Loading...

Been asked about ISO 27001 in a tender or client questionnaire?

You’re not alone. Many businesses first encounter ISO 27001 when clients or prospects ask about their information security credentials during the procurement process.

Why Clients Ask About ISO 27001

When you handle their business data, customer information, or personal details, clients want assurance that you’ll protect it properly. ISO 27001 certification demonstrates you have robust information security controls in place – it’s their way of managing risk when sharing sensitive information with contractors and suppliers.

What is ISO 27001?

ISO 27001 is the international standard for information security management systems. Think of it as a framework that helps you systematically protect all the information in your business – from customer data and financial records to employee details and business plans.

What Does ISO 27001 Actually Involve?

ISO 27001 isn’t just about IT security or installing antivirus software. It’s a comprehensive Information Security Management System frequently shortened to ISMS when talking about ISO 27001. The information security management system covers the areas in the business that affect security and includes:

Risk Assessment – Identifying what information you have, where it’s stored, and what could go wrong and then putting in place mitigation to reduce the impact should the risk become active.

Policies and Procedures – Documented processes for handling information securely across your entire business.

Physical Security – Protecting offices, servers, and paperwork from unauthorised access.

Staff Training – Ensuring everyone understands their role in keeping information secure and how to handle threats to the confidentiality, integrity and availability of information.

Access Controls – Managing who can access what information, both digitally and physically.

Supplier Management – A process for due diligence and contract management with suppliers.

Incident Management – Having plans in place for when things go wrong.

Business Continuity – Having a process in place to manage a major incident or technical failure and keep the business running.

Regular Reviews – Ongoing monitoring and improvement of your security measures.

The Certification Process

How Do You Actually Get Certified?

ISO 27001 certification involves several stages:

Stage 1: Implementation You build and implement your information security management system according to the ISO 27001 requirements. This includes risk assessments, business continuity, suppliers, policies, procedures, and staff training.

Stage 2: Internal Audit Before the Certification Audit, you must conduct an internal audit to check your system is working properly and identify any gaps. This internal audit should cover all aspects of the ISMS.

Stage 3: Management Review Senior management formally reviews the system’s performance.

Stage 4: Certification Audit An independent certification body conducts a two-part audit:

  • Part 1: Document review to check your system meets the standard
  • Part 2: On-site or remote audit to verify your system is actually working and complies with the Standard.

Stage 5: Certificate Issued If successful, you receive your ISO 27001 certificate, valid for three years.

Ongoing Requirements Annual surveillance audits ensure you continue to maintain the standard, with a full recertification audit every three years.

Why Do Businesses Struggle With ISO 27001?

Most businesses find ISO 27001 implementation challenging because:

It’s Complex – The standard contains 93 security controls and 7 clauses. Knowing which ones apply to your business and how to implement them isn’t always obvious.

It’s Time-Consuming – Creating policies, procedures, and documentation from scratch can take months. Most business owners don’t have the time to become ISO 27001 experts.

It’s Confusing – The standard is written for security professionals, not business owners. It uses a language all of its own. Understanding what auditors actually want to see can be difficult.

Resource Intensive – Your team has a business to run. Adding ISO 27001 implementation, when they haven’t done it before, on top of daily operations often means implementations stall or get abandoned.

Risk of Failure – Get it wrong and you’ll fail the certification audit, wasting months of work, the money invested and delaying those client opportunities that depend on certification.

How Long Does It Take?

  • DIY Approach: 12-18 months (if you don’t get stuck)
  • Traditional Consultants: 6-12 months
  • Our ISO27001 Advantage Programme: 6 months with 100% success rate