ISO/IEC 27001 is the international standard for an Information Security Management System, commonly called an ISMS. It helps an organisation manage information-security risk through defined governance, repeatable assessment, proportionate controls and continual improvement.
What an ISMS Covers
An ISMS is broader than an IT security project. Its scope can include people, processes, facilities, suppliers, cloud services and information in physical or digital form. Leadership defines the scope and risk criteria, assigns responsibilities and makes sure the system supports business and contractual needs.
The organisation then identifies information-security risks, evaluates them consistently and records treatment decisions. The Statement of Applicability explains which controls are relevant, why they are included or excluded and how they are implemented.
Evidence Matters
Policies alone are not enough. Auditors expect evidence that the system operates: completed risk reviews, access decisions, supplier assessments, incident records, awareness activities, monitoring results, internal audits, management reviews and corrective actions. Evidence should reflect normal work rather than a once-off exercise before the audit.
A Practical Readiness Path
- Define the ISMS scope and responsible leaders.
- Assess current practices against the standard.
- Complete risk assessment and treatment planning.
- Implement proportionate policies, processes and controls.
- Operate the system and retain evidence.
- Perform an internal audit and management review.
- Close findings and prepare for the independent audit.
Timeframes vary with scope, complexity and existing controls. No responsible consultant can guarantee certification or a completion date before understanding the organisation.
Certivanta provides ISO 27001 implementation and certification-readiness support. An independent certification body conducts the certification audit and decides whether to issue a certificate. Explore our ISO 27001 consulting service or request a consultation.
A South African Buyer Scenario
A local SaaS provider preparing for an enterprise procurement review may need to explain how remote access, cloud hosting, incident response and suppliers are governed. Rather than answering each questionnaire from scratch, the ISMS can connect those commitments to approved risks, controls and evidence. It can also support privacy governance, although ISO 27001 certification does not itself prove POPIA compliance.
Questions to Ask Before Appointing Support
- Will the scope cover the service customers are actually buying?
- Who owns risk acceptance and technical remediation?
- How will existing cloud and supplier evidence be reused?
- What work must be completed before internal and external audit?
What Drives the Cost?
Scope, architecture, sites, supplier reliance, current security maturity and evidence quality determine consulting effort. Penetration testing, security tools, legal advice, standards purchases and certification-body fees are separate unless included in writing. Review Certivanta’s consultation package and the full ISO 27001 service.
What a Useful ISO 27001 Proposal Should Confirm
A proposal should identify the intended ISMS boundary, the workshops and deliverables included, the responsibilities retained by the client and the evidence needed before audit. It should distinguish management-system consulting from technical remediation and independent certification. Ask how risks, the Statement of Applicability, internal audit and management review will be handled, and which assumptions could change the fee or timetable.