ISO 27001 certification: ISMS certification according to ISO/IEC 27001

The main normative part of ISO 27001 is relevant to certification and includes the following chapters and requirements:

• Context of the organization: defining the specific scope of the ISMS; conducting a requirements and environment analysis.
• Leadership and commitment: Requirements for the responsibility of the organization's management; roles, responsibilities & authorities in the organization; company policy.
• Planning: Measures for dealing with risks & opportunities; defining information security objectives and planning how these can be achieved.
• Support: Requirements to ensure ISMS effectiveness (resources, competencies, security awareness, communication, documented information)
• Operation: Operational planning & control; Regular risk assessment & handling.
• Evaluation of performance: Monitoring, measurement, analysis & evaluation of measures and achievement of objectives; Internal audits; Management review.
• Improvement: Non-compliance & corrective actions; Continuous improvement of the ISMS.

In addition, the controls from normative Annex 1 must be observed and implemented.

As the basic prerequisite for ISO 27001 certification is the implementation of an ISMS, this is preceded by many preparatory activities on the customer side..

These include, among other things: 

• Determination of the specific area of application (scope)
• Define an Information Security Policy & Information Security Objectives 
• Develop measures to address risks & opportunities
• Develop a risk assessment & risk management methodology
• Develop a Statement of Applicability
• Define roles, responsibilities & authorities within the organization
• Create of a list of assets

The central requirement of the standard and therefore the basic prerequisite for certification in accordance with ISO 27001 is the successful implementation of an ISMS. In addition, organizations should have an effective risk management system in place that addresses the assessment and management of existing and potential security risks (risk analysis strategy).

ISO 27001 and the GDPR overlap in many areas. For example, both address the goal of ensuring the confidentiality, availability and integrity of data or pursue a risk-based approach. However, the GDPR has a broader scope, which means that while an ISO 27001 certification can simplify GDPR compliance, it cannot cover it completely. 

The time it takes to achieve ISO 27001 certification depends on a number of factors, such as the size of your organization (number of sites and employees), the complexity of your processes and your internal capabilities. It is therefore not possible to give a general answer to this question. However, one thing is certain: the larger and more complex your organization, the longer it will take to achieve ISO 27001 certification.
Please contact us for a more detailed assessment.

The ISO 27001 certificate is valid for a maximum of 3 years.

A surveillance audit is carried out in the first and second year after successful ISO 27001 certification.

After 3 years, a recertification audit is carried out to check that the requirements for renewal are still met. 

The costs for ISO 27001 certification vary depending on the size and situation of the company. The decisive factor here is the number of days required for the two certification audits. While smaller and medium-sized companies generally require fewer days, larger companies and groups should plan more time and budget accordingly.

We would be happy to provide you with an individual offer. 

An ISO 27001 certification does not automatically cover the entire scope relevant for the evidence according to §8a BSIG. Therefore, an ISO 27001 certificate can be used as part of a certificate, but not as a certificate itself. The prerequisite for this is that the scope of the certificate fully covers the critical infrastructure or critical service.

In general, the following general conditions must be met: 

• Scope: The scope must include the facilities operated in accordance with the BSI Critical Infrastructure Ordinance.
• Extended scope: Extension of the scope to include outsourced areas & implementation of a comprehensive security assessment from a KRITIS perspective. 
• Consideration of KRITIS protection goals: Appropriate definition of KRITIS protection objectives to be included in the risk assessment and to be considered consistently in all processes and implementation of measures. 
• KRITIS IT protection requirements: Assessment of the protection objectives of availability, confidentiality, integrity and authenticity in relation to the maintenance of the critical service (risk management).
• Risk management: In particular, the level of a risk to the general public, i.e. the impact on the functionality of the critical infrastructure and the critical service, must be taken into account. Appropriateness must be considered in the selection of measures. 
• Implementation of measures: In principle, all measures required to maintain the critical service must be implemented. All measures that are only being planned – for example in the continuous improvement process, in the implementation plan or in the risk treatment plan – must be included in the list of security deficiencies according to § 8a (3) BSIG.