What is ISO 27001?
ISO/IEC 27001 is the leading international standard for information security management, providing a systematic approach to managing sensitive company and customer information through an ISMS.
Benefits of Certification
- ✔Protect confidential and personal data
- ✔Win contracts requiring security assurance
- ✔Reduce risk of breaches and financial loss
- ✔Demonstrate compliance with GDPR and UK data law
- ✔Build customer and partner trust
Scope
For any organisation that stores, processes or transmits information and wishes to manage information security risks systematically.
Who it applies to
- ●IT & software / SaaS
- ●BPO & shared services
- ●Financial & professional services
- ●Telecommunications
- ●Healthcare & data processors
- ●E-commerce & cloud providers
What the scope covers
- ▸Information security risk assessment and treatment
- ▸Access control and cryptography
- ▸Asset, supplier and cloud security
- ▸Incident management and business continuity
- ▸Physical and operational security
- ▸Statement of Applicability (Annex A controls)
Key Requirements
- ▸Information security policy and risk assessment
- ▸Statement of Applicability (SoA)
- ▸Annex A controls implementation
- ▸Access control and cryptography
- ▸Incident management and business continuity
- ▸Internal audit and management review
Certification Process
- 1
Application & Quotation
Submit your details and receive a tailored, fixed-price quotation based on scope, sites and headcount.
- 2
Gap Analysis (Optional)
An optional pre-audit review identifies gaps between your current practices and the standard.
- 3
Stage 1 Audit
Documentation review to confirm your management system is designed and ready for assessment.
- 4
Stage 2 Audit
On-site (or remote) assessment of the implementation and effectiveness of your system.
- 5
Certification Decision
An independent technical review leads to the certification decision and issue of your certificate.
- 6
Surveillance & Renewal
Annual surveillance audits maintain your certification over the three-year cycle before recertification.
Documents Required
- 📄Company registration / incorporation details
- 📄Organisation chart and list of sites
- 📄Scope statement of activities
- 📄Management system manual / documented information
- 📄Key policies and procedures relevant to the standard
- 📄Records demonstrating implementation (audits, reviews, training)
Frequently Asked Questions
How long does ISO 27001 certification take?
Typical timelines range from 4 to 12 weeks depending on the size of your organisation, the number of sites and how mature your existing management system is.
How long is a ISO 27001 certificate valid?
Certificates are issued for a three-year cycle, subject to successful annual surveillance audits, after which recertification renews the cycle.
Can the audit be conducted remotely?
Yes. Where appropriate, UKCTL can conduct Stage 1 and parts of Stage 2 remotely, combined with on-site verification as required.
Is ISO 27001 certification accredited?
UKCTL issues accredited certificates recognised internationally, giving your customers and stakeholders confidence in the assessment.
Get ISO 27001 certified with UKCTL
Apply Now