How Does the ISO 27001 Certification Process Work? A Guide to TÜRKAK, Stage 1, Stage 2 and Surveillance Audits

What Is ISO 27001 Certification?

ISO/IEC 27001 certification is the process in which an independent certification body assesses whether the Information Security Management System (ISMS) that an organisation has established and operates within a defined scope conforms to the requirements of the ISO/IEC 27001 standard.

ISO/IEC 27001:2022 is an international management system standard for the systematic management of information security.

The standard is built on assessing information security risks, determining security controls, defining management responsibilities, monitoring performance and continual improvement.

The certification process does not merely examine whether security policies exist. It also assesses whether those policies are implemented, whether risk management processes are operated and how effective the security controls are.

Short answer: To obtain an ISO 27001 certificate, an organisation needs to define its ISMS scope, implement the requirements of the standard, carry out risk assessment and risk treatment, perform an internal audit and a management review, and successfully pass the independent certification audits.

1. What Is an ISO 27001 Certificate Good For?

ISO/IEC 27001 certification helps an organisation demonstrate that it addresses information security within a defined management system framework.

It can be particularly important for customer trust, supplier assessments, international contracts and corporate governance.

Main benefits

• Establishing a systematic approach to information security management.
• Identifying and prioritising risks.
• Clarifying security responsibilities.
• Providing assurance to customers and business partners.
• Supporting contractual security requirements.
• Institutionalising audit and improvement processes.
• Measuring information security performance.
• Planning security investments on a risk basis.

Limits of the certificate

An ISO 27001 certificate does not show that an organisation has no security vulnerabilities.

Nor does it mean that all systems have undergone penetration testing, that no data breach will ever occur, or that every piece of legislation is automatically complied with.

The certificate means that, within the defined scope, the ISMS has been assessed against the requirements of the relevant standard.

2. What Does the ISO/IEC 27001:2022 Standard Cover?

ISO/IEC 27001:2022 contains the requirements for an information security management system.

The management system requirements are set out in clauses 4 to 10 of the standard.

Clause	Topic	Core purpose
4	Context of the organisation	ISMS scope and relevant requirements
5	Leadership	Management responsibility and policy
6	Planning	Risk assessment, risk treatment and objectives
7	Support	Resources, competence, communication and documentation
8	Operation	Implementation of ISMS processes
9	Performance evaluation	Measurement, internal audit and management review
10	Improvement	Nonconformity management and continual improvement

Annex A of the standard contains 93 reference information security controls.

These controls are organised into four groups: organisational, people, physical and technological.

When preparing for certification, the management system requirements and the necessary security controls should be addressed together.

3. Who Is an ISO 27001 Certificate Suitable For?

ISO/IEC 27001 is not a standard designed only for large technology companies.

It can be applied by organisations of different sizes that process, store or transmit information, or that provide critical services.

Example sectors

Banking and finance.

Insurance.

Healthcare.

Defence industry.

Software development.

Cloud services.

Data centre operations.

Telecommunications.

E-commerce.

Manufacturing.

Logistics.

Professional services.

Public institutions.

Is it suitable for small businesses?

Yes.

However, the ISMS scope, organisational structure and security needs of a small business may differ from those of a large financial institution.

While the requirements of the standard are met, it is important that the implementation is proportionate to the organisation's size and risks.

4. Is It Mandatory to Obtain an ISO 27001 Certificate?

ISO/IEC 27001 certification is not a general, universal legal requirement for all organisations.

However, information security certification may be requested in certain sectors, regulations, tenders or contracts.

Situations in which the certificate may be requested

Public tenders.

Supplier assessments in the financial sector.

International customer contracts.

Cloud service procurement.

Data processing services.

Critical infrastructure supply chains.

An important distinction

A customer asking for an ISO 27001 certificate is not the same thing as the relevant legislation making the certificate mandatory.

The source of the obligation should be examined separately.

5. Stages of the ISO 27001 Certification Process

The certification process generally consists of the following stages.

Stage 1: Defining the ISMS scope

The activities, locations, systems and processes that will fall within the scope are defined.

Stage 2: Current-state analysis

The organisation's existing practices are compared with the requirements of the standard.

