The ISO/IEC 27001 certification process involves assessing whether an organization has established, implemented, and maintains an Information Security Management System (ISMS)that is appropriate for its risks, activities, and scope, in accordance with the requirements of the standard UNE-EN ISO/IEC 27001:2023 (equivalent to ISO/IEC 27001:2022)
The ISO/IEC 27001 certification provided by ACERTA allows for an independent assessment of whether an organization has an Information Security Management System (ISMS)designed to identify, analyze, and address risks that may affect the confidentiality, integrity, and availability of information.
The standard UNE-EN ISO/IEC 27001:2023, equivalent to ISO/IEC 27001:2022, applies to organizations of any size and in any sector. Its approach integrates people, processes, and technology, and enables the systematic management of information security in a manner that is proportionate to the risks and focused on continuous improvement.
The certification process is divided into several phases: review of the application and scope, audit planning, and initial audit in Stage 1 and Stage 2, handling of nonconformities, independent review, and decision-making. When the outcome is favorable, the certificate is issued, and a three-year certification cycle begins, with periodic follow-up audits and a renewal audit prior to expiration.
This process allows us to evaluate the effectiveness of the ISMS, verify the management of information security risks, verify the implementation of selected controls and identify nonconformities and opportunities for improvement. Certification instills confidence in customers, government agencies, partners, and other stakeholders, and can help meet contractual requirements, supplier qualification processes, and bidding requirements.
ISO/IEC 27001 can also serve as a basis for organizing and providing evidence in relation to other security frameworks and regulatory requirements, such as the National Security Scheme, the NIS2 Directive, the DORA Regulation , or data protection requirements. However, ISO/IEC 27001 certification does not replace the specific assessments, certifications, or audits that these frameworks may require. NIS2 establishes its own obligations regarding risk management, monitoring, and incident reporting, while DORA incorporates specific requirements for digital operational resilience in the financial sector.
ISO/IEC 27001 is an international standard that establishes the requirements for implementing, maintaining, and improving an Information Security Management System (ISMS).
This application enables the identification and management of risks that may affect the confidentiality, integrity, and availability of information through organizational, human, physical, and technological measures.
Certification helps demonstrate to customers, partners, and other stakeholders that the organization manages information security in a systematic manner and that its ISMS has been assessed by an independent body.
The specific classification of activities must be carried out in accordance with applicable regulations and the characteristics of each project.
Any organization can be certified, regardless of its size, industry, or level of complexity. The standard applies to large organizations as well as small and medium-sized enterprises (SMEs), microenterprises, technology providers, and professionals who manage relevant information within a clearly defined scope.
In general, certification is voluntary. However, it may become a commercial or contractual requirement when demanded by a customer, a bid, a parent company, a business partner, or a supplier qualification process.
The Information Security Management System within the scope defined by the organization.
The scope may cover the entire organization or be limited to specific services, processes, activities, locations, or units. Its boundaries must be clear and consistent, and may not exclude elements that are essential for the proper management of risks.
ISO/IEC 27001 does not certify a product, application, technology platform, or cloud service on its own, although these elements may be part of the assessed ISMS.
Not necessarily. The organization must select the necessary controls based on its risks, legal requirements, contractual commitments, and the needs of its stakeholders.
The selection is included in the Statement of Applicability, which identifies the controls deemed necessary, their implementation status, and the justification for any exclusions. In addition, the organization must verify that it has not omitted any relevant controls from Annex A.
Therefore, certification does not involve automatically applying a fixed list of measures, but rather demonstrating that risks have been properly identified and addressed.
The process begins with a review of the application, the organization's scope, and its characteristics. Based on this information, the duration of the audit is determined and the evaluation is planned.
The initial audit is conducted in two stages:
After any nonconformities have been resolved, the file undergoes an independent review, and a decision regarding certification is made.
The organization must analyze the causes, make the necessary corrections, define corrective actions, and provide evidence of their implementation within the established timeframe.
The identification of nonconformities does not automatically result in the denial of certification. However, nonconformities that prevent confirmation of the conformity or effectiveness of the ISMS must be satisfactorily resolved before a favorable decision can be made.
Depending on its nature, the verification may be conducted through a document review or may require additional checks
The certification cycle lasts three years. Following the initial audit, periodic follow-up audits are conducted, and a renewal audit is performed before the cycle ends.
The time required to obtain certification depends on the scope, size, and complexity of the organization; the number of locations; the technologies used; the outsourcing of services; and the ISMS's prior level of maturity.
Prior to the initial audit, the organization must have a system in place and sufficient evidence of its operation, including risk assessment, the Statement of Applicability, the internal audit, and management review.
Yes. ISO/IEC 27001 can be integrated with standards such as ISO 9001, ISO 14001, ISO 20000-1, or ISO 22301, sharing processes related to context, leadership, objectives, competencies, internal auditing, management review, and continuous improvement.
It can also facilitate the organization of controls and documentation related to the National Security Framework, NIS2, DORA, and data protection requirements.
However, ISO/IEC 27001 certification does not replace the compliance or specific assessments required by these frameworks. Each framework has its own scope, requirements, and oversight or certification mechanisms.
Our team can analyze your case and guide you through the requirements, necessary documentation, and steps to begin the process with ACERTA. Contact us for a free consultation, and we'll respond within 24 hours.
If you have any questions, comments or suggestions, please do not hesitate to contact us.
