Getting started: your certification roadmap

1. Get buy-in

   Secure a sponsor, budget and a project lead. Explain the business case.

2. Define scope

   Decide which parts of the business, locations and systems are in (clause 4.3).

3. Gap analysis

   Compare where you are against clauses 4–10 and Annex A.

4. Risk assessment

   Choose a method, assess risks, and decide treatments (6.1, 8.2).

5. Statement of Applicability

   List all 93 controls, mark applicable or not, and justify each.

6. Implement controls & policies

   Write policies, roll out controls, train staff (clauses 7–8).

7. Operate & measure

   Run the ISMS for a few months, collect metrics (9.1).

8. Internal audit & management review

   Audit the full ISMS and hold a management review (9.2, 9.3).

9. Stage 1 audit

   Certification body reviews your documentation and readiness.

10. Stage 2 audit

    Auditor tests that the ISMS works in practice. Pass → certificate (valid 3 years).

11. Surveillance

    Annual surveillance audits, then recertification in year 3.

Core documents checklist

• ISMS scope (4.3)
• Information security policy (5.2)
• Risk assessment & treatment methodology (6.1)
• Statement of Applicability (6.1.3)
• Risk treatment plan (6.1.3, 8.3)
• Security objectives (6.2)
• Competence evidence (7.2)
• Risk assessment results (8.2)
• Monitoring & measurement results (9.1)
• Internal audit programme & results (9.2)
• Management review results (9.3)
• Nonconformities & corrective actions (10.2)