ISO certification, explained clearly

Practical guidance for teams building an audit-ready ISMS and navigating ISO 27001, NIS2, GDPR, and information security expectations.

Readiness preview Indicative

Scope80%

Risk analysis60%

Evidence42%

Audit readiness28%

Where do you want clarity?

Pick your route — primary topics for certification and regulation; compact links for hosting, supply chain, and the scan.

From scope to certification audit: a practical route to a workable ISMS that auditors can follow.

Governance, supply chain, and incident notification: what NIS2 means for your organisation and vendors.

Align privacy, data flows, and processors with your security narrative and audit evidence.

Policy, roles, risks, and evidence: the building blocks every certification audit expects.

A clear path: less noise, more evidence — aligned with how auditors assess an ISMS.

1
Understand the requirements
Translate the standard, laws, and contract clauses into concrete obligations for your scope.
2
Define scope and risks
Document scope, stakeholders, and risk treatment as the backbone of your ISMS and SoA.
3
Implement policy and controls
Connect policy to roles, processes, and controls — workable in the line, not only on paper.
4
Collect documentation and evidence
Traceable decisions, registers, and examples that match how you actually operate.
5
Prepare for the audit
Sampling, storyline, and evidence pack: show the ISMS runs and improves (PDCA).

What is it, when does it matter, and where do you start?

ISO 27001

What is it?: A certifiable information security management system (ISMS) aligned with the international standard.
When is it relevant?: When you need demonstrable control over confidentiality, integrity, and availability — often required by customers and contracts.
Where do you start?: Start with context and scope, then risk assessment and Annex A control selection.

NIS2

What is it?: EU legislation focused on cyber risk, governance, and the supply chain.
When is it relevant?: Relevant for essential/important entities and frequently for vendors bound by contractual chain requirements.
Where do you start?: Confirm applicability, roles (e.g. CISO/accountable executive), and a proportionate control set with evidence.

GDPR

What is it?: The EU GDPR: rules for personal data processing and data subject rights.
When is it relevant?: Always relevant when you process personal data; often combined with ISO 27001 for security and privacy.
Where do you start?: Document processing activities and retention; map processors and DPIAs to your risks.

ISMS

What is it?: The information security management system: policy, processes, roles, and evidence.
When is it relevant?: When you must show the “system” works — not only isolated documents or tools.
Where do you start?: Move from context and stakeholders to risks, objectives, and a controlled control baseline (e.g. Statement of Applicability).