ISO 27001 certification took us six months, one failed internal audit, and real investment in documentation tooling. Here is the honest walkthrough.
What ISO 27001 actually certifies
ISO 27001 is the international standard for an information security management system. It does not certify that a company is unhackable. It certifies that the company identifies its security risks, decides how to treat them, applies controls, and keeps checking that the controls work. The emphasis is on a repeatable system, not a one-time clean-up.
The timeline
Months one and two went to gap analysis and scoping. Months three and four were policy writing and control implementation. Month five was internal audit — which we failed the first time — and month six was remediation and the external audit.
Scoping is the first real decision
The scope defines which parts of the business the certificate covers. Too narrow and it means little to clients; too broad and the first certification becomes unmanageable. Decide early which teams, systems and locations are in, and be ready to explain why.
Risk assessment drives everything else
The standard does not hand you a list of controls to implement blindly. You assess your own risks, then choose the controls that address them and record that reasoning in a statement of applicability. Auditors spend a lot of time on whether the controls you chose follow from the risks you identified.
Where the effort really goes
The technical controls were the easy part. The heavy lifting was documentation, access reviews, and getting every team to follow the same process consistently.
An auditor does not ask whether you have a policy. They ask for evidence that it was followed last month: the access review that was actually carried out, the leaver whose accounts were actually closed, the incident that was actually logged.
Why internal audits fail
Failing the first internal audit is common, and useful. The usual causes are the same everywhere:
- Policies that describe an ideal process nobody follows.
- Controls that exist but have no evidence.
- Exceptions that were agreed verbally and never recorded.
- Staff who cannot say what the policy asks of them.
The internal audit exists to find these before the external auditor does.
What we wish we had known
- Start collecting evidence from day one, not before the audit.
- Assign a single owner — shared responsibility means no responsibility.
- Budget for tooling; spreadsheets do not scale to an audit.
We would add one more: write policies that match how you really work. A shorter policy that people follow passes an audit. An impressive one that they ignore does not.
Certification is the start
The certificate is followed by regular surveillance audits and a full recertification cycle. Internal audits, management reviews and risk reassessment continue every year. Plan the ongoing work when you plan the project, or the system decays between audits.
What it means for clients
For a client, a certified supplier means security questionnaires are quicker to complete and there is independent evidence behind the answers. Access to client code and data is controlled and reviewed, and incidents follow a defined process.
Security is central to how we build, especially for regulated industries like fintech and healthcare. Explore our secure software solutions or talk to us about compliance.