Stage 3: Establishing the ISMS

Policies, processes, responsibilities and the risk management approach are put in place.

Stage 4: Implementing controls

The necessary technical and administrative controls are implemented in line with the risk treatment decisions.

Stage 5: Internal audit

The conformity and effectiveness of the ISMS are assessed.

Stage 6: Management review

Top management evaluates the performance of the management system and the need for improvement.

Stage 7: Stage 1 audit

Certification readiness is reviewed.

Stage 8: Stage 2 audit

The implementation and effectiveness of the ISMS are assessed.

Stage 9: Certification decision

The audit results are evaluated in accordance with the relevant certification rules.

Stage 10: Surveillance and recertification

The relevant audits are carried out to maintain the certificate.

6. How Is the ISO 27001 Certification Scope Defined?

The certification scope determines which activities and organisational boundaries the certificate applies to.

Scope definition criteria

Products and services offered.

The organisation's activities.

Physical locations.

Information systems.

Business processes.

Outsourced services.

Requirements of interested parties.

Technological dependencies.

Example scope

“Information security management activities relating to the organisation's software development, application maintenance, technical support and managed cyber security services.”

This is only an example scope statement.

The actual scope should be prepared taking into account the organisation's activities and boundaries.

A common mistake

Leaving critical dependencies out of the assessment in order to reduce the cost of certification.

Narrowing the scope is possible, but the boundaries defined must be consistent and justifiable.

7. What Is an ISO 27001 Current-State Analysis?

A current-state analysis is the comparison of an organisation's existing information security practices with the requirements of the standard.

This work is usually called a gap analysis.

Assessment areas

ISMS scope.

Information security policies.

Risk management.

Asset inventory.

Access control.

Human resources security.

Supplier security.

Incident management.

Backup.

Business continuity.

Performance measurement.

Internal audit.

Example

It may be found that the organisation performs regular backups but does not record its restore tests.

In that case, how the effectiveness of the existing control will be verified should be assessed.

Gap analysis outputs

Current-state report.

List of gaps.

Inputs to the risk assessment.

Improvement plan.

Responsibilities.

Priorities.

8. Why Is Risk Assessment Important in Certification?

Risk assessment is one of the core processes of the ISMS.

Clause 6.1.2 of ISO/IEC 27001:2022 defines the requirements for information security risk assessment.

Risk assessment process

Establishing risk criteria.

Identifying risks.

Determining risk owners.

Assessing potential consequences.

Determining risk levels.

Prioritising risks.

Example

Asset: Customer database.

Risk: Unauthorised data access.

Risk source: Excessively broad access permissions.

Potential consequence: Disclosure of sensitive information.

Control: Role-based access and access review.

Key point

ISO 27001 does not require the same risk matrix or risk scoring formula for all organisations.

What matters is that the methodology produces consistent and repeatable results.

9. How Is the Risk Treatment Plan Assessed in Certification?

The risk treatment plan shows how the identified risks will be managed.

Example risk treatment options

Risk modification (mitigation).

Risk avoidance.

Risk sharing.

Risk acceptance.

Fields in a risk treatment plan

Risk ID.

Risk description.

Risk level.

Selected treatment method.

Planned control.

Owner.

Target date.

Verification method.

Residual risk.

Example

Risk: Lack of MFA on critical systems.

Treatment: Implementing MFA.

Owner: Identity management team.

Evidence: MFA coverage report.

Residual risk: To be reassessed once the control has been implemented.

In an audit, it is not only the existence of the risk treatment plan that may be examined, but also the implementation status of the planned activities.

10. Why Is the ISO 27001 SoA Required for Certification?

The SoA (Statement of Applicability) is the document that shows the controls necessary to treat information security risks, the justification for selecting them, their implementation status, and the justification for any Annex A controls that are excluded.

Core functions of the SoA

Justifying control selections.

Establishing the link with risk treatment decisions.

Showing the implementation status of controls.

Assessing the Annex A controls.

Example

Control: A.8.13 – Information backup.

Justification: Reducing the risk of loss of critical data.

Implementation status: Implemented.

Evidence: Backup logs and restore tests.

A common mistake

Marking all 93 controls as “implemented” without carrying out any assessment.

