Anthropic Says Seven China-Based AI Labs Ran Industrial-Scale Claude Distillation..
In its September 2026 threat intelligence report, published on...
Read more
DefensyLab»ISMS & ISO 27001 Certification
Governance, Risk & Compliance
ISMS & ISO 27001 Certification
Structure your Information Security Management System and durably prepare your organization for ISO/IEC 27001 certification.
Deploy a risk-based approach, robust security policies and relevant controls to reach maturity and demonstrate your compliance.
What is ISO 27001 certification?
ISO/IEC 27001 is the international reference standard for establishing an Information Security Management System. It enables your organization to identify and address its risks, control and secure its data, comply with regulatory requirements, and strengthen the trust of your customers, partners and stakeholders.
93controls
Annex A of ISO/IEC 27001:2022 lists 93 security controls.
4themes
Organizational • People • Physical • Technological
3years
Typical certification validity period, with annual surveillance.
Our methodology
Our path to ISO 27001 certification
Initial assessment
& scoping
Analysis of the current state, scope definition and identification of gaps against ISO/IEC 27001 requirements.
ISMS design
Risk analysis, definition of information security policies and procedures, governance and Statement of Applicability (SoA).
ISMS implementation
Deployment of security measures, formalization of processes and support for teams as they put them into practice.
Certification
support
Internal audit, management review, mock audit and support through to the certification audit by an accredited body.
Our methodology
Your project phases
- 01
Gap analysis
Assessment of your compliance level against the ISO 27001 standard.
- 02
Risk analysis and treatment
Identification, evaluation and prioritization of information security risks.
- 03
Information security policies and procedures
Definition and documentation of the rules, processes and controls needed to manage security.
- 04
Statement of Applicability (SoA)
Selection and justification of the applicable controls based on the organization’s risks and context.
- 05
Implementation of applicable controls
Operational deployment of controls and awareness-raising for stakeholders.
- 06
Internal audit
Verification of ISMS compliance and identification of improvement areas.
- 07
Management review
Analysis of results, decision-making and validation of ISMS effectiveness.
- 08
Certification audit preparation
Documentation preparation, final review and support through to the certification body’s audit.
FAQ
Frequently asked questions
How long does it take to obtain ISO 27001 certification?
The duration depends on the scope, the initial maturity of the ISMS, the gaps identified and team availability. An initial assessment helps establish a realistic roadmap and prioritize the actions needed before the certification audit. ISO/IEC 27001 applies to any type of organization and is based on a structured risk management approach.
Do I need to implement all 93 controls from Annex A?
No. The 93 controls in Annex A serve as a reference to verify that no necessary control has been overlooked. The organization determines which controls are actually applicable based on its risks and justifies its choices in the Statement of Applicability (SoA).
What are the benefits of ISO 27001 certification?
It helps durably structure information security governance, better manage risks, strengthen the trust of customers and partners, and demonstrate the existence of a management system compliant with a recognized international standard.
What is the difference between ISO 27001 and HDS certification?
ISO/IEC 27001 is an international information security management standard applicable to all sectors. HDS is a scheme specific to health data hosting in France; its framework is based notably on ISO 27001 and adds requirements specific to health data.
Do I need to redo the audit every year?
Certification does not require redoing the full initial audit every year. It is generally part of a certification cycle with periodic surveillance audits, followed by a renewal audit at the end of the cycle. However, the ISMS must be continuously managed and improved between audits.
Can ISO 27001 help me comply with other frameworks?
Yes. ISO/IEC 27001 provides a solid foundation of governance, risk management and security controls. It can facilitate alignment with other regulatory or sector-specific requirements, but does not replace the specific obligations of each framework.
Discover your level of readiness for ISO 27001
Receive a personalized analysis of your organization and concrete recommendations to progress.
Our cybersecurity news and analysis
News & Insights
Discover our latest analyses, news and expertise in cybersecurity.
