+44 (0)1482 770583
hello@systechitsolutions.co.uk
Most ISO 27001 projects focus entirely on the technical controls, firewalls, access policies, encryption, and treat the audit itself as a formality to schedule once everything's built. That's backwards. The certification body you choose, and when you bring them in, shapes the entire project, and picking wrong is one of the most common reasons a first audit fails.
In short: ISO 27001 certifies an Information Security Management System (ISMS), not just technical controls, and a UKAS-accredited certification body audits it in two stages: a Stage 1 documentation review, then a Stage 2 audit of whether the ISMS actually operates as documented, with evidence. Choosing that certification body and involving them early is what most first-time projects get wrong.
Here's what ISO 27001 actually certifies, why the auditor relationship matters from day one, and how we partner with clients through it.
What does ISO 27001 actually certify?
ISO 27001 isn't a checklist of technical controls to tick off. It certifies an Information Security Management System, a management framework covering risk assessment methodology, a Statement of Applicability mapping every relevant Annex A control, documented policies, an internal audit programme and regular management review. That's a meaningfully different, and bigger, undertaking than Cyber Essentials, which is a self-assessed technical baseline rather than an independently certified management system.
The current version of the standard, ISO/IEC 27001:2022, reorganised Annex A into 93 controls across four themes:
- Organisational, 37 controls
- People, 8
- Physical, 14
- Technological, 34
That replaced the 114 controls and 14 domains of the 2013 edition, and it introduced eleven genuinely new controls, threat intelligence, information security for cloud services, data leakage prevention and secure coding among them. The Statement of Applicability is where you record, control by control, which of those 93 apply to your scope and why any are excluded, and it's one of the first documents a Stage 1 auditor will scrutinise. If you certified under the 2013 version, the transition deadline to 2022 has now passed, so any certificate still referencing the old standard needs attention.
What are the two stages of the ISO 27001 audit?
Certification runs in two stages, and most of the businesses we see stumble at one or the other.
Stage 1: the documentation review
Stage 1 is a documentation review: does the ISMS exist on paper, is the scope properly defined, is every exclusion in the Statement of Applicability actually justified. Businesses that build technical controls first and documentation later often aren't ready for this stage, even though the underlying security is sound.
Stage 2: the certification audit
Stage 2 is the certification audit itself: does the ISMS actually operate as documented, with evidence, internal audits that have actually happened, management reviews that have actually taken place, corrective actions that have actually been tracked. This is where projects that treated the ISMS as a paperwork exercise get caught out, there's no evidence trail because the process was never really run.
Certification is not a single pass-and-forget event
It's also worth knowing that certification isn't a single pass-and-forget event. Once you're certified, the certificate runs on a three-year cycle: the Stage 2 audit in year one, then lighter annual surveillance audits in years two and three that check the ISMS is still operating, followed by a full recertification audit before the three years are up. An ISMS that's allowed to lapse quietly between surveillance visits is the single most common way businesses lose a certificate they worked hard to earn, which is why the process has to keep running long after the first audit is passed.
Why does the auditor relationship matter from day one?
"Businesses that bring their certification body in at the end are scoping their own audit blind. Businesses that bring them in at the start find out exactly what evidence Stage 2 will expect, while there's still time to build it."
- Choose a UKAS-accredited certification body early, not once the technical work is finished. Their expectations shape how you should have scoped the project from the outset.
- Get the ISMS boundary right with their input. Scope too broadly and you're managing controls you didn't need to; scope too narrowly and the certificate doesn't cover what your customers actually need it to.
- Run a readiness assessment before Stage 1, so gaps in documentation or evidence surface while there's time to fix them, not during the audit that determines whether you pass.
How we partner with clients through this process
Our Security Services team handles the technical and procedural side, access control, encryption, endpoint protection, backup, supplier security, all mapped against the Annex A controls that matter for your scope. We then coordinate directly with an accredited ISO 27001 certification partner to run a pre-assessment ahead of the formal Stage 1, so audit findings get fixed on our schedule, not the auditor's. And because certification isn't a one-off event, annual surveillance audits keep coming, we help keep the ISMS genuinely operating between them, not quietly lapsing back into a folder of unused documents until the next audit forces a scramble.
