ISO 27001 Certification in the UK: A Practical Readiness Roadmap from Gap Analysis to Stage 2

ISO/IEC 27001 is the international standard for information security management systems (ISMS). For many UK organisations it becomes urgent for a commercial reason: an enterprise customer, a public sector framework or an investor asks for a certificate, and the sales team wants a date. The risk is that certification is treated as a documentation project, rushed through with template policies, and then fails at the point where auditors ask for evidence that the system actually operates.

This roadmap sets out how to prepare properly for ISO/IEC 27001:2022, the current edition, in a way that survives the certification audit and the surveillance audits that follow.

Understand what you are being certified against

ISO 27001 has two parts that matter. Clauses 4 to 10 define the management system: understanding your context, leadership commitment, planning and risk treatment, support and resources, operation, performance evaluation, and improvement. These clauses are mandatory. Annex A then lists 93 reference controls, grouped into four themes: organisational, people, physical and technological. You select controls from Annex A based on your risk assessment, and justify any you exclude.

Two practical points are often missed. First, the 2013 edition has been withdrawn and the transition period for existing certificates ended in October 2025, so any new certification is against the 2022 edition. Second, a 2024 amendment added an explicit requirement to consider whether climate change is a relevant issue in your context. It is a small change, but auditors will check it.

Stage 1: Define scope carefully

Scope is the most consequential decision you make. Too narrow, and the certificate will not satisfy the customer who asked for it. Too broad, and the project becomes unmanageable. Define scope by the services, locations, teams and technology that customers actually rely on. For SaaS businesses, that usually means the production platform, the people who build and run it, and the supporting cloud environments in AWS, Azure or Google Cloud. Document interfaces and dependencies on suppliers clearly, because cloud and outsourced services remain your responsibility to manage even when someone else operates them.

Stage 2: Gap analysis

A gap analysis compares what you do today against each clause and each relevant Annex A control. Done well, it produces a prioritised list of missing processes, weak controls and absent evidence, with owners and effort estimates. It should involve the people who operate the controls, not only those who write policies. Most organisations find that technical controls are stronger than expected and governance processes, such as management review, internal audit and supplier management, are weaker.

Stage 3: Risk assessment and the Statement of Applicability

The risk assessment is the heart of ISO 27001. Define a repeatable method, identify risks to the confidentiality, integrity and availability of information, assess them, and decide how to treat them. The output is a risk treatment plan and a Statement of Applicability (SoA), which lists every Annex A control, whether it applies, why, and whether it is implemented.

Auditors read the SoA closely. Every exclusion needs a reason that makes sense given your risks, and every included control needs evidence that it operates.

Stage 4: Implement controls and collect evidence as you go

Implementation is where projects stall. The fix is to design evidence collection alongside each control. If access reviews happen quarterly, decide where the record lives before the first review. If cloud configuration is a control, collect configuration evidence automatically rather than taking screenshots. Our article on multi-cloud compliance auditing explains why screenshot folders fail at audit, and how PyraLink Prove collects dated cloud evidence mapped to ISO 27001 controls.

Running mainly on Microsoft Azure? Our ISO 27001 on Azure controls and evidence checklist maps the Annex A controls auditors sample to the Azure settings and records that evidence them.

Allow the system to run for long enough to generate meaningful records. Auditors want to see controls operating over time, not configured the week before the audit.

Stage 5: Internal audit and management review

Before the external audit, you must complete at least one internal audit covering the ISMS and a management review by leadership. The internal auditor must be objective and impartial, which in small organisations often means using an external party. Treat findings seriously: raise nonconformities, fix them, and record what you did. A certification body would rather see an honest internal audit with findings closed than a clean report nobody believes.

Stage 6: The certification audits

Certification is carried out by a certification body, and for UK buyers it should be accredited by UKAS or an equivalent accreditation body. The audit runs in two stages:

• Stage 1 reviews documentation and readiness: scope, risk assessment, SoA, and whether the management system is designed correctly.
• Stage 2 tests implementation: auditors interview staff, sample records and check that controls operate as described.

Certificates are typically valid for three years, with surveillance audits in the intervening years and a recertification audit at the end of the cycle. That is why the system must be sustainable, not a one-off push.

Common reasons organisations struggle

• Template policies that do not describe what the organisation actually does.
• A risk register owned by IT alone, with no business input.
• No evidence that controls operated over time.
• Supplier and cloud risks not assessed.
• Leadership not visibly involved in management review.

Where ISO 27001 fits with other standards

If you are also pursuing Cyber Essentials, the technical controls overlap usefully; see our guide to getting Cyber Essentials certified. If your organisation develops or deploys AI, ISO/IEC 42001 uses the same management system structure, and an integrated approach saves effort. Our ISO 42001 readiness guide explains how.

Resourcing the project realistically

ISO 27001 projects rarely fail for lack of technical skill. They fail because the people who own the controls are busy with their day jobs. Before committing to a target date, identify who will own the ISMS overall, who owns each control area, and how much time each can realistically give. Leadership commitment, which the standard requires in Clause 5, means protecting that time, approving the risk appetite and attending management review, not simply signing the policy.

Budget for more than the certification body's fees. Typical costs include remediation of control gaps, tooling for evidence collection and vulnerability management, staff awareness training, an independent internal audit, and possibly a penetration test to evidence technical controls. Our guide to scoping a penetration test explains how to make that test useful beyond the audit.

How Pyralink helps

PyraLink™ Prove collects read-only configuration evidence from your AWS, Azure and Microsoft 365 environments and maps it to ISO 27001 controls, so the evidence behind your Statement of Applicability and audits stays current. Certification is carried out by an independent accredited certification body, not by Pyralink.

Frequently asked questions

How long does ISO 27001 certification take?

It depends on scope, maturity and resources. Organisations with established controls may be ready in a few months, while those starting from scratch usually need longer, because controls must operate long enough to produce evidence before the Stage 2 audit.

What is the difference between ISO 27001:2013 and 2022?

The 2022 edition restructured Annex A into 93 controls in four themes, introduced new controls such as threat intelligence and cloud services security, and updated the management system clauses. The 2013 edition has been withdrawn.

Who issues ISO 27001 certificates in the UK?

Independent certification bodies. UK buyers generally expect the certification body to be accredited by UKAS or an equivalent national accreditation body.

What is a Statement of Applicability?

A document listing every Annex A control, whether it applies to your organisation, the justification for including or excluding it, and its implementation status.

Do we need Cyber Essentials if we have ISO 27001?

They are separate schemes. Some UK government contracts specifically require Cyber Essentials, so many organisations hold both.

Sources: ISO: ISO/IEC 27001:2022 Information security management systems; ISO: ISO/IEC 27001:2022/Amd 1:2024 Climate action changes; UKAS: Find an accredited organisation; NCSC: Cyber Assessment Framework.