Clients, insurers and procurement teams are asking more questions than ever about how their suppliers protect information. For many UK businesses, the clearest way to answer those questions is ISO 27001, the international standard for information security management.
ISO 27001 is not just for IT companies. Security firms, facilities providers, recruitment businesses, consultancies and contractors all handle personal data, client information and operational records that need protecting. This guide explains what ISO 27001 is, who needs it, what an information security management system involves, how risk assessment and the Statement of Applicability work, and how to prepare for certification.
What Is ISO 27001?
ISO/IEC 27001 is the international standard that sets out requirements for an information security management system (ISMS). The current version is ISO/IEC 27001:2022. It gives organisations a structured way to identify information security risks, decide how to treat them and keep improving over time.
The standard protects three core properties of information:
- Confidentiality: information is only available to people authorised to see it
- Integrity: information is accurate and has not been altered without authority
- Availability: information is accessible to authorised people when they need it
ISO 27001 follows the same high-level structure as other ISO management system standards, such as ISO 9001 and ISO 45001. That makes it easier to run an integrated management system if you already hold another ISO certification.
Who Needs ISO 27001?
ISO 27001 is voluntary, but it is increasingly expected by clients. You are likely to benefit if:
- Clients or tenders ask about information security, data protection or cyber controls
- You handle personal data about employees, customers or members of the public
- You hold sensitive client information, such as site plans, access codes, CCTV footage or financial records
- You supply the public sector, financial services, healthcare or critical infrastructure
- You want to reduce the risk and cost of data breaches and cyber incidents
For security companies in particular, ISO 27001 can strengthen tenders by showing that client data, alarm and access information, rota data and incident records are properly controlled.
ISO 27001 and UK GDPR
ISO 27001 does not make you automatically compliant with UK GDPR, but the two work well together. UK GDPR requires appropriate technical and organisational measures to protect personal data. An ISMS gives you a documented, risk-based way to decide what those measures are, apply them and prove they are working.
Key ISMS Requirements
The main requirements of ISO 27001 sit in clauses 4 to 10 of the standard. In practical terms, they ask you to:
| Clause | What It Covers | What It Means in Practice |
|---|---|---|
| 4. Context | Your organisation, interested parties and ISMS scope | Define what the ISMS covers and which requirements apply to you. |
| 5. Leadership | Management commitment, policy and roles | Senior management owns the ISMS, sets the policy and assigns responsibilities. |
| 6. Planning | Risk assessment, risk treatment and objectives | Identify information security risks and decide how to treat them. |
| 7. Support | Resources, competence, awareness and documentation | Train staff, raise awareness and control ISMS documents. |
| 8. Operation | Running the ISMS | Carry out risk assessments and apply risk treatment plans. |
| 9. Performance evaluation | Monitoring, internal audit and management review | Check that controls work and review performance regularly. |
| 10. Improvement | Nonconformity, corrective action and continual improvement | Fix problems at their root cause and keep improving. |
Annex A Controls
Alongside the clauses, ISO 27001:2022 includes Annex A, a reference list of 93 information security controls grouped into four themes:
- Organisational controls, such as policies, supplier security, asset management and incident management
- People controls, such as screening, awareness training and confidentiality agreements
- Physical controls, such as secure areas, clear desk and equipment protection
- Technological controls, such as access control, malware protection, backups and logging
You do not have to apply every control. You select the controls that address your risks, and justify your decisions in the Statement of Applicability.
The Risk Assessment Process
Risk assessment is the heart of ISO 27001. A typical process looks like this:
- Define your method: set clear criteria for assessing likelihood and impact, and for deciding which risks are acceptable.
- Identify risks: consider threats to your information assets, such as lost devices, phishing, unauthorised access, supplier failures or accidental disclosure.
- Analyse and evaluate: score each risk and decide which need treatment.
- Treat risks: reduce, avoid, transfer or accept each risk, choosing controls from Annex A or elsewhere.
- Record and review: document the results, get risk owners to approve the treatment plan and review risks regularly or when something changes.
Auditors expect the risk assessment to be repeatable and to produce consistent results. A clear, simple method that your team actually uses is far better than a complex spreadsheet nobody understands.
