Step 1 – Initial Consultation

Understand your organization’s information-security objectives, business activities, risks, and certification requirements.

Step 2 – Gap Assessment

Evaluate your existing information-security practices against ISO/IEC 27001 requirements.

Step 3 – Define ISMS Scope

Determine the locations, departments, systems, information assets, processes, products, and services covered by the ISMS.

Step 4 – Information Security Risk Assessment

Identify information assets, threats, vulnerabilities, risks, and opportunities relevant to the ISMS scope.

Step 5 – Documentation

Develop ISMS policies, procedures, risk-management documentation, Statement of Applicability, controls documentation, and supporting records.

Step 6 – Implementation

Implement the ISMS and applicable security controls throughout the defined scope.

Step 7 – Employee Training

Train employees on information-security policies, procedures, cybersecurity awareness, risk responsibilities, and applicable controls.

Step 8 – Internal Audit

Conduct internal audits to evaluate ISMS conformity and identify nonconformities.

Step 9 – Management Review

Review ISMS performance, objectives, risk treatment, incidents, audit findings, corrective actions, and improvement opportunities.

Step 10 – Corrective Actions

Address identified nonconformities and verify that corrective actions are effective.

Step 11 – Certification Audit

An independent certification body conducts the external assessment of your ISMS.

Step 12 – Certification Decision

The certification body reviews the audit results and independently makes the certification decision.

Step 13 – Continual Improvement

Maintain the ISMS, monitor security performance, reassess risks, address incidents and nonconformities, and continually improve information-security practices.