Published · By the Aesparrow Security Research Team
Short answer
To implement ISO 27001, define the ISMS scope, perform a gap analysis, run a risk assessment, choose controls and document them in a Statement of Applicability, implement policies and controls, train staff, run an internal audit and management review, and then complete the Stage 1 and Stage 2 certification audits.
What drives ISO 27001 implementation cost?
- Scope: number of locations, people, systems and processes in the ISMS.
- Current maturity: existing policies and controls reduce effort.
- Internal resources: how much your team does versus the consultant.
- Technical gaps: controls such as logging, MFA or backups that need investment.
- Certification body fees: Stage 1, Stage 2 and surveillance audits are charged separately.
How to choose an ISO 27001 consultant
- Qualifications: ISO 27001 Lead Implementer / Lead Auditor credentials.
- Implementation track record: references from organisations like yours.
- Practical approach: right-sized documentation, not generic templates.
- Technical depth: ability to implement and test controls, including VAPT.
- Independence: the consultant should not be your certification auditor.
ISO 27001 implementation steps
- 1Secure leadership commitmentAgree objectives, budget and an information security policy with top management.
- 2Define the ISMS scopeDecide which locations, teams, systems and services the ISMS covers.
- 3Perform a gap analysisCompare current practice with clauses 4–10 and Annex A controls.
- 4Run the risk assessmentIdentify assets, threats and vulnerabilities, and rate risks by likelihood and impact.
- 5Write the Statement of ApplicabilitySelect Annex A controls, justify inclusions and exclusions, and plan risk treatment.
- 6Implement controls and documentationRoll out policies, procedures and technical controls; train staff.
- 7Monitor and measureCollect evidence and metrics that show controls are operating.
- 8Conduct the internal auditIndependently audit the ISMS against the standard (clause 9.2).
- 9Hold the management reviewReview results, risks and improvements with leadership (clause 9.3).
- 10Complete certification auditsPass the Stage 1 and Stage 2 audits with an accredited certification body.
FAQ
Frequently Asked Questions
Clear answers about what we do — and what we don’t. If you have any other questions, feel free to reach out to our team.
How do I prepare for an ISO 27001 audit?
Complete an internal audit and management review, close corrective actions, organise evidence for each clause and Annex A control, brief control owners, and run a mock audit.
Can a small company implement ISO 27001?
Yes. The standard scales to any size; a well-scoped ISMS for a startup can be lean and practical.