ISO 27001 for Businesses: What Preparation Involves and Where to Start

What is ISO 27001

The full name is ISO/IEC 27001. The current version dates from 2022, and the transition period from the 2013 version ended at the end of October 2025. The standard describes an information security management system (ISMS): a set of rules, roles, processes and measures that protect the confidentiality, integrity and availability of information.

The standard has two parts. The main text (clauses 4 to 10) describes how the system is managed: context and scope, leadership, planning and risk, support, operation, performance evaluation and improvement. Annex A contains 93 controls in four groups: 37 organisational, 8 people, 14 physical and 34 technological. A company does not have to apply all of them; it selects the applicable ones based on its risks.

ISO 27001 is not a legal requirement. Companies adopt it because customers ask for it, because they take part in tenders, or because they want security that is organised and provable.

When ISO 27001 makes sense

• Large customers or foreign partners require a certificate or detailed evidence of security.
• The company takes part in public procurement or tenders where the certificate earns points.
• The company processes sensitive data: financial, health or customers' personal data.
• The company is in scope of NIS2 or supplies companies that are, and wants one framework to show its measures.

Without such pressure, a small company usually gains more from basic technical measures than from full certification: multi-factor authentication, tested backups, device protection and clear access rights. See also cybersecurity for small businesses.

What preparation involves: 7 steps

1. Scope and context

First, decide which activities, offices, systems and people are included. A scope that is too wide makes the project endless; one that is too narrow does not build customer trust. A good scope follows what your customers actually buy.

2. Leadership and roles

The standard requires management commitment: a security policy, objectives and a clear owner. Without it, preparation stays an IT project and stalls at the first conflict with daily work.

3. Risk assessment

Information assets are listed together with the threats to them and the likelihood and impact of an incident. The assessment drives every later decision: where to invest and which risks the company consciously accepts. A good starting point is an IT audit of the company infrastructure.

4. Statement of Applicability and risk treatment plan

For each of the 93 Annex A controls, the company states whether it applies, why, and how it is implemented. The treatment plan shows what still needs to be done, by whom and by when.

5. Policies, procedures and evidence

Write only the documents that are needed and that people will actually follow. The mandatory ones include the scope, the security policy, the risk assessment method and results, the Statement of Applicability, the risk treatment plan, objectives, monitoring results, the internal audit programme and results, the management review and records of nonconformities and corrective actions.

6. Implementation and training

The measures start working day to day and staff are trained. Auditors look for evidence that the rules are followed, not just written: logs, reports, minutes and records. Good corporate cyber hygiene helps here.

7. Internal audit and management review

Before certification, the company audits itself, fixes the gaps and management reviews the results. Then comes the certification audit by an independent body, in two stages: first the documentation is reviewed, then the auditor checks that the system actually works.

Example: preparation in a mid-sized company

Example scenario: a trading company with 60 employees, two offices, cloud email and an accounting system on its own server. A major customer requires ISO 27001 certification within a year.

• Scope: sales, customer service and the IT systems that support them. The warehouse stays out of scope.
• The risk assessment reveals three major gaps: no multi-factor authentication, server backups have never been restore-tested, and several people share an administrator account.
• The first measures are technical and take a few weeks: multi-factor authentication for everyone, a restore test of the backup, personal administrator accounts and device protection.
• In parallel, policies are written, staff are trained and evidence is collected over 2-3 months of operation.
• The internal audit finds minor nonconformities, which are fixed. The certification audit is passed about 9 months after the start.

The most useful outcome is often not the certificate itself, but that the company now knows what it has, who has access and how to recover from an outage.

Technical measures that are most often missing

• An inventory of devices, accounts and systems that is kept up to date, not made once.
• Protection against malware on all devices (Annex A control 8.7). See also ransomware protection for business.
• Timely updates and vulnerability management (control 8.8).
• Backups whose restore is tested regularly (control 8.13), together with a disaster recovery plan.
• Logging and monitoring of system events (controls 8.15 and 8.16).
• Secure authentication and access control (controls 8.5 and 5.15).

Technical preparation and audit support for managed support clients

Many of the technological Annex A controls are everyday IT work. For its clients on subscription support, Helpdesk Bulgaria prepares the IT environment and brings it into technical compliance with ISO 27001: we implement the controls, maintain them and prepare the evidence. If you decide to get certified, we also support you during the audit. The subscription includes:

• 24/7 monitoring of servers and workstations.
• Antivirus licences and endpoint protection, plus EDR and SIEM for threat detection, analysis and event logging on the Professional plan.
• Backup policies and disaster recovery.
• Access and account management, including multi-factor authentication.
• Timely updates and vulnerability remediation.
• Trackable support tickets and a monthly report, which also serve as evidence that measures are in place.

Technical preparation, technical consulting and audit support for the technical part are included in the Professional plan. On the Standard plan, technical consulting is charged separately.

The organisational part - policies, risk assessment, training and internal audit - is the company's responsibility, and the certificate is issued by an accredited certification body. For the technical side and during the audit, we are with you. See what each plan includes on the computer support page.

See the plans | Request a quote

ISO 27001 and NIS2

The two are often confused. NIS2 is a legal obligation for companies in its scope, while ISO 27001 is a voluntary standard. Their measures overlap heavily: risk assessment, access control, backups, incident response and supplier security. A company with a working ISO 27001 system is therefore much better prepared for NIS2. A certificate does not mean automatic NIS2 compliance, though, because the law has its own requirements, such as incident reporting deadlines and management accountability. See our NIS2 guide.

Frequently asked questions

What is ISO 27001?

An international standard for an information security management system. It requires a company to manage information risks with suitable measures and to prove they work.

Is ISO 27001 mandatory?

No. The standard is voluntary. Companies adopt it because of customer requirements, tenders, or to organise their security.

How long does preparation take?

For a mid-sized company, usually 6 to 12 months, depending on the scope, how many measures already work and management commitment.

How much does certification cost?

It depends on the scope, the number of employees and the certification body. Besides the audit, there are internal costs: staff time, technical measures and documentation.

How long is the certificate valid?

Three years, with an annual surveillance audit, followed by recertification.

Can a small company get certified?

Yes, the standard applies to companies of any size. For a small company, however, it is often wiser to put basic technical measures in place first and check whether customers really require a certificate.

Do you help with the certification audit?

Yes. For our managed support clients we prepare the technical side - the controls and technical evidence - and support you during the audit. This is included in the Professional plan; on the Standard plan, technical consulting is charged separately. The certificate is issued by an accredited certification body.

This article is for information only. An ISO 27001 certificate can only be issued by an accredited certification body.