The SoA must reflect the actual implementation status.

11. How Do You Choose an ISO 27001 Certification Body?

The choice of certification body matters for the credibility of the process.

Evaluation criteria

Accreditation status.

Accreditation scope.

ISO/IEC 27001 certification competence.

Sector experience.

Audit approach.

Audit duration.

Scope of the quotation.

Surveillance costs.

International recognition.

Key point

It is not enough for a certification body simply to use the word “accredited” on its website.

The validity of the accreditation and whether it covers the relevant standard should be verified.

12. What Is TÜRKAK (Turkish Accreditation Agency) Accreditation?

TÜRKAK is the national accreditation body in Türkiye that assesses the competence of conformity assessment bodies against specific standards.

The accreditation status of organisations offering ISO/IEC 27001 certification services is important.

The role of TÜRKAK

Assessing certification bodies against the relevant accreditation requirements.

Determining accreditation scopes.

Monitoring accreditation status.

The difference between certification and accreditation

Certification: Assessing the conformity of an organisation's management system to a standard.

Accreditation: Assessing whether a certification body is able to carry out the relevant conformity assessment activity competently.

These two concepts should not be confused.

13. How Do You Verify the TÜRKAK Accreditation of an ISO 27001 Certificate?

When assessing the credibility of a certificate, a logo on the PDF is not enough.

What to check

The name of the certification body.

The certificate number.

The certification standard.

The scope of the certificate.

The validity status of the certificate.

The accreditation status of the certification body.

The accreditation scope.

Verification sources

TÜRKAK's official accreditation records.

The certification body's official certificate verification system.

International accreditation verification mechanisms, where appropriate.

Official source

TÜRKAK: https://www.turkak.org.tr

Critical point

A body being accredited for another standard does not automatically mean it is also accredited for ISO/IEC 27001 certification.

The accreditation scope must be checked separately.

14. What Is the ISO 27001 Stage 1 Audit?

Stage 1 is the readiness assessment phase of the initial certification process.

At this stage, the organisation's ISMS structure, scope and readiness for the Stage 2 audit are reviewed.

Topics that may be assessed

ISMS scope.

Policies.

Risk assessment methodology.

Risk assessment results.

Risk treatment plan.

SoA.

Information security objectives.

Internal audit status.

Management review.

The organisation's activities and locations.

The purpose of Stage 1

Assessing the organisation's readiness for the Stage 2 audit.

Identifying significant gaps.

Providing input for planning the next audit.

15. Which Documents May Be Requested in a Stage 1 Audit?

The records requested may vary depending on the certification body's methodology.

Example documents

ISMS scope document.

Information security policy.

Organisation structure.

Risk assessment methodology.

Risk register.

Risk treatment plan.

SoA.

Information security objectives.

Internal audit programme and results.

Management review records.

An important distinction

Not every organisation needs to prepare all of its procedures in the same format.

The documented information that the standard requires and the effectiveness of the management system should be the basis.

16. What Happens If Gaps Are Found in the Stage 1 Audit?

During Stage 1, gaps that affect readiness for Stage 2 may be identified.

Example

The risk assessment may not have been completed.

The SoA may not have been created.

The ISMS scope may not be sufficiently clear.

The internal audit process may not have been carried out as planned.

Outcome

The certification body may notify the organisation of areas that must be resolved before Stage 2.

If necessary, the Stage 2 schedule may be reassessed.

Key point

It should not be assumed that every gap identified in Stage 1 will automatically lead to the same classification or outcome.

The relevant certification procedures apply.

17. What Is the ISO 27001 Stage 2 Audit?

Stage 2 is the phase in which the implementation and effectiveness of the ISMS are assessed.

This audit examines whether policies and procedures are reflected in real operations.

Example audit areas

Risk management.

Asset inventory.

Access control.

Human resources security.

Supplier management.

Technical vulnerability management.

Incident response.

Logging and monitoring.

Backup.

Business continuity.

Performance evaluation.

Corrective actions.

Example

The organisation may state that MFA is applied on critical accounts.

The auditor may assess the implementation status through samples of relevant accounts and system records.

