ISO/IEC 27001 specifies requirements for an information security management system. Preparation covers more than technical configuration: the company must manage risk, responsibilities and improvement. Policy templates without operating processes do not establish readiness for independent audit.
Define scope and purpose
Establish which services, departments, data and locations belong in the management system. Consider customer, contractual and other stakeholder requirements. Scope must be clear: certification of one process does not automatically cover every organisational activity.
Management assigns ownership and resources. Process owners must participate alongside system administrators. Procurement, personnel, suppliers and customer data handling may affect risk as much as server configuration.
Assess risks and choose justified controls
Describe assets, threats, consequences and existing controls. Agree assessment methods and residual risk acceptance. The goal is to explain company decisions rather than copy a universal spreadsheet unrelated to the environment.
Link controls to risks and requirements. For example, critical customer files may need approved access, recovery and transfer controls. Documentation should explain why these actions were selected, who performs them and how outcomes are evidenced.
Collect evidence of actual operation
Access policy should match how permissions are granted, changed and revoked. Backup planning should match actual retained and tested copies. Compare documents with operational records to avoid two unrelated versions of company practice.
Evidence may include approvals, training results, check logs and incident actions. Restrict access according to contents. Do not fabricate historical records; gaps become tasks for completion and validation.
Separate preparation from certification
Conduct internal reviews and address nonconformities with owners. Management reviews system condition and required changes. Before independent audit, verify scope, evidence and the current requirements of the applicable standard edition and amendments.
ISO develops standards but does not itself certify the company. Certification is performed by an appropriate external body. Preparation support does not guarantee a positive decision; the system needs ongoing operation after audit rather than a folder stored until the next inspection.
Sources and further reading