The Statement of Applicability
The Statement of Applicability (SoA) is one of the key documents in any ISMS. It lists every Annex A control and states:
- Whether the control is included or excluded
- Why it is included, usually linked to a risk, legal requirement or client requirement
- Why any control is excluded
- Whether the included control has been implemented
Certification auditors use the SoA as a map of your ISMS, so it needs to be accurate and consistent with your risk assessment.
Implementation Steps
| Step | What Happens |
|---|---|
| 1. Gap analysis | Compare your current practices against ISO 27001 to see what already exists and what is missing. |
| 2. Scope and policy | Define the ISMS scope and agree the information security policy with senior management. |
| 3. Risk assessment | Identify, analyse and evaluate information security risks. |
| 4. Risk treatment and SoA | Select controls, create the risk treatment plan and complete the Statement of Applicability. |
| 5. Implement controls | Put policies, procedures and technical controls in place, and train staff. |
| 6. Operate and gather evidence | Run the ISMS for long enough to produce records, such as access reviews, incident logs and training records. |
| 7. Internal audit and management review | Audit the ISMS and hold a management review before certification. |
For a small or medium-sized business with some existing controls, implementation often takes several months. The timeline depends on your scope, existing systems and how much time your team can commit.
The Certification Process
Certification is carried out by an independent certification body, ideally one accredited by UKAS. It usually involves two stages:
- Stage 1 audit: a review of your ISMS documentation and readiness, including scope, risk assessment and SoA.
- Stage 2 audit: a detailed assessment of whether your ISMS is implemented and working effectively in practice.
Once certified, the certificate normally runs on a three-year cycle, with surveillance audits in the intervening years and a recertification audit at the end of the cycle.
What Does ISO 27001 Cost?
Costs vary widely depending on your size, scope and complexity. The main elements are:
- Certification body fees for stage 1, stage 2 and surveillance audits
- Consultancy support, if you use it, for gap analysis, documentation and audit preparation
- Internal time for your team to implement and operate the ISMS
- Technical improvements identified by the risk assessment, such as better backup, access control or device management
Ask several UKAS-accredited certification bodies for quotes based on your specific scope before you budget.
Common Mistakes
- Treating ISO 27001 as an IT project rather than a business management system
- Buying a template pack that does not reflect how the business actually works
- Choosing a scope that is too broad, or so narrow that clients see little value in it
- Producing a risk assessment once and never reviewing it
- Not keeping enough records to prove controls are operating
How ESC Support Can Help
ESC Support helps UK businesses plan, implement and maintain ISO 27001 in a way that fits how they actually operate. Our ISO 27001 consultancy covers gap analysis, scope, risk assessment, Statement of Applicability, policies and procedures, staff awareness and certification preparation. We can also carry out internal audits before your certification audit and integrate ISO 27001 with an existing ISO 9001 system.
Frequently Asked Questions
Is ISO 27001 a legal requirement?
No. ISO 27001 is voluntary, but it is often required by clients and in tenders, and it helps demonstrate the appropriate security measures expected under data protection law.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 sets out the requirements you are certified against. ISO 27002 is supporting guidance that explains the Annex A controls in more detail. You cannot be certified to ISO 27002.
Do we need to implement all 93 Annex A controls?
No. You select the controls that address your risks and requirements, and justify inclusions and exclusions in the Statement of Applicability.
How long does ISO 27001 certification take?
It depends on your size, scope and starting point. Many small and medium-sized businesses take several months to implement the ISMS and generate enough evidence for the certification audit.
Is ISO 27001 only for IT companies?
No. Any organisation that handles valuable or sensitive information can benefit, including security companies, facilities providers, recruitment firms and professional services businesses.
Can ISO 27001 be combined with ISO 9001?
Yes. Because both standards share the same high-level structure, many businesses run them as an integrated management system with shared processes for document control, internal audit and management review.
Build an ISMS That Works for Your Business
Gap analysis, risk assessment, Statement of Applicability, policies and certification preparation, delivered by ESC Support. Get a clear plan for ISO 27001.