More Irish organisations are being asked a simple question in tenders and supplier reviews: are you ISO 27001 certified? Clients, partners and procurement teams want evidence that information is protected by a managed system, not just by a collection of tools.
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current version is ISO/IEC 27001:2022. The transition period for the older 2013 version ended on 31 October 2025, so any valid certificate today is to the 2022 edition. Everything IT is itself ISO 27001:2022 certified, and this guide explains what the journey involves: the steps, a realistic view of timing, and what auditors actually look for.
What certification actually means
Certification means an independent certification body has audited your ISMS and confirmed that it meets the requirements of the standard. A certificate typically runs on a three-year cycle, with surveillance audits in the intervening years to confirm the system is still working.
Choose an accredited certification body. In Ireland, accreditation is provided by INAB, the Irish National Accreditation Board, and certification bodies such as NSAI hold INAB accreditation for ISO/IEC 27001:2022. Bodies accredited by other recognised national accreditation bodies are also widely accepted.
The steps to ISO 27001 certification
1. Decide why, and define the scope
Be clear about the goal: a client requirement, a tender, regulatory expectations or simply better control of risk. Then define the scope: which parts of the organisation, which locations, systems and services the ISMS will cover. A sensible scope is the single biggest factor in a manageable project.
2. Secure leadership commitment
The standard requires top management to own the ISMS: approving the policy, providing resources and taking part in reviews. Name who is responsible for running it day to day.
3. Understand your context
Identify the internal and external issues that affect information security, the interested parties (clients, staff, suppliers, regulators) and what they require of you.
4. Assess risk
Agree a method for assessing risk, then identify threats and vulnerabilities to your information, how likely they are and what the business impact would be. Priorities should be based on evidence, not guesswork.
5. Choose controls and write the Statement of Applicability
Annex A of ISO 27001:2022 lists 93 controls in four themes: organisational, people, physical and technological. You do not have to apply every control. You select the controls your risks call for and record your decisions, with justifications, in a Statement of Applicability (SoA).
6. Implement the controls
Put the chosen controls into operation: access management, supplier security, backups, incident response, secure configuration, staff awareness and so on. Proportionate administrative, technical and physical controls should reduce each risk to an acceptable level.
7. Document what matters
Write the policies and procedures the standard requires and your organisation needs. Documents should describe how you really work. Templates copied without adapting them are one of the most common reasons audits go badly.
8. Train and raise awareness
Everyone in scope should understand the policy, their responsibilities and how to report an incident. Keep records of training.
9. Run an internal audit and a management review
Before the certification audit, audit the ISMS internally against the standard, and hold a management review of its performance. Both must have happened, with records, before the external audit can succeed.
10. Stage 1 and Stage 2 certification audits
Stage 1 reviews your documentation and readiness: is the ISMS designed properly and is the organisation ready for a full audit? Stage 2 tests whether the system is implemented and working effectively, through records, sampling and interviews. Any nonconformities must be addressed before the certificate is issued.
How long does it take?
It depends on the scope, the size of the organisation and how mature its security practices already are. Organisations with strong existing controls move faster; those starting from scratch need longer. Plan for it to take months rather than weeks. The ISMS also needs to run long enough to produce real evidence, such as risk reviews, training records, an internal audit and a management review, before Stage 2.
What auditors check
- The scope statement and the information security policy.
- Your risk assessment method, risk register and risk treatment plan.
- The Statement of Applicability and the reasoning behind each decision.
- Evidence that controls operate: access reviews, backup and restore tests, patching records, supplier assessments, incident logs.
- Training and awareness records.
- Internal audit reports, management review minutes and corrective actions.
- Interviews with staff, to confirm practice matches the documents.
Common pitfalls
- A scope that is too broad for the first certification.
- Policies that describe an ideal organisation rather than yours.
- Controls that exist on paper but leave no evidence.
- Treating it as an IT-only project, when HR, facilities, finance and suppliers are all involved.
- Losing momentum after the certificate arrives, leading to trouble at the first surveillance audit.
ISO 27001, GDPR and NIS2
A working ISMS gives you structure that supports other obligations, such as the security requirements of GDPR and the risk management expectations of the EU’s NIS2 Directive. Certification is not the same as compliance with either, but it gives you much of the governance, risk assessment and evidence they call for.
Frequently asked questions
Do we need to implement all 93 Annex A controls?
No. You consider all of them, apply the ones your risk assessment requires, and justify any exclusions in your Statement of Applicability.
Is a 2013 certificate still valid?
No. Certificates to ISO/IEC 27001:2013 expired at the end of the transition period on 31 October 2025. Certification now has to be to the 2022 version.
What happens after certification?
Surveillance audits check that the ISMS stays effective, and recertification follows at the end of the cycle. Keep running risk reviews, internal audits, management reviews and corrective actions throughout.
Start with a clear view of where you are
Everything IT’s ISO 27001 compliance support covers the full journey: gap assessment, policy development, risk assessment, control implementation, audit readiness and ongoing maintenance after certification. The goal is a security management system that fits the way your people, technology, suppliers and processes actually work.