18. Differences Between Stage 1 and Stage 2

Criterion	Stage 1	Stage 2
Core purpose	Readiness assessment	Assessment of implementation and effectiveness
Focus	Scope, documentation and readiness	Operational practices and evidence
Risk management	Method and readiness are reviewed	Implementation results are reviewed
SoA	Its existence and consistency are assessed	Its relationship with control implementation is verified
Technical controls	May be assessed from a readiness perspective	Implementation evidence may be examined in detail
Outcome	Readiness for Stage 2	Input to the certification decision

This comparison describes the general approach.

Different types of evidence may be examined in both stages.

19. What Evidence Is Requested in an ISO 27001 Audit?

Audit evidence varies according to management system processes and control requirements.

Management evidence

Policies.

Risk assessment records.

SoA.

Management meeting records.

Internal audit reports.

Corrective action records.

Technical evidence

Firewall configurations.

Access authorisation records.

MFA coverage reports.

Vulnerability scan results.

Backup logs.

Logging reports.

Security test results.

Operational evidence

Incident response records.

Supplier assessments.

Training records.

Change management records.

Account creation and deactivation records.

Critical point

It is important that evidence is current, relevant, verifiable and related to the audit scope.

20. How Are Technical Controls Verified in an ISO 27001 Audit?

Policy documents alone may not be sufficient when assessing technical controls.

Example verifications

Reviewing privileged accounts.

Assessing firewall rules.

Checking VPN access controls.

Reviewing server security configurations.

Assessing cloud IAM permissions.

Reviewing backup restore test results.

Checking vulnerability management records.

Example

Control: Technical vulnerability management.

Evidence: Vulnerability scan reports.

Additional assessment: How critical findings were prioritised.

Verification: Re-check records for findings that were closed.

An important distinction

A certification audit is not the automatic equivalent of a comprehensive penetration test.

Technical testing may require separate expertise and authorisation.

21. What Is a Major Nonconformity in ISO 27001?

A major nonconformity may refer to a significant failure in the management system's ability to meet requirements or to achieve its intended outcomes.

Examples

The risk assessment process not being implemented at all.

The internal audit requirement not being met systematically.

Significant implementation failures in critical ISMS processes.

Recurring and systematic control failures.

Key point

Classifying a finding as major is done within the framework of the relevant audit criteria and certification rules.

A major nonconformity decision is not made by looking only at the CVSS score of a technical vulnerability.

22. What Is a Minor Nonconformity in ISO 27001?

A minor nonconformity may refer to more limited failures that do not significantly undermine the overall effectiveness of the management system.

Examples

Isolated record omissions.

Limited documentation inconsistencies.

Non-systematic implementation gaps in specific processes.

Example

A training record missing required information may be assessed as a minor nonconformity.

However, if similar omissions are widespread, they may point to a more significant problem.

Critical point

Minor nonconformities should not be dismissed as unimportant.

Their root causes should be assessed and the necessary corrective actions implemented.

23. Does a Major Nonconformity Prevent You from Obtaining the Certificate?

A major nonconformity can significantly affect the certification decision.

In the initial certification process, the relevant requirements must be met and nonconformities must be handled according to the certification body's rules.

Example process

A major nonconformity is identified.

The organisation prepares a correction and corrective action plan.

The necessary activities are carried out.

The certification body uses appropriate verification methods.

The certification decision is assessed according to the relevant rules.

Key point

The timeframes and methods for resolving and verifying major nonconformities depend on the relevant certification rules.

A single fixed timeframe should not be assumed for all organisations.

24. How Is an ISO 27001 Nonconformity Closed?

Nonconformity management is not just a matter of fixing the existing gap.

Step 1: Evaluating the nonconformity

The scope and impact of the finding are determined.

Step 2: Correction

The consequences of the existing nonconformity are dealt with.

Step 3: Root cause analysis

The conditions that caused the nonconformity are investigated.

Step 4: Corrective action

Actions aimed at preventing recurrence are implemented.

Step 5: Effectiveness verification

The effect of the actions is assessed.

Example

Nonconformity: A departed employee's account is still active.

Correction: Deactivating the account.

Root cause: An incomplete notification process between human resources and IT.

Corrective action: A controlled account deactivation workflow.

Verification: Reviewing records of new leavers.

