How to prepare for an ISO 27001 certification?

ISO 27001 does not require perfection: it requires demonstrating that information security is managed systematically, with identified risks, proportionate controls, and continuous improvement. Most non-conformities found during mock audits are not about technical flaws, but about missing documented evidence: an unformalized security policy, an untracked access review, a business continuity plan that has never been tested.

The first step is to define the scope of the ISMS: which systems, which teams, which sites are covered. A scope that is too broad needlessly complicates preparation; a scope that is too narrow may be judged unrepresentative by the auditor. Next comes risk assessment, the core of the standard: every information asset must be associated with threats, a likelihood, an impact, and documented treatment measures.

The domains most often underestimated ahead of an audit are identity and access management (IAM), logging and monitoring, incident management, and business continuity. These are also the domains where a structured audit, conducted question by question with supporting evidence, saves the most time before the official audit.

A structured pre-audit, conducted upfront on these domains, makes it possible to objectively measure the gap with the standard and prioritize corrective actions before the actual certification audit, rather than discovering non-conformities on the day itself.