Get in touch

Get in touch

  • This field is for validation purposes and should be left unchanged.

Privacy Notice

X

When you submit an enquiry via our website, we use the personal data you supply to respond to your query, including providing you with any requested information about our products and services. We may also email you several times after your enquiry in order to follow up on your interest and ensure that we have answered your it to your satisfaction. We will do this based on our legitimate interest in providing accurate information prior to a sale. Your enquiry is stored and processed as an email which is hosted by Microsoft within the European Economic Area (EEA). We keep enquiry emails for two years, after which they are securely archived and kept for seven years, when we delete them.

Reveal Menu

Our quick top 5 for ISO27001

We’re often asked how to become certified to the ISO/IEC 27001 standard as fast as possible. Sometimes this is due to pressure from current or prospective customers, sometimes it’s from a regulator and sometimes it’s just because the organization wants to get on with it. As well as using the CertiKit ISO/IEC 27001 Toolkit, there are a number of quick tips we usually give to make the process of certification as fast and painless as possible and we’ve summarized them here.

blog-thumb

1 - Consider Your Scope

This is probably the biggest single source of confusion and misunderstanding around the ISO standard. In essence you can choose the scope of your certification by service (or technology), by geography or by business area (including customers). The smaller the scope, generally the less work involved so adjust your scope according to how quickly you want to be certified. A single service to a single customer at a single location is perfectly acceptable and scoping small will allow you to learn the lessons early and apply them when you gradually widen the scope post-certification.

So consider your scope carefully.

2- Understand the Standard

This may sound obvious, but to implement an ISMS you need to familiarise yourself with the standard and understand what is expected of you. Sometimes we hear of people who are going for certification without having bought the ISO/IEC 27001 standard at all – not a good idea. The ISO/IEC 27000 family is a big one, but the more you read around it, the clearer the requirements will seem so getting hold of additional codes of practice such as ISO/IEC 27002, ISO/IEC 27005 and ISO/IEC 27017 can be helpful.  Download our free ISO27001 Implementation Guide which provides guidance on understanding the ISO27001:2022 standard.

3- Get Management commitment

Success will be much easier if you can get direction and motivation from the top. Even if you are convinced it is the way forward for the organisation, you have to convince senior management and get their commitment before you roll it out to your staff. The standard requires effective leadership from top management so it will be a definite barrier to certification if this is not in place and evidenced via various forms of communication. Resources will be easier to obtain too if the right people are behind you.

4 - Get the Right People Involved

It’s been said many times before that the best people to achieve change are the people that actually do the job and that’s still as true today as it ever was. Make sure everyone has a copy of the sections of the standard that are relevant to their job and that they understand the urgency. Get them involved in the risk assessment process and delegate as much as possible of the work on relevant controls etc. to them (whilst accepting that they may have a day job too, of course).

5 – Choose a Friendly Customer or Department

Leading on from your scoping decision, make life easy for yourself and choose a business unit or customer that is already friendly to the idea of improving information security and open to participating in the various activities you will need to start doing such as risk assessment, reporting and review meetings. They will then also be your best supporter when widening the scope to less receptive parts of the organisation or customer base. A little goodwill goes a long way when you’re trying to change the way you manage your information security.

So in a nutshell that’s our quick top 5.

Note, this blog has been updated and review in November 2022 to reflect the ISO27001:2022 standard.


For more tips, download our free ISO 27001 guide!

Download our free ISO27001: 10 steps to certification guide to learn:

  1. Each step of the process from project planning to the certification audit
  2. Expert tips from the CertiKit team on best practise for easy implementation
  3. Key insights into building a successful ISMS

Download free 10 step guide

We’ve helped more than 4000 businesses with their compliance

Testimonials

The toolkits are very clear and easy to use and probably the best examples out there for these standards. Easy to adapt or add details to, to reflect your own processes and procedures.

Aberdein Considine
UK

View all Testimonials