ISO/IEC 27001 sets out the requirements to establish, implement, maintain and continually improve an information security management system (ISMS). It is not an IT checklist: it covers people, processes and technology across the whole scope you define, and it puts risk at the centre of every decision.
Certification is voluntary, but it has become a common requirement in tenders, enterprise sales and supplier assessments. ISO does not certify organisations, and neither do we: certificates are issued by independent certification bodies, ideally accredited by a national body such as ENAC in Spain or UKAS in the United Kingdom. Our role is to get you there with a system that works day to day.
Who it applies to
Any organisation, any size
The standard is sector-neutral: from start-ups to public bodies, anyone handling information they need to protect can adopt it.
Technology and SaaS companies
Enterprise customers increasingly expect a certificate before sharing data or signing a contract.
Suppliers under regulatory pressure
Clients bound by NIS2 or DORA need assurance from their providers, and a certified ISMS is a widely recognised answer.
Organisations juggling several frameworks
An ISMS gives a single backbone for ENS, NIS2, DORA or GDPR evidence instead of parallel projects.
Key requirements
Context and scope
Understand internal and external issues and interested parties, and define the ISMS scope precisely. Since Amendment 1:2024, this includes considering whether climate change is a relevant issue.
Leadership and policy
Top management must commit to the ISMS, approve an information security policy and assign roles, responsibilities and resources.
Risk assessment and treatment
A repeatable method to identify, analyse and evaluate risks, and a treatment plan whose residual risks are accepted by the risk owners.
Statement of Applicability
Annex A lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. You justify which ones apply and why.
Performance evaluation
Monitoring and measurement, a planned internal audit programme and regular management reviews.
Continual improvement
Nonconformities are corrected, their root causes addressed and the system improved over time.
How we help
Gap analysis and scope
We review your current practices against the standard and help you define a scope that is meaningful for customers and realistic to run.
Plan and risk method
Risk methodology, asset and risk inventory, treatment plan and a draft Statement of Applicability, with a realistic timeline.
Implementation
Policies and procedures, awareness training and the technical controls behind them: identity and access, logging and monitoring, vulnerability management, backups and secure development.
Internal audit and certification readiness
An internal audit and management review before the external audit, support during stage 1 and stage 2 with the certification body you choose, and help with the annual surveillance audits.
Signs you need to act
- A tender or enterprise customer requires an ISO 27001 certificate.
- Your team spends weeks answering security questionnaires one by one.
- Your ISMS exists on paper, but nobody runs the risk reviews or internal audits.
- Your processes were designed for the 2013 edition and have not been revisited.
- You face NIS2, DORA or the ENS and want one framework to organise the evidence.
Frequently asked questions
How long does ISO 27001 implementation take?
It depends on scope, size and starting maturity. After the gap analysis we give you a realistic timeline, including the time the ISMS needs to run and generate evidence before the audit.
Does ZERYON issue the certificate?
No. Certificates are issued by independent certification bodies, preferably accredited ones. We prepare your organisation and accompany you through the process.
Do we have to implement all 93 Annex A controls?
No. You select controls based on your risk assessment and justify every inclusion and exclusion in the Statement of Applicability.
How long is the certificate valid?
Accredited certification usually runs on a three-year cycle, with surveillance audits in the intervening years and a recertification audit at the end.
What changed in the 2022 edition?
Annex A was restructured from 114 controls to 93 in four themes, with new controls such as threat intelligence, cloud services security, data masking and secure coding. The transition period for 2013 certificates ended on 31 October 2025.
Does ISO 27001 make us compliant with NIS2 or the ENS?
Not automatically. It shares much of their logic and speeds up both, but each has specific requirements: reporting deadlines and management duties in NIS2, system categorisation and the CCN-STIC guides in the ENS.