. Preparation depends on scope, existing practices, unresolved weaknesses and the availability of people who own the processes. Build the schedule around completed work and operating evidence, not a promised certificate date.

Initial certification involves two audit stages. Stage one examines the management system and readiness for the next assessment. Stage two evaluates implementation and effectiveness. Allow time to address findings and to demonstrate that corrective actions resolve their underlying causes.

The usual certification cycle lasts three years, with annual surveillance audits and recertification before expiry. Agree the detailed programme with the certification body. Surveillance should not be the first occasion on which the organisation discovers that its evidence or risk assessment is out of date.

Sanctions and commercial stakes

ISO 27001 itself does not impose regulatory fines. However, unresolved nonconformities can prevent certification or affect an existing certificate, including suspension or withdrawal under the applicable certification rules.

Contractual consequences are separate. A missed commitment can affect supplier approval, procurement eligibility or customer confidence. Describe the certified scope accurately in tender responses and security statements. Certification is evidence about a management system, not a guarantee that incidents cannot occur or that every product is covered.

A seven-step implementation path

1. Agree the business scope. Describe the services and information to be protected, relevant obligations and dependencies. Appoint an executive sponsor and an operational lead. Obtain approval for boundaries, responsibilities and the resources needed to run the ISMS.

2. Establish the baseline. Inventory assets, information owners, suppliers and existing security practices. Compare current arrangements with the requirements. Distinguish a missing control from an existing control that lacks reliable evidence; the remedies are different.

3. Assess risks with process owners. Define impact and likelihood criteria before scoring scenarios. Include availability and integrity as well as confidentiality. Assign risk owners who can make treatment decisions and approve residual risk within their authority.

4. Build the treatment plan and SoA. Connect each action to the relevant risk or obligation. Specify an owner, completion condition and evidence expectation. Check Annex A systematically and justify exclusions instead of copying another organisation’s applicability statement.

5. Operate the controls. Implement the selected measures and explain responsibilities to the people involved. Gather records from real activity, such as access decisions, supplier assessments, restoration tests and incident exercises. Investigate exceptions rather than hiding them before the audit.

6. Challenge the system internally. Conduct an objective internal audit and present meaningful findings to management. Review performance, changes, unresolved risks and resource needs. Track corrective actions through to an effectiveness check, rather than closing them when a document is edited.

7. Prepare for independent assessment and continuity. Organise evidence so process owners can explain how their work meets requirements. After certification, maintain a recurring review schedule. Reassess the ISMS when acquisitions, new services or infrastructure changes alter the risk picture.

How Domyno supports the programme

Domyno combines a SaaS platform with a dedicated human expert. Agents prepare work and a human validates it. This supports structured preparation while keeping contextual judgement and validation in the process.

Use risk analysis, supporting EBIOS RM and ISO 27005, to organise risk assessment. Controls & compliance provides a common control library, evidence, action plans and the SoA. Documentation supports policies and their versions. These capabilities help teams work from consistent material instead of maintaining separate, conflicting audit folders.

References and next action

Consult the official ISO/IEC 27001 overview and the 2024 amendment. Use the normative text for detailed requirements and confirm assessment arrangements with the selected certification body.

To review your scope, existing evidence and implementation priorities, request a demonstration.