The short answer
ISO 27001 implementation means building an information security management system (ISMS) that meets ISO/IEC 27001:2022: agree the scope, assess risks, choose controls in a Statement of Applicability, write policies, run the controls, then complete an internal audit and management review. For most small and mid-sized organisations it takes three to nine months from start to certificate.
On this page
ISO 27001 implementation is the work of building an information security management system (ISMS) that meets ISO/IEC 27001:2022 and proving it runs. You set the scope, assess risks, choose controls, write policies, operate the controls, then check the whole system with an internal audit and management review before an independent certification body audits you. For most small and mid-sized organisations, that takes three to nine months.
Sovereign Secure Ltd is an ISO 27001-certified UK consultancy, a PCI SSC-approved QSA company and an IASME-licensed Cyber Essentials certification body. We help clients implement ISO 27001; certification audits are carried out by an independent certification body, our partner MQA International.
How to implement ISO 27001 step by step
There are 11 ISO 27001 implementation steps, each mapped below to the ISO 27001 requirements it meets. The first ten build and check your ISMS; the last is the certification audit.
| Step | What you do | Clauses | Output |
|---|---|---|---|
| 1 | Secure commitment and set up the project | 5.1, 5.3, 7.1 | Sponsor, ISMS owner, budget, plan |
| 2 | Understand context and set the scope | 4.1 to 4.4 | Scope statement, issues and interested parties |
| 3 | Run a gap analysis | Not required | Gap register and roadmap |
| 4 | Assess risks | 6.1.2, 8.2 | Risk method and risk register |
| 5 | Plan risk treatment and write the SoA | 6.1.3, 8.3 | Treatment plan, Statement of Applicability |
| 6 | Write policies and set objectives | 5.2, 6.2, 7.5 | Approved policies, measurable objectives |
| 7 | Implement controls and train people | 7.2 to 7.4, 8.1, Annex A | Controls in place, training records |
| 8 | Operate, monitor and measure | 9.1 | Records and metrics |
| 9 | Carry out an internal audit | 9.2 | Audit report and findings |
| 10 | Hold a management review and fix findings | 9.3, 10.1, 10.2 | Minutes, corrective action log |
| 11 | Certification audit, stage 1 and stage 2 | Certification body | Certificate |
1. Secure commitment and set up the project
Top management must lead the ISMS, not just sign it off. Agree why you want certification (a customer, a tender, risk reduction), name a sponsor and an ISMS owner, set a budget and pick a target audit date.
2. Understand context and set the scope
Record the internal and external issues that affect information security, including whether climate change is relevant (added by Amendment 1 in 2024), what interested parties such as customers and regulators require, and which of those requirements the ISMS will address. Then set the scope: which services, sites, teams and systems the certificate will cover, and where they connect to activities outside it, such as a parent company’s IT or an outsourced service desk.
3. Run a gap analysis
The standard does not require one, but it tells you how much work lies ahead. Compare current practice with every clause and Annex A control and rank the gaps. An ISO 27001 gap analysis from an outside assessor adds evidence sampling.
4. Assess risks
Define a method with risk acceptance criteria and named risk owners, then identify, analyse and evaluate risks to the confidentiality, integrity and availability of information in scope. Our guide to the ISO 27001 risk assessment covers methods and worked examples.
5. Plan risk treatment and write the SoA
Choose how to treat each risk, decide the controls you need, compare them with the 93 Annex A controls and record every decision in the Statement of Applicability. ISO 27002 gives the purpose and implementation guidance for each control. Risk owners approve the treatment plan and accept the residual risk.
6. Write policies and set objectives
Write the information security policy and the supporting policies your SoA needs, for how you actually work. Our free ISO 27001 toolkit gives you a policy template and an outline for topic-specific policies to start from. Set measurable security objectives with owners and dates, and put document control in place.
7. Implement controls and train people
Put the selected controls in place: technical changes, new processes, supplier terms. Run awareness training so staff know the policy and their part in it, and record who completed it.
8. Operate, monitor and measure
Run the ISMS as designed and keep the records auditors will sample: access reviews, incident logs, supplier checks, backup tests, change records. Decide what to measure and analyse the results.
9. Carry out an internal audit
Clause 9.2 requires internal audits at planned intervals by auditors chosen for objectivity and impartiality, and before certification they should cover the whole ISMS. If nobody in-house is trained and independent of the work, an outsourced ISO 27001 internal audit covers it.
10. Hold a management review and fix findings
Top management reviews the ISMS using every input clause 9.3 lists, including audit results, and records decisions. Correct each nonconformity and remove its root cause.
11. Certification audit
An independent certification body reviews your documentation at stage 1 and tests whether the ISMS works at stage 2. Our guide to the ISO 27001 audit explains both stages and the surveillance audits that follow.
ISO 27001 implementation roadmap
The 11 steps fall into six phases. Each phase ends with a milestone you can report to your board, which makes the roadmap easier to track than a list of tasks.
