Skip to content
DMC DEFENSE

ISO 27001 isn't a diploma, it's a system that runs.

ISO 27001 is the international standard for information security. It doesn't certify a document: it certifies an Information Security Management System (ISMS) that lives, is measured and improves. We guide you toward certification, which is issued by an independent body.

Contents

An ISMS, not a binder of procedures

The most expensive mistake is treating ISO 27001 as a stack of documents to produce for a stamp. The standard doesn't ask for documents: it asks for a management system, a durable way to decide, act and verify.

That system rests on a risk assessment that is yours alone. You don't tick 93 boxes: you identify what genuinely threatens your information, decide how to treat it, and write a Statement of Applicability that justifies every control kept, or dropped.

And because today's risk isn't next year's, the ISMS is built to run: measure, correct, repeat. Certification attests that this machinery works, not that a file is complete.

The certification cycle

  1. Year 0CertificationStage 1 and 2 audits
  2. Year 1SurveillanceFollow-up audit
  3. Year 2SurveillanceFollow-up audit
  4. Year 3RecertificationThe cycle restarts

Certification is valid for three years. A surveillance audit comes back every year; at the end of the cycle, it all begins again. Not a finish line: a rhythm.

What the standard actually requires

  • A risk-based approach

    Your security decisions flow from your risks, not from a generic template.

  • Continuous improvement

    The ISMS measures and corrects itself in a loop, never freezing in place.

  • 93 controls to weigh

    Annex A proposes; your Statement of Applicability disposes.

The engine: Plan, Do, Check, Act

Beneath the certification runs a loop, known as PDCA. It never stops: each turn refines the security of the one before. Certification is just one point on this ring, crossed once, then revisited at every audit.

The PDCA loop

  • Plan

    Set the scope, map the risks, define security objectives and the controls to put in place.

  • Do

    Implement technical and organizational controls, train teams, keep the procedures alive.

  • Check

    Measure effectiveness through metrics, internal audits and management review. Hunt for gaps.

  • Act

    Fix non-conformities, adjust controls, fold the lessons back in, then start another turn.

The path to certification

Here, by contrast, order matters: this is a real sequence, from the first diagnostic to the certification audit. We run it end to end; the final audit belongs to an independent certification body.

From diagnostic to audit

  1. 01 · Month 1

    Context analysis

    Understand the organization, interested parties and ISMS scope, and measure the gap against the standard.

  2. 02 · Month 2

    Risk assessment

    Identify and evaluate risks, build the treatment plan and write the Statement of Applicability (SoA).

  3. 03 · Month 2-3

    ISMS documentation

    Write the policies and procedures the standard requires, without turning them into an administrative monument.

  4. 04 · Month 3-5

    Implementation

    Deploy technical and organizational controls, train teams, get the system running.

  5. 05 · Month 5-6

    Internal audit

    Audit the ISMS from within, hold the management review, fix non-conformities before the body arrives.

  6. 06 · Month 6-8

    Certification audit

    Support the Stage 1 (documentation) and Stage 2 (effectiveness) audits run by the certification body.

Certified, and the cycle begins

The certificate is issued for three years. The sequence ends, but the loop takes over: from the very next year, a surveillance audit checks that the ISMS is still running.

Indicative durations: they vary with the scope of the ISMS.

The 93 Annex A controls

ISO 27001:2022 groups its controls into four themes. These aren't steps you clear one after another: they apply together, dosed according to your risks.

93controls across 4 themes

  • A.5 · 37 controls

    Organizational

    Policies, roles and responsibilities, asset management, access control, supplier relationships.

  • A.6 · 8 controls

    People

    Hiring, awareness, training, disciplinary process, post-employment responsibilities.

  • A.7 · 14 controls

    Physical

    Secure perimeters, physical access, environmental protection, cabling security.

  • A.8 · 34 controls

    Technological

    Network security, encryption, vulnerability management, secure development, logging.

Breakdown of ISO/IEC 27001:2022 Annex A (clauses A.5 to A.8). Proportional bar.

What certification opens up

Beyond the seal, an ISMS that runs produces concrete effects, on your markets, your clients and your risk exposure.

  • Global recognition

    Certificates reported in 150 countries and across all economic sectors (ISO Survey 2022).

  • Market access

    A frequent prerequisite for public tenders and large private accounts.

  • Client trust

    Independent proof of your rigor, one you can point to without arguing your case.

  • Risk reduction

    Proactive identification and systematic treatment of your information risks.

  • Easier compliance

    A foundation that speeds up GDPR, NIS2 and sector-specific compliance.

  • Continuous improvement

    A permanent adjustment reflex, built into how the company operates.

Sources

The facts in this guide (structure of the standard, number of controls, certificate validity) come from these public texts.

The standard

Certification

Sources checked on 29 September 2026.

Read next

Let's get your ISMS running.

Our experts assess your maturity for free and map a route to certification, from the initial gap all the way to the Stage 2 audit.

Request a free auditDiscover the PSSI

Discover the 24/7 SOC