Virtual CISO · ISO 27001
ISO 27001 certification, and an ISMS still running a year later
Most certification projects end the week the certificate arrives. The consultant leaves, the risk reviews stop, and the first surveillance audit finds a management system nobody has operated for ten months. We build it with you, and then we are the people who keep running it — same team, same fixed monthly fee, same portal.
ISO 27001 asks two questions, and most projects only answer one
Clauses 4 to 10 are the management system itself: who owns security, what you decided to protect and why, how competence is maintained, how performance is measured, what happens when something is found. Annex A is the other half — 93 controls, each one either applied or formally left out with a reason.
They fail in completely different ways. A missing control is a finding you can close in a fortnight. A management system that exists on paper but has never actually run is a finding you cannot close at all before the auditor writes it up, which is why the two are scored separately in your portal rather than blended into one reassuring percentage.
Scope is the one choice here you cannot quietly revise later
Scope says which legal entities, which sites and which services the management system covers. It is printed on the certificate, so it is the line your customers read before anything else. Too narrow and the certificate does not cover the thing they were asking about; too wide and you spend a year evidencing controls in places nobody ever required them.
Out of that decision comes the Statement of Applicability: all 93 Annex A controls, whether each one applies to you, and why. Auditors read the exclusions first, and an exclusion with no reasoning behind it is the shortest route to a nonconformity there is — so the reasoning is written at the time the decision is made, not reconstructed in the week before Stage 1.
- The entities, sites and services the certificate will name
- The interfaces and dependencies at the edge of that boundary, outsourced ones included
- A Statement of Applicability covering all 93 controls, applied or not
- A written justification for every control left out, which is what gets sampled
Policies written for your organization, and the work that makes them true
ISO asks for documented information, which in practice means a management-system manual covering clauses 4 to 10 and a policy set covering the controls you said apply. Both are drafted against your actual profile — your size, your sites, your systems, your suppliers — and then argued through with the people who will have to live under them.
A policy on its own proves nothing, and an auditor knows it. Each one in the portal carries the tasks that implement it and its own completion figure, so “we have an access control policy” and “access control is actually in place” stop being the same sentence. Where the figure is low, that is the agenda rather than an embarrassment.
- A management-system manual for clauses 4 to 10, written against your organization
- A policy per domain, covering the controls your Statement of Applicability includes
- Each policy scored, with its implementing tasks and their progress underneath it
- Approval dates and version history, which is what clause 7.5 is actually asking for
An auditor can tell a live risk register from one built for the audit
ISO wants a repeatable method, an owner named for each risk, and a treatment decision somebody with the authority to take it actually took. What it does not accept is a register assembled the month before the audit, agreed by nobody, and never opened again afterwards.
Yours is the register the vCISO works from all year: inherent and residual scoring, the treatment plan, the review dates that have already passed and the ones coming, and any acceptance signed by name with an expiry on it. It stays current because the program runs on it, which is a different reason from an audit being due.
The internal audit is the one part nobody can do for themselves
Clause 9.2 requires auditors to be objective and impartial, which in plain language means nobody audits their own work. If the same person wrote the policy, closed the task and then signs off that the control is effective, the internal audit proves nothing — and the external auditor will ask how impartiality was ensured, so it is agreed and written down at the start.
- 01
The internal audit
Planned in the first weeks rather than improvised in month ten, and run by a Spirity colleague from outside your engagement — so the person auditing a control is never the person who wrote the policy or closed the task behind it. The program covers the whole management system across the cycle, not the half that is easy to evidence.
- 02
The management review
A minuted meeting of your management against the agenda ISO prescribes: performance, findings, risk, resources, and what changes as a result. We prepare it and we sit in it. The decisions are yours and the minutes carry your names, which is the entire point of the clause.
- 03
Corrective action
Every nonconformity gets a root cause rather than a patch, an owner and a date, in the same task list as everything else. A finding raised in February cannot quietly go missing by October, because it is in the list the monthly report is drawn from.
Two stages, run by a body that has to be independent of us
You are certified by an accredited certification body — not by your consultant, and not by us. That separation is exactly what makes the certificate worth showing to a customer. We prepare you for the audit, we sit with you through it, and we answer for the parts we built.
- 01
Stage 1 — the documentation
The auditor reads the scope, the Statement of Applicability, the risk assessment and the policy set, and decides whether there is a management system here to audit at all. Gaps found at this point are cheap to close. The same gaps found at Stage 2 are not.
