DO: Implement and operate your ISMS. Key actions include creating the mandatory Statement of Applicability (SoA)to justify selected controls and deploying risk treatment plans.

CHECK: Monitor and review the ISMS through internal audits, management reviews, and performance evaluations

.ACT: Maintain and improve the ISMS by implementing corrective actions and addressing root causes.

This framework establishes a continual improvement loop, systematically protecting data assets, ensuring compliance, and building trust with clients.

Identify information security risks and legal requirements.
Establish the ISMS scope and security objectives.
Develop the Statement of Applicability (SoA) and risk treatment plan.
Implement security controls and operational procedures.
Monitor security performance and incidents.
Analyse audit results and investigate non-conformities.
Implement corrective and preventive actions.
Review ISMS performance and effectiveness regularly.
Drive continual improvement in the security management system.

Core Information Technology Management Principles:

Data and stakeholder focus, fulfilling security obligations. ISO 27001 shifts attention to protecting information assets and meeting legal, contractual, and regulatory duties for data security and privacy.

Leadership commitment to a security culture. Top management must actively define policy, allocate resources, and promote an organisation-wide culture of information security to protect business operations.

ISMS process approach and risk-based thinking.

The core of ISO 27001 is a systematic process for managing information security,

centred on a formal risk assessment to identify and address

threats to confidentiality, integrity, and availability (CIA).

Evidence-based security decision making. Decisions are driven by the risk assessment,

audit findings, and performance metrics, not conjecture.

The Statement of Applicability (SoA) is the key evidence document that justifies

Which security controls are applied based on assessed risks?

I'd like you to please consult with relevant stakeholders. Adequate security requires input from across the organisation—business units, IT, legal, HR—to ensure controls are practical and comprehensive.
Continual improvement of the ISMS. The standard embeds the PDCA cycle to systematically review, audit, and enhance the Information Security Management System, adapting to new threats and business changes

The Main ISO 27001 Clauses - Complete Breakdown:

Clause 4: Context of the Organisation.

This clause requires you to look outward and inward. First, you must identify internal and external issues relevant to your information security goals (e.g., the regulatory landscape, organisational culture). Second, you must define the needs and expectations of interested parties(e.g., customers, regulators, employees). Finally, you must use this analysis to determine the scope and boundaries of your ISMS: what parts of the organisation, locations, and information assets it covers. The key output here is a documented scope statement. This foundational work ensures your ISMS is aligned with your strategic direction and addresses real-world constraints and stakeholder requirements, providing a realistic basis for the entire system.

Clause 5: Leadership

Leadership moves from understanding context to active commitment. Top management must demonstrate leadership and commitment by integrating the ISMS into business processes and ensuring resources are available. Critically, they must establish a clear information security policy that provides a framework for setting objectives. Furthermore, leadership is responsible for defining and communicating organisational roles, responsibilities, and authorities related to the ISMS. This clause ensures information security is driven from the top, fostering a culture where security is seen as a business enabler, not just an IT issue. Management's active involvement is crucial for the ISMS's legitimacy and effectiveness.

Clause 6: Planning

Clause 6 translates leadership's policy into actionable plans. It mandates a systematic process to address risks and opportunities that could impact the ISMS. The core activity is information security risk assessment: you must define a risk methodology, identify risks to your information assets, analyse, and evaluate them. Based on this assessment, you must formulate a risk treatment plan to modify risks to an acceptable level.

This plan directly informs the selection of controls, documented in the Statement of Applicability (SoA).

Finally, you must set measurable information security objectives and plan how to achieve them. This clause is the strategic "Plan" phase of the PDCA cycle.

Clause 7: Support

Support is about resourcing and enabling the ISMS. The organisation must determine and provide the necessary resources (people, infrastructure, funding). It must ensure personnel are competent through education, training, or experience, and it must promote awareness of

the security policy and their role. Effective communication plans, both internal and external, must be established. Crucially, all documentation required by the standard and for effective operation must be created and controlled.

This includes the SoA, risk treatment plan, procedures, and records. This clause builds the foundation for successful implementation in the next stage.

Clause 8: Operation

This is the "Do" phase. Clause 8 requires you to execute the plans from Clause 6. You must carry out the risk assessment and treatment processes as planned. This involves implementing the risk treatment plan and the controls specified in your SoA. You must also establish controls to manage outsourced processes and ensure security is maintained. The operation must be planned and controlled, and changes must be handled. The output is the active, functioning set of security controls protecting your information. This clause turns policy and planning into a concrete, operational reality.

Clause 9: Performance Evaluation

Clause 9 is the "Check" phase. You must monitor, measure, analyse, and evaluate the performance of your ISMS. This involves deciding what to monitor and how, such as tracking the effectiveness of controls or the number of security incidents.

You'll need to conduct internal audits at planned intervals to make sure you follow your own requirements and ISO 27001. At least once a year, top management must review the ISMS to ensure its continuing suitability, adequacy, and effectiveness. This evaluation provides the evidence needed to make informed decisions about necessary improvements.

