ISO 27001 certification: the process from stage 1 to recertification

Who certifies against ISO 27001?

ISO/IEC 27001 certificates are issued by certification bodies accredited for it, in Germany by the national accreditation body DAkkS. The requirements for these bodies are set out in ISO/IEC 27006. When choosing one, check that the accreditation covers ISO/IEC 27001 and compare audit scope and audit days, not only the quote.

Organisations working with BSI IT-Grundschutz can instead apply to the BSI for an ISO 27001 certificate on the basis of IT-Grundschutz. The process is similar; the BSI Standards and the IT-Grundschutz Compendium then form part of the audit basis.

What has to be in place before the first audit

What is audited is an ISMS in operation, not a project plan. Before the certification audit, the required documents have to exist and the core processes have to have run at least once.

• Scope (clause 4.3) and information security policy (5.2)
• Method and results of risk assessment and risk treatment (6.1, 8.2, 8.3)
• Statement of Applicability with justifications (6.1.3)
• A completed internal audit (9.2)
• A management review (9.3)

Stage 1 and stage 2: the certification audit

The initial certification audit has two stages. In stage 1 the audit team reviews documentation, scope and readiness for the actual audit. In stage 2 it checks whether the ISMS is effectively implemented, through interviews, samples and evidence from operations.

Findings are graded as major or minor nonconformities. Major nonconformities have to be corrected and verified by the certification body before the certificate is issued; for minor ones an accepted action plan is usually sufficient.

The three-year cycle

The certificate is valid for three years. In the two years in between, surveillance audits each examine part of the ISMS, regularly including internal audit, management review and the handling of nonconformities. Before expiry, a recertification audit covers the whole ISMS.

Tell the certification body early about significant changes, for example to the scope, sites or organisation. They can trigger additional audit effort.

What a certificate does and does not say

A certificate confirms that, at the time of the audit, the ISMS met the requirements of the standard within the defined scope. It is no guarantee against incidents and covers nothing outside the scope. When assessing suppliers, always check the scope stated on the certificate.