- 02
Stage 2 — the evidence
Weeks later, in your systems and with your people: do the controls operate, can you show that they did, and do the records go back far enough to prove it. This is the stage where a management system that was written rather than run comes apart.
- 03
The findings
A major nonconformity has to be closed before any certificate is issued. A minor one travels with you to the next visit on an agreed plan, and an observation is advice. Knowing which of the three you are looking at before the closing meeting is most of what preparation buys.
- 04
The certificate
Issued by the body, valid for three years, naming the scope agreed at the start. Check that it carries an accreditation mark — an unaccredited certificate is a PDF, and procurement teams have learned to look for the difference.
Seven months is a normal answer, and it is not a promise
For a few hundred people starting with no formal management system, Stage 1 at around month six and Stage 2 a month after it is a realistic shape, and it is the one we plan against. What moves that date is mostly not us: how quickly decisions get made on your side, whether the evidence for a control already exists or has to be created from nothing, and how long your chosen certification body is booked out for.
If we think the date you have in mind is wrong, you will hear it in the first month rather than six weeks before an audit. And if a customer contract has already named a date, say so at the start — it changes the order we do things in, which is a conversation worth having early and a bad surprise late.
Year two is where most certified management systems quietly stop
The certificate runs for three years: a surveillance audit in each of the first two, a full recertification in the third. The organizations that struggle at that second visit are rarely the ones that built badly. They are the ones whose consultant left in month eight, and where nobody inherited the risk reviews, the internal audit program or the management review.
There is no handover here because there is nobody to hand over to. The team that built the management system is the team that operates it, on the same monthly fee, and a surveillance audit becomes a visit rather than a project to be resourced all over again.
- Risk reviews on their due dates, with the register current between audits
- An internal audit program that keeps running through the three-year cycle
- The management review held and minuted, not reconstructed before the visit
- Policies reviewed on their own cycle, with the approval dates to show it
- Evidence collected as the work happens, rather than gathered in a panic
One set of work, counted against both
Most of what ISO 27001 asks for is what NIS2 asks for, in different words and a different order. Run as two projects, that becomes two gap analyses, two document sets, and the same people answering the same questions twice for two sets of consultants who do not talk to each other.
Here it is the same task list, scored against each framework separately, so the certification program moves your NIS2 position as it goes and the overlap is something you can see rather than something you are told about. The parts that genuinely do not overlap — registration, reporting deadlines, management training — are obligations no certificate discharges, and they sit in the same list too.
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
No, and we are not allowed to. The certificate comes from an accredited certification body, and accreditation rules keep that body separate from anyone who built or operates the management system being audited. That separation is not red tape — it is the entire reason the certificate means something to the customer who asked you for it. What we do is build the system with you, prepare you for both stages, sit with you through the audit, and answer for the parts we built. The certification decision is the certification body’s, based on the audit results.
For a few hundred people starting without a formal management system, planning for Stage 1 around month six and Stage 2 a month later is realistic. Three things move that date and only one of them is us. How quickly decisions get made on your side: scope, risk tolerance and policy approvals are yours to sign. Whether the evidence for a control already exists or has to be created from nothing, which is usually the single biggest variable. And how far ahead your chosen certification body is booked, which in a busy year is months rather than weeks. If we think your target date is wrong, you will hear it in the first month.
Yes, but never with the people who built the thing being audited. Clause 9.2 requires auditors to be objective and impartial, and nobody auditing their own work satisfies that — so your internal audit is run by a Spirity colleague from outside your engagement, who had no hand in writing the policies or closing the tasks they are looking at. It is scoped and staffed at the start of the program rather than arranged late, and the separation is written down, because the external auditor will ask how impartiality was ensured and “we were careful” is not an answer to that question.
Not here, because it is one task list scored against both — the certification program moves your NIS2 position as it goes, and you can see exactly where the two overlap instead of being told that they do. What is worth being clear about is the part that does not overlap in either direction. A certificate does not discharge a legal duty: registration, incident reporting deadlines and management training are obligations in their own right, and an auditor will not do them for you. And NIS2 compliance is not a certificate, so it will not satisfy the customer whose procurement form asks for one.
Where to go next
Framework mapping
One control answered once, and counted against every framework that asks for it.
The assessment
Two weeks, your answers and our review, scored against the frameworks you are held to.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.