Download the ISO 27001 implementation plan (.xlsx), free. It turns this roadmap into a project plan: every phase, step and task with its clause, output and milestone, plus columns for the owner, start date, duration and status, and a summary that shows progress by phase.
| Phase | Steps | Key outputs | Milestone |
|---|---|---|---|
| 1. Plan | 1 to 3 | Sponsor, ISMS owner, scope statement, gap register | Scope and plan approved by top management |
| 2. Assess risk | 4 and 5 | Risk register, risk treatment plan, Statement of Applicability | Risk owners approve treatment and accept residual risk |
| 3. Build | 6 and 7 | Policies, objectives, controls in place, training records | Every applicable control has an owner and is running |
| 4. Operate | 8 | Records, metrics and reviews from day-to-day running | Enough records for an auditor to sample |
| 5. Check | 9 and 10 | Internal audit report, management review minutes, corrective action log | No open major findings |
| 6. Certify | 11 | Stage 1 and Stage 2 reports, certification decision | Certificate issued; surveillance audits planned for years two and three |
Phases 3 and 4 overlap in practice: controls start producing records as soon as they go live, so switch on the ones with periodic records, such as access reviews and backup tests, as early as you can. Free templates help with phases 1 and 2: our ISO 27001 checklist for the gap analysis and the Statement of Applicability template for step 5.
How long does ISO 27001 implementation take?
Three to nine months from start to certificate is typical for small and mid-sized organisations. Scope and starting maturity matter more than headcount alone.
| Organisation profile | Indicative timeline | Why |
|---|---|---|
| Small, one site, mostly cloud services, existing Cyber Essentials | About three to six months | Few systems and suppliers; decisions made quickly |
| Mid-sized, several teams, in-house development or hosting | About six to nine months | More Annex A controls apply and more records to build up |
| Large, multi-site or complex group scope | Often longer than nine months | More stakeholders, sites and suppliers to bring in |
For a small software or SaaS team, our guide to ISO 27001 for startups shows a lean version of this plan built around the product, the cloud platform and the people who run it.
An indicative six-month plan for a mid-sized organisation:
| Month | Work |
|---|---|
| 1 | Commitment, scope, gap analysis |
| 2 | Risk assessment, treatment plan, SoA |
| 2 to 4 | Policies, controls, training |
| 3 to 5 | Operate the ISMS and build up records |
| 5 | Internal audit, management review, corrective actions |
| 6 onwards | Stage 1, then stage 2 when the certification body schedules it |
Existing work shortens the plan. Cyber Essentials evidence covers firewalls, secure configuration, user access control, malware protection and security update management, and PCI DSS work supplies risk assessments, policies, logging and test reports. What slows projects down is usually slow decisions, an unclear scope or controls switched on too late to produce records.
Who does what in an ISO 27001 implementation?
ISO 27001 is a management system, so the work spreads well beyond IT.
| Role | Responsibility |
|---|---|
| Top management | Sets direction, provides resources, approves policy, leads management review |
| ISMS owner | Runs the project and then the ISMS day to day |
| Risk owners | Approve risk treatment and accept residual risk |
| Control owners (IT, HR, facilities, development) | Operate controls and keep the records |
| All staff | Follow policy, complete training, report security events |
| Internal auditor | Audits objectively and never audits their own work |
| Consultant (optional) | Guides, drafts, trains and checks readiness |
| Certification body | Audits and decides on certification; cannot advise |
Can you implement ISO 27001 yourself?
Yes. Nothing in the standard requires a consultant, and the certification body judges the ISMS, not who built it. Organisations with an experienced security lead often implement in-house and buy help only for the hard parts. What you cannot hand over is ownership: decisions, risk acceptance and running the controls stay with you.
| Task | Your team | What a consultant adds |
|---|---|---|
| Scope and risk appetite | Makes the decisions | Facilitates and challenges |
| Risk assessment | Knows the assets, threats and owners | Provides the method and runs workshops |
| Policies and procedures | Approves and follows them | Drafts them to fit how you work |
| Controls | Configures systems and changes processes | Advises on options and reviews designs |
| Internal audit | Can do it if competent and impartial | Audits independently |
| Certification audit | Presents the evidence | Prepares you, but cannot certify you |
Common mistakes either way: starting from a template pack before the risk assessment, so controls cannot be traced to risks; treating ISO 27001 as an IT project and leaving out HR, facilities and suppliers; and leaving the internal audit and management review until the week before stage 1.
Why Sovereign Secure
- ISO 27001 certified ourselves, so we run an ISMS and face surveillance audits too.
- Independent certification. We help you implement; MQA International, an independent certification body, carries out the certification audits and makes its own decisions.
- One evidence set for several schemes. As a PCI SSC QSA company and an IASME-licensed Cyber Essentials certification body, we reuse PCI DSS and Cyber Essentials work in your ISMS.
- Testing from the same provider for Annex A 8.8 and 8.29, from penetration testing to vulnerability scanning.
- UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453).
Start your ISO 27001 implementation
See how our ISO 27001 consultancy takes you from gap analysis to certificate, or check the budget in our ISO 27001 certification cost guide. For a fixed quote, tell us your headcount, sites, scope and target date through the enquiry form, or call +44 161 523 5276.
Your next step
- ISO 27001 checklistClause-by-clause readiness and a Stage 1 and Stage 2 audit checklist, free in Excel.Get the checklist
- Statement of Applicability templateAll 93 Annex A controls in a free spreadsheet, with a worked example.Get the SoA template
- Get an ISO quoteConsultancy from an ISO 27001-certified firm, with audits through our partner certification body, MQA International.Get an ISO quote
Last reviewed October 2026 by the Sovereign Secure assessment team.