25. How Is the ISO 27001 Certification Decision Made?

The certification decision is made by evaluating the audit results and the relevant requirements.

Elements evaluated

Audit report.

Nonconformities.

Corrective action status.

ISMS scope.

Audit evidence.

Certification rules.

An important distinction

A positive assessment from the person who carried out the audit does not, on its own, mean that the certificate has definitely been issued.

The certification body's decision-making process must be completed.

Information that may appear on the certificate

Name of the organisation.

Certification standard.

Certification scope.

Certificate number.

Date of issue.

Validity information.

Certification body.

26. How Many Years Is an ISO 27001 Certificate Valid?

In accredited management system certification practice, the general certification cycle is three years.

Surveillance activities are carried out during this period.

At the end of the cycle, a recertification assessment is performed.

Example three-year cycle

Period	Activity
Year one	Initial certification
Year two	Surveillance audit
Year three	Surveillance audit
End of cycle	Recertification

The schedule is set according to the date of the initial certification decision and the relevant rules.

Key point

The certificate having a three-year cycle does not mean that no audits will be carried out for three years.

27. What Is an ISO 27001 Surveillance Audit?

A surveillance audit is carried out to assess whether a certified ISMS continues to meet the relevant requirements.

Topics that may be assessed in surveillance

Internal audit.

Management review.

Nonconformities.

Corrective actions.

Information security objectives.

Risk management.

Control implementation.

Significant changes.

Previous audit findings.

Example

The organisation may have moved to a new cloud infrastructure in the previous year.

In the surveillance audit, it may be examined whether this change has been reflected in the risk assessment and in control implementation.

28. Can the Certificate Be Revoked in a Surveillance Audit?

Within the certification body's relevant rules, decisions such as suspension or withdrawal of the certificate may arise.

Situations that may create risk

Significant nonconformities not being resolved.

Surveillance requirements not being met.

The management system seriously losing its effectiveness.

Breach of certification rules.

An important distinction

Not every nonconformity automatically results in the certificate being revoked.

Decisions are made according to the relevant certification and accreditation rules.

29. What Is ISO 27001 Recertification?

Recertification is the reassessment of the conformity and effectiveness of the ISMS at the end of the current certification cycle.

Assessment areas

Overall performance of the ISMS.

Risk management.

Control effectiveness.

Previous audit results.

Corrective actions.

Management system changes.

Continual improvement.

Key point

Recertification is not just changing the date on the old certificate.

The sustainability of the management system is assessed.

30. What Does the Cost of ISO 27001 Certification Depend On?

There is no single fixed price for ISO/IEC 27001 certification that applies to all organisations.

Factors affecting cost

Number of employees.

ISMS scope.

Number of locations.

Complexity of activities.

Information security risks.

Use of outsourcing.

Audit duration.

Certification body.

Surveillance audits.

Recertification.

Costs to be assessed separately

Consultancy.

Certification audit.

Technical security improvements.

Training.

Internal audit.

Technical security testing.

Key point

The audit quotation given by a certification body may not cover all of an organisation's information security improvement costs.

31. How Long Does ISO 27001 Certification Take?

There is no single timeframe for certification preparation that can be applied to all organisations.

Factors affecting the timeframe

Existing ISMS maturity.

Size of the organisation.

System complexity.

Risk assessment status.

Control gaps.

Documentation.

Internal audit readiness.

Corrective actions.

Example

An organisation whose existing security processes are mature may complete its preparation work in a shorter time.

However, an organisation with extensive technical gaps may well need longer.

Critical point

Instead of firm promises of obtaining a certificate in a short time, a realistic gap analysis and project plan should be produced.

32. Should an Internal Audit Be Carried Out Before Certification?

The ISO/IEC 27001 internal audit requirement is an important component of the ISMS.

For initial certification preparation, the internal audit programme is expected to have been implemented.

What is assessed in an internal audit

Management system requirements.

Risk management.

SoA.

Security controls.

Operational practices.

Performance measurement.

Improvement.

Key point

An internal audit does not replace the certification body's Stage 1 or Stage 2 audit.

The two processes serve different purposes.

33. Why Is Management Review Important in Certification?

Management review is top management's evaluation of the suitability, adequacy and effectiveness of the ISMS.