Where this leaves you
Passing ISO 27001 first time is almost always a preparation problem, not a security problem, most businesses that fail already had reasonable technical controls in place. The difference is whether the certification body's expectations were built into the project from day one or discovered during the audit. If you're planning ISO 27001, or already stuck partway through a first attempt, Systech's assessment will tell you exactly where the gaps are, technical and evidential, and we can bring in the right accredited partner to take it from there.
Frequently asked
What does ISO 27001 actually certify?
ISO 27001 certifies an Information Security Management System, not a checklist of technical controls. The ISMS is a management framework covering your risk assessment methodology, a Statement of Applicability mapping every relevant Annex A control, documented policies, an internal audit programme and regular management review. Technical controls sit inside that framework, but they are not what the certificate is awarded for, which is why businesses with genuinely sound security still fail a first audit. It is also a meaningfully bigger undertaking than Cyber Essentials. Cyber Essentials is a self-assessed technical baseline; ISO 27001 is an independently certified management system, audited by a UKAS-accredited certification body. If you are treating it as a set of controls to build and then have inspected, the project is already pointed in the wrong direction.
What is the difference between Stage 1 and Stage 2 of the ISO 27001 audit?
Certification runs in two stages, and businesses stumble at both for different reasons. Stage 1 is a documentation review: does the ISMS exist on paper, is the scope properly defined, and is every exclusion in the Statement of Applicability actually justified. Businesses that build technical controls first and write the documentation later often are not ready for Stage 1, even though the underlying security is sound. Stage 2 is the certification audit itself: does the ISMS actually operate as documented, with evidence. That means internal audits that have genuinely happened, management reviews that have genuinely taken place, and corrective actions that have genuinely been tracked. Projects that treated the ISMS as a paperwork exercise get caught here, because there is no evidence trail sitting behind the documents.
How many controls are there in ISO 27001:2022?
The current version of the standard, ISO/IEC 27001:2022, has 93 Annex A controls organised across four themes: organisational (37 controls), people (8), physical (14) and technological (34). That replaced the 114 controls and 14 domains of the 2013 edition, and it introduced eleven genuinely new controls, threat intelligence, information security for cloud services, data leakage prevention and secure coding among them. You do not implement all 93 automatically. The Statement of Applicability is where you record, control by control, which of them apply to your scope and why any are excluded, and it is one of the first documents a Stage 1 auditor will scrutinise. If you certified under the 2013 version, the transition deadline to 2022 has passed, so any certificate still referencing the old standard needs attention.
Is ISO 27001 a one-off audit, or does it recur?
It recurs, on a three-year cycle. The Stage 2 certification audit happens in year one, then lighter annual surveillance audits in years two and three check that the ISMS is still operating, followed by a full recertification audit before the three years are up. That structure catches out businesses who treat certification as a finish line. An ISMS allowed to lapse quietly between surveillance visits is the single most common way a business loses a certificate it worked hard to earn: the internal audits stop happening, management reviews slip, and the evidence trail the next auditor asks for simply is not there. The process has to keep running long after the first audit is passed, which is a resourcing question worth answering at the outset.
When should you involve the certification body?
At the start, not once the technical work is finished. Choose a UKAS-accredited certification body early, because their expectations shape how the project should have been scoped in the first place. Get the ISMS boundary right with their input: scope too broadly and you are managing controls you never needed, scope too narrowly and the certificate does not cover what your customers actually need it to. Then run a readiness assessment before Stage 1, so gaps in documentation or evidence surface while there is still time to fix them, rather than during the audit that decides whether you pass. Businesses that bring their certification body in at the end are scoping their own audit blind. Passing first time is almost always a preparation problem, not a security problem.