Clause 10: Improvement

The final clause closes the PDCA loop with the "Act" phase. Its purpose is continual improvement. When nonconformities occur (e.g., from audits or incidents), you must react by taking action to control, correct, and deal with the consequences. More importantly, you must determine the root cause and implement any necessary corrective action to prevent recurrence. You should also take preventive actions to address potential nonconformities. Ultimately, the organisation must continually seek to improve the suitability, adequacy, and effectiveness of the ISMS. This clause ensures the ISMS adapts and grows stronger over time.

S o A

ISO 27001 Frequently Asked Questions.

What is ISO/IEC 27001:2022?

ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS). It provides a systematic framework for managing sensitive company information, ensuring its confidentiality, integrity, and availability. The 2022 update consolidated controls from 114 to 93, organised them into 4 themes (organisational, people, physical, technological), and added 11 new controls related to modern threats like cloud security, threat intelligence, and data leakage prevention.

Is ISO 27001 mandatory in the UK?

No, it is not generally mandatory by law. However, it can become a factored-in requirement in certain situations:

Public Sector Contracts: Many government contracts (especially involving sensitive data) require it.
Industry Requirements: Highly regulated sectors (finance, healthcare) may demand it.
Client Demand: An increasing number of large corporations, especially in tech and professional services, require their suppliers to be certified.
However, being registered via a non-UKAS company also shows that you are following rules at a significantly reduced cost.

How does ISO 27001 relate to UK GDPR?

They are highly complementary. UK GDPR is the legal framework for data protection. ISO 27001 provides the operational system to achieve and demonstrate compliance with key GDPR principles, such as security and accountability. Implementing an ISMS helps you identify risks to personal data, implement appropriate controls, and maintain records—all of which support GDPR compliance and can reduce regulatory risk.

How long does ISO 27001 certification take and cost in the UK in 2026?

Timeline: For a typical mid-sized organisation, the process usually takes9-18 months from project start to certification. This depends heavily on existing processes, resources, and scope.
Cost in 2026:Costs are subject to inflation and market rates. Expect a ballpark range:
- Consultancy (optional):£5,000 - £30,000+.
- Certification Audit Fees: £ 2,500 - £15,000+ per year, depending on organisation size and complexity.
- Internal Costs (staff time, tools): Significant but variable.

Do we need a UKAS-accredited certification body?

NO, it is strongly recommended. The United Kingdom Accreditation Service (UKAS) is the national accreditation body. A certificate from a UKAS-accredited certification is widely recognised and trusted proof of accreditation.

However, non-accredited certificates can also be obtained at a vastly cheaper cost to the company.

What is the Statement of Applicability (SoA)?

The SoA is the most critical document in your ISMS. It is a formal document that:

Lists all 93 Annex A controls.
States which are applicable and which are excluded.
Justifies exclusions.
Describes how each applicable control is implemented.
It is the primary document that auditors review to understand your control landscape.

What are the most common reasons UK organisations fail ISO 27001 audits?

Incomplete or poor SoA: Missing justifications, incorrect scoping.
Lack of evidence: Policies exist but are not followed (e.g., no records of reviews, training, or incidents).
Weak risk assessment: Not identifying key risks or not linking controls to risks.
Management disengagement: Leadership not involved in reviews or setting objectives.
Incorrect scope: Leaving out critical information assets to simplify the process.
Poor internal audit: Not conducting effective internal audits or failing to act on findings.

What documents are required for ISO 27001:2022?

The standard mandates documented information. Key required documents include:

ISMS Scope.
Information Security Policy & Objectives.
Risk Assessment & Treatment Process.
Statement of Applicability (SoA).
Risk Treatment Plan.
Records of training, audits, management reviews, incidents, and corrective actions.

How often are ISO 27001 audits carried out?

Surveillance Audits: Annual (after the initial certification) by your certification body to check ongoing compliance.
Recertification Audit: Every three years for full re-certification.
Internal Audits: You must conduct your own internal audits at planned intervals (typically annually).

Can small businesses get ISO 27001 in the UK?

Absolutely. The standard is scalable. Many small UK businesses achieve certification,

Often, it is necessary to meet client requirements or to gain a competitive edge.

The scope should be appropriate to the size and complexity of the business.

Does ISO 27001 cover cybersecurity only?

No. It covers information security broadly, which includes:

Cybersecurity(digital/data security).
Physical Security(locks, access badges).
People Security(training, NDAs).
Legal & Compliance aspects.
It’s a holistic business management standard, not just an IT standard.

Is ISO 27001 worth it for UK organisations?

For most organisations handling sensitive data (client, financial, IP) or seeking

competitive tenders, Key benefits:

Winning Business: Essential for many public/private sector contracts.
Reducing Risk: Systematically protects against data breaches and cyber-attacks.
GDPR Compliance: Provides a framework for meeting data protection obligations.
Reputation & Trust: Demonstrates a serious commitment to security to stakeholders.
Cost Savings: Can reduce insurance premiums and potential breach costs.

The investment should be weighed against your specific business drivers, regulatory environment, and client expectations.

More infromation can be found at https://compassrose.one/common-iso-standards-compliance/new-iso27001-2022

S o A