Example agenda

Information security performance.

Risk assessment results.

Risk treatment status.

Internal audit results.

Nonconformities.

Corrective actions.

Information security objectives.

Resource needs.

Opportunities for improvement.

Outputs

Management decisions.

Resource allocation.

Improvement activities.

ISMS change needs.

Critical point

A management review should not be merely an attendance sheet showing that a meeting took place.

The necessary inputs and decisions must be recorded.

34. Is ISO 27001 Certification the Same as KVKK (Turkish Personal Data Protection Law) Compliance?

No.

ISO/IEC 27001 defines the requirements for an information security management system.

KVKK, on the other hand, contains the legal obligations relating to the protection of personal data.

Common areas

Access control.

Data security.

Incident management.

Supplier security.

Authorisation.

Logging.

Different areas

Conditions for processing personal data.

Obligation to inform.

Data subject rights.

Data transfer conditions.

Data controller obligations.

Conclusion

An ISO 27001 certificate can support personal data security.

However, it is not automatic proof of full compliance with KVKK.

35. The Relationship Between ISO 27001 Certification and ISO 42001

ISO/IEC 42001 is the international standard for an artificial intelligence management system.

While ISO/IEC 27001 focuses on information security management, ISO/IEC 42001 addresses broader requirements relating to the management of artificial intelligence systems.

Areas that can be assessed together

Risk management.

Governance.

Policies.

Responsibilities.

Supplier management.

Monitoring.

Internal audit.

Continual improvement.

Key point

An ISO 27001 certificate does not automatically replace an ISO 42001 certificate.

Each standard has its own requirements and certification scope.

36. The Relationship Between ISO 27001 Certification and SOC Services

SOC services can support security monitoring and incident response processes.

SOC contributions

Central monitoring of logs.

Detection of suspicious activity.

Assessment of security events.

Support for incident response processes.

Use of threat intelligence.

An important distinction

ISO/IEC 27001 does not require all organisations to procure a 24/7 SOC service.

Monitoring requirements are determined according to the organisation's risks.

Example

In an organisation that carries out critical financial transactions, continuous security monitoring can be an important risk mitigation mechanism.

However, the appropriate monitoring model should be determined according to the organisation's activities.

37. Technical Checklist Before ISO 27001 Certification

Identity and access security

• Have privileged accounts been identified?
• Has MFA been considered for critical access?
• Are the accounts of departed employees being closed?
• Are access permissions being reviewed?

Network and system security

• Is the critical system inventory up to date?
• Are firewall rules being reviewed?
• Are security patches being managed?
• Have the risks for unsupported systems been addressed?

Data security

• Has sensitive data been classified?
• Has data access been restricted?
• Have backup processes been defined?
• Are restore tests being performed?

Monitoring and incident management

• Have critical log sources been identified?
• Are security events being recorded?
• Have incident response responsibilities been defined?
• Are incident notification processes in place?

Software and cloud security

• Have secure development requirements been considered?
• Are cloud accesses being controlled?
• Has access to source code been restricted?
• Are security tests planned according to risks?

This list is an example tool that supports certification preparation.

38. The 10 Most Common Mistakes in ISO 27001 Certification

1. Treating the certificate only as a commercial requirement

The ISMS needs to manage real security risks.

2. Using ready-made documents as they are

Policies must reflect the organisation's actual processes.

3. Turning risk analysis into a formality

Risk assessment should support decision-making.

4. Preparing the SoA independently of the actual controls

Control implementation statuses must be verified.

5. Neglecting the internal audit

The internal audit should assess the effectiveness of the management system.

6. Not involving top management in the process

Resources and management support are important.

7. Ignoring technical security weaknesses

Technical gaps related to risks should be assessed.

8. Closing nonconformities only on paper

Corrective actions must be implemented and their effectiveness assessed.

9. Not planning for surveillance audits

Certification is a sustainable process.

10. Not checking the scope of the certificate

It should be clear which activities the certificate covers.

39. A Sample 90-Day Preparation Plan for ISO 27001 Certification

Days 1–15: Scope and Gap Analysis

The ISMS scope is defined.

Existing practices are assessed.

