ISO 27001:2022 Implementation Roadmap

Short answer: Implementing ISO/IEC 27001:2022 follows six phases: scope definition and context, gap assessment, risk assessment and treatment, ISMS documentation and control implementation, internal audit and management review, and certification audit. For a medium-sized organisation starting from scratch, the full cycle typically takes 9–18 months.

TL;DR: ISO 27001:2022 certification is achievable with a structured approach. The standard requires you to understand your context, assess your risks, implement proportionate controls, document everything, and prove it works — not just once, but as an ongoing management system. As of 2024, there were 96,709 valid ISO 27001 certificates worldwide, making it the most widely adopted information security standard (ISO Survey 2024).

Key Takeaways - ISO 27001:2022 has 93 controls in Annex A (down from 114 in the 2013 version), reorganised into four themes and 11 new controls added. - The transition deadline from ISO 27001:2013 was 31 October 2025 — organisations still on the old standard need to recertify under 2022 immediately. - Certification requires passing both a Stage 1 (documentation review) and Stage 2 (implementation audit) by an accredited certification body. - The ISMS must be maintained year-round — surveillance audits occur annually; full recertification every three years. - Hands-on training in ISMS implementation significantly reduces the time and cost of reaching certification readiness.

On this page

• Why implement ISO 27001:2022?
• What changed in ISO 27001:2022
• The six-phase implementation roadmap
• Timeline summary
• Common implementation pitfalls
• Frequently asked questions

Why implement ISO 27001:2022?

ISO/IEC 27001 is the international standard for information security management systems (ISMS). Certification demonstrates to customers, regulators, and partners that you have systematically identified your information security risks and implemented controls proportionate to those risks.

The ISO Survey 2024 recorded 96,709 valid certificates across 179,877 certified sites globally — making ISO 27001 one of the fastest-growing management system certifications worldwide. The jump from earlier years reflects both genuine adoption growth and improved data collection via the IAF CertSearch database.

Organisations pursue certification for several reasons:

• Customer and procurement requirements: enterprise procurement processes increasingly require ISO 27001 as a minimum information security baseline.
• Regulatory alignment: ISO 27001 controls map to GDPR Article 32 security requirements, NIS2 obligations, and sector-specific frameworks. EU guidance treats recognised management system standards as evidence of appropriate security measures (ENISA).
• Operational discipline: the certification process forces a rigorous look at information risks that most organisations have never systematically assessed.

What changed in ISO 27001:2022

ISO/IEC 27001:2022 was published on 25 October 2022, replacing the 2013 version. The transition period for organisations certified against the 2013 version ended on 31 October 2025, as set by the IAF resolution on transition arrangements (IAF Resolution 2022-21, IAF.nu). After that date, 2013 certificates are no longer valid. The main body (Clauses 4–10) changed only slightly — refinements in wording and a new requirement for organisations to determine processes needed for the ISMS and their interactions. The substantive changes are in Annex A:

• Controls reduced from 114 to 93 through consolidation.
• Reorganised from 14 control categories to 4 themes: Organisational (37 controls), People (8 controls), Physical (14 controls), Technological (34 controls).
• 11 new controls added, including Threat intelligence (A.5.7), Information security for cloud services (A.5.23), ICT readiness for business continuity (A.5.30), Web filtering (A.8.23), Data masking (A.8.11), Data leakage prevention (A.8.12), and Secure coding (A.8.28).

The six-phase implementation roadmap

Phase 1: Scope, context, and leadership (weeks 1–4)

Define the ISMS scope. Clause 4.3 requires you to determine the boundaries of the ISMS — which parts of the organisation, which locations, which assets, and which information are included. Scope can be organisation-wide or limited to specific business units, systems, or services.

Understand the context. Clause 4.1 requires analysis of internal and external issues relevant to the ISMS (industry, regulatory environment, organisational structure, technology landscape). Clause 4.2 requires identification of interested parties and their requirements.

Secure leadership commitment. Without visible executive sponsorship and a named ISMS owner, implementations stall. Clause 5 makes this a formal requirement: top management must demonstrate leadership and commitment and assign responsibilities.

Phase 2: Gap assessment (weeks 4–8)

A gap assessment compares your current information security controls and practices against the requirements of Clauses 4–10 and the applicable controls in Annex A. The output is a prioritised list of gaps to close before a certification audit.

For a detailed treatment of this phase, see our post on ISO 27001 gap assessment explained.

Phase 3: Risk assessment and treatment (weeks 6–16)

Clause 6.1.2 requires a documented risk assessment process. You must:

1. Define risk assessment criteria (likelihood, impact, risk appetite).
2. Identify information security risks (threats, vulnerabilities, and affected assets or processes).
3. Analyse and evaluate each risk against your criteria.
4. Prioritise risks for treatment.

The risk treatment plan (Clause 6.1.3) documents how you will address each identified risk — apply controls, accept, transfer, or avoid. Controls selected must be justified against Annex A (the Statement of Applicability, or SoA, documents this justification).

For a full breakdown of the risk process, see ISO 27001 risk assessment and treatment explained.

Phase 4: ISMS documentation and control implementation (weeks 10–32)

Build and implement the mandatory documentation set. The ISMS documentation checklist covers all required artefacts in detail. