ISO 27001 certification is not awarded for a set of controls. It is awarded for a management system that decides which controls you need, runs them, checks whether they work, and improves. That distinction explains most first-time failures: teams implement Annex A diligently, then arrive at the Stage 2 audit without an internal audit, a management review, or a risk assessment that actually drove their control choices. This playbook is organized around the management system first and the controls second.
What each clause requires you to produce
Annex A then lists 93 reference controls grouped into four themes: organizational, people, physical, and technological. You do not have to implement all of them, but you must consider every one in your Statement of Applicability, state whether it applies, and justify inclusions and exclusions. For background on the management system concept itself, see what an ISMS is.
A phased path to certification
Indicative sequence; actual duration depends on scope, maturity, and auditor availability
Getting the risk assessment right
The risk assessment is where the standard expects your ISMS to become specific to you. Clause 6.1.2 requires defined risk acceptance criteria and a process that produces consistent, valid, and comparable results. In practice that means a written methodology with a scoring scale everyone applies the same way, owners who accept residual risk, and a clear line from each risk to the controls that treat it. Our risk assessment methodology template is a starting point you can adapt.
A common mistake is building the Statement of Applicability first, by walking down Annex A and ticking controls, then writing risks to justify the ticks. Auditors can see this because the risks read like control names. Start from the business: the information you hold, the processes that depend on it, and what could realistically go wrong. The SoA should be an output of that thinking.
Roles the ISMS needs
- Top management approves the policy, sets objectives, provides resources, and chairs or attends management review. Auditors will want to speak with them.
- ISMS manager owns the program day to day: risk process, SoA, document control, and audit coordination.
- Risk and control owners across IT, engineering, HR, facilities, and legal, who operate controls and produce evidence.
- Internal auditor who is independent of the areas they audit, whether a staff member from another function or an external provider working to an internal audit plan.
Where programs stall
- Scope drawn so broadly that every office, subsidiary, and legacy system must be covered before the first audit.
- Leaving internal audit and management review to the final weeks, so there is no time to act on their findings.
- Policy documents copied from elsewhere that describe processes the organization does not follow.
- No document control, leaving several versions of the same policy in circulation.
- Treating certification as the finish line, then scrambling before the first surveillance audit because nothing was maintained.
Signals the ISMS is actually working
- Risk register updated after a significant change, not only on the annual cycle
- Objectives with measurable targets and reported results
- Corrective actions closed with evidence that the root cause was addressed
- Management review minutes that record decisions, not just attendance
- Staff can explain the policies relevant to their role
- Evidence for recurring controls exists for every period, not just the weeks before the audit
How Asurvo supports the program
Asurvo's AI learns your organization's context, then generates controls, drafts policies, and builds a risk assessment specific to you rather than generic boilerplate. The risk register scores inherent, residual, and target risk with treatment plans, owners, and deadlines, and evidence arrives through native integrations with expiry tracking. Internal audit workflows, findings, and corrective actions live in the Audit module. For certification, Asurvo partners with GCAICERT, a certification body for ISO 27001. The ISO 27001 complete guide covers the standard in depth.