Gaps are identified.

A project plan is created.

Days 16–30: Risk Management

The risk methodology is established.

The risk assessment is carried out.

The risk treatment plan is prepared.

The SoA is created.

Days 31–50: Control Implementation

Policies and procedures are developed.

Critical technical controls are implemented.

Access and asset management are assessed.

Days 51–65: Operational Records

Evidence of control implementation is collected.

Incident management and monitoring processes are assessed.

Performance measurements are prepared.

Days 66–75: Internal Audit

The internal audit is carried out.

Nonconformities are identified.

Corrective actions are planned.

Days 76–90: Management Review and Readiness

The management review is carried out.

The status of corrective actions is assessed.

Certification readiness is reviewed.

Important disclaimer

This plan is a sample preparation timeline.

It does not guarantee certification within 90 days.

The organisation's current state and the certification body's calendar affect the timeframe.

40. What Should Be Done After ISO 27001 Certification?

Certification does not mean that ISMS work comes to an end.

Ongoing activities

Updating risk assessments.

Monitoring control effectiveness.

Carrying out internal audits.

Management review.

Tracking information security objectives.

Managing nonconformities.

Staff awareness.

Supplier assessments.

Technical security improvements.

Example

If the organisation has started using a new artificial intelligence service, the impact of this change on information security risks should be assessed.

The necessary controls and the SoA may be updated.

41. Management Reporting for ISO 27001 Certification

Top management should be able to follow the status of the certification process through understandable indicators.

Example KPIs

Implementation status of ISMS requirements.

Number of critical risks.

Risk treatment completion rate.

Open nonconformities.

Status of corrective actions.

Internal audit results.

Control verification rate.

Certification readiness status.

Example management summary

“The risk assessments within the ISMS scope have been completed, the necessary controls have been identified and the SoA has been prepared. Owners have been assigned for critical technical gaps, and corrective actions have been initiated based on the internal audit results.”

This approach helps link certification work to management decisions.

42. Supplier Security for ISO 27001 Certification

Organisations need to assess information security risks in their supplier relationships.

Example suppliers

Cloud providers.

Data centre operators.

Software development firms.

Technical support providers.

SOC service providers.

Outsourced personnel.

Assessment areas

Service criticality level.

Types of data processed.

Access permissions.

Security obligations.

Incident notification processes.

Business continuity.

Service termination.

Key point

A supplier holding an ISO 27001 certificate can be a useful indicator.

However, it does not automatically replace the organisation's own supplier risk assessment.

43. The Role of Penetration Testing in ISO 27001 Certification

Penetration tests can support the assessment of technical security risks.

Test areas

Web applications.

APIs.

Internal network.

External network.

Active Directory.

Wireless network.

Cloud environments.

Mobile applications.

Example

A critical authorisation vulnerability was identified in a penetration test.

The finding is fed into the risk assessment.

The risk owner is determined.

Remediation is planned.

The necessary verification is performed.

Critical point

ISO/IEC 27001 does not specify a single fixed penetration testing frequency for all organisations.

Testing needs should be determined according to the risk assessment and applicable obligations.

44. Should You Use Consultancy When Preparing for ISO 27001 Certification?

Consultancy can be assessed according to the organisation's existing competences and resources.

Areas where consultancy support can contribute

Gap analysis.

ISMS scope.

Risk methodology.

Risk assessment.

SoA.

Control implementation.

Internal audit preparation.

Nonconformity management.

Certification planning.

An important distinction

A consultancy service and independent certification activity are different from each other.

The independence of the certification decision must be preserved.

A successful approach

The organisation's own staff should take an active part in ISMS processes.

Building a sustainable management system solely on documents prepared by an external consultant can be difficult.

45. SECURESYS ISO 27001 Certification Preparation and ISMS Consultancy

In its information security management system work, SECURESYS takes a risk-based approach grounded in technical verification.

ISMS current-state analysis

Existing processes are assessed against the requirements of ISO/IEC 27001:2022.

Risk management

Support is provided in establishing the risk assessment methodology, the risk register and risk treatment processes.

SoA preparation

The necessary information security controls are linked to risk treatment decisions.

Technical security assessment

Support can be provided in assessing security controls across systems, networks, applications and cloud environments.

