Getting Started2023-10-29T17:23:22+00:00

Getting Started

Information security has never been more important for organisations. As cyber threats and data breaches continue to make headlines, companies are looking to implement robust protection for their business information. This is where ISO 27001 comes in.

ISO 27001 is the international standard that outlines the requirements for an information security management system (ISMS). By attaining ISO 27001 certification, organisations can systematically manage risks to their information and reassure customers and clients that business information is being protected.

If you’re looking to implement an information security management system (ISMS) in your organisation, you probably have a lot of questions. ISO 27001 can seem complex and intimidating at first. Where do you even begin?

I’ve put together this handy web page in an FAQ format to help demystify ISO 27001 and provide practical guidance on how to get started on your implementation journey and even if ISO 27001 is for you.

Whether you’re just learning about the Information Security Standard or preparing a case for certification, this page will give you a solid foundation. There are questions relating to:

– What is ISO 27001 and what are the key benefits?
– Who needs to get ISO 27001 certified?
– What are the main steps to implement an ISMS?
– How long does it take and how much does it cost?
– What resources do I need to have in place?
– How do I choose a certification body?

Let’s get started on the path to ISO 27001 certification and transforming your organization’s information security. I’m confident this site will provide immense value to you on your journey.

How much time and Resources will be required?2023-10-29T16:54:15+00:00

Implementing an ISO 27001 compliant information security management system (ISMS) requires a significant investment of time, money and resources. It will vary from organisation to organisation depending on a lot of factors including what is already in place, what skills are in-house, how large or complex an organisation is and speed of implementation. Here are some guidelines.


  • The quickest implementation period is 12 -16 weeks.
  • More usually, for a small to medium sized organisations, the implementation process takes 6-12 months on average. For larger companies, 12-24 months is typical.
  • After achieving certification, you will need to factor in time to maintain your ISMS so time for monitoring, reviews, internal audits and continuous improvement.


  • The certification audit itself will cost £2,000 to £10,000 for smaller companies and £10,000+ for larger companies.
  • If you choose to use software tools for risk assessment, audits and policies they will dent your budget too (Frankly we run very successful implementations without any specialist software – so no additional cost).
  • There will also be the cost of the staff time implementing the ISMS, this is frequently hard to quantify as it just becomes part of their job role.
  • Annual surveillance audits are required after certification, typically costing 30-50% of the initial audit.


  • A cross-functional ISO 27001 project team is required, involving leadership, IT, HR, legal, finance and other departments.
  • Involving a consultant is highly recommended to provide expertise, training and implementation guidance.
  • Employee time will be required for training, implementing controls and contributing to risk management.

The investment pays off through enhanced security, lower risk, compliance and competitive advantage. With proper planning and budgeting, organisations of any size can achieve ISO 27001 success.

What are the Benefits of ISO 27001?2023-10-29T15:59:58+00:00

Some of the key benefits that organisations can achieve through ISO 27001 certification are:

– Improved information security – ISO 27001 provides a systematic approach to managing information security risks. By implementing the standard’s controls, organisations can better protect their data from threats.

– Compliance – Certification demonstrates compliance with information security best practices and meets legal/regulatory requirements. This can help avoid fines for non-compliance.

– Competitive advantage – Being certified gives organisations a marketing edge and inspires trust in customers. It provides assurance that their information is secure.

– Risk management – The risk assessment and treatment processes in ISO 27001 enables better evaluation and mitigation of information security risks.

– Business continuity – The ISO 27001 controls and procedures required boost resilience against security incidents, reducing downtime and impact.

– Validation of security controls – Independent certification provides validation that necessary controls are in place and working effectively to secure business information and data.

– Reputation – ISO 27001 improves public reputation and gives stakeholders confidence that systems and data are properly protected.

– Return on investment – Although certification requires investment, improved security, risk reduction and resilience usually results in a significant return on investment (ROI).

In summary, the information security practices set out within the ISO 27001 standard result in enhanced data protection, resilience, compliance, trust, and provide a competitive edge for organisations.

What is ISO 27001?2023-10-29T15:26:31+00:00

ISO 27001 is an international standard that focuses on an information security management system (ISMS). It helps organisations manage their information security risks systematically and effectively and is independently verified by a certification body. ISO 27001 is widely recognised and respected and frequently requested by clients as part of the procurement process.

Some key things to know about ISO 27001:

– It was published by the International Organization for Standardization (ISO).

– The current version is ISO 27001:2022, published in October 2022.

– It specifies the requirements for establishing, implementing, maintaining and continually improving an ISMS.

– The ISMS is a systematic approach to managing sensitive company and customer information so that it remains secure.

– It includes aspects like security policy, asset management, access control, encryption, physical and environmental security, and much more.

– By implementing ISO 27001, companies can identify, assess, and address their information security risks and assure their clients of their information security practices.

– It helps protect intellectual property, financial information, employee details and other valuable data.

– Certification to ISO 27001 demonstrates to customers and stakeholders that your organization has robust information security controls.

In summary, ISO 27001 is the leading international standard for an ISMS that helps organisations manage information security in a systematic, comprehensive way.

What happens once we are certified?2024-06-13T14:25:54+01:00

Once you have received your certification, you need to continue to undertake the various requirements to meet the standard. One of the key elements of ISO27001 is continuous improvement so you will need to demonstrate that you continue to meet the required standard and improve your ISMS throughout the year. After certification, there will be an annual audit, called surveillance, for two years before your business will be re-certified in year 3.

Go to Top