Internal audit preparation

The audit scope, evidence, processes and gaps are assessed.

Nonconformity management

Support is provided in planning corrective actions and assessing their effectiveness.

Certification readiness

The organisation's readiness can be reviewed ahead of the Stage 1 and Stage 2 audits.

Continual improvement

After certification, support is provided in improving risk management and the effectiveness of security controls.

In the SECURESYS approach, ISO/IEC 27001 certification is addressed not merely with the goal of obtaining a certificate, but in order to manage corporate information security in a measurable, sustainable and risk-focused way.

Frequently Asked Questions (FAQ)

1. What is an ISO 27001 certificate?

It is a management system certificate showing that an organisation's Information Security Management System has been assessed against the requirements of ISO/IEC 27001 within a defined scope.

2. How do you obtain an ISO 27001 certificate?

The ISMS is established, risk management is implemented, the necessary controls are operated, an internal audit and management review are carried out, and the independent certification process is completed.

3. Is an ISO 27001 certificate mandatory?

It is not a general requirement for all organisations. However, there may be sectoral, regulatory or contractual requirements.

4. How many years is an ISO 27001 certificate valid?

In accredited management system certification, the general cycle is three years, during which surveillance audits are carried out.

5. What is TÜRKAK accreditation?

It is TÜRKAK's assessment of the competence of certification bodies in their relevant conformity assessment activities.

6. What is ISO 27001 Stage 1?

It is the first audit stage, in which certification readiness is assessed.

7. What is ISO 27001 Stage 2?

It is the second audit stage, in which the implementation and effectiveness of the ISMS are assessed.

8. How much does ISO 27001 certification cost?

The cost varies according to the number of employees, scope, locations, complexity, audit duration and certification body.

9. How long does it take to obtain an ISO 27001 certificate?

The timeframe depends on the organisation's existing security maturity, its gaps and the audit calendar.

10. Is an internal audit required for ISO 27001?

Yes. Internal audit is one of the ISO/IEC 27001 management system requirements.

11. Is management review mandatory?

Yes. It is required under clause 9.3 of ISO/IEC 27001:2022.

12. Is an SoA required for ISO 27001?

Yes. The SoA is an important output of the risk treatment process.

13. Must all 93 controls be implemented for ISO 27001?

It is not mandatory for every control to be implemented in the same way in every organisation. The necessity of controls is assessed in the risk treatment process.

14. Is penetration testing mandatory for ISO 27001?

There is no requirement for penetration testing of the same scope and frequency for all organisations. Testing needs are determined according to risks and the relevant obligations.

15. Does an ISO 27001 certificate ensure KVKK compliance?

It supports information security practices but does not automatically guarantee full compliance with KVKK.

16. Can a company with an ISO 27001 certificate be hacked?

Yes. Certification does not guarantee that no security incident will occur.

17. What is an ISO 27001 surveillance audit?

It is the audit in which it is assessed whether the certified ISMS continues to meet the requirements.

18. Does an ISO 27001 major nonconformity affect the certificate?

Yes. Major nonconformities can affect the certification decision and must be handled according to the relevant rules.

19. How do you check the authenticity of an ISO 27001 certificate?

The certification body's official verification system, the certificate scope and the relevant accreditation records should be examined.

20. What does ISO 27001 consultancy provide?

It provides support in ISMS establishment, risk management, the SoA, control implementation, internal audit and certification preparation processes.

Conclusion: How Do You Successfully Manage the ISO 27001 Certification Process?

ISO/IEC 27001 certification supports organisations in addressing information security through a systematic management model.

In a successful certification process, the ISMS scope must first be defined correctly.

Existing security practices must be assessed.

A risk management methodology must be established.

Risk treatment decisions and the necessary controls must be determined.

The SoA must reflect the actual implementation status.

An internal audit and a management review must be carried out.

Preparation for the Stage 1 and Stage 2 audits must be based on objective evidence.

Nonconformities must be managed effectively.

After certification, surveillance and continual improvement processes must be maintained.

The real value of ISO/IEC 27001 certification lies not only in obtaining the certificate, but in making information security risks manageable, controls verifiable and security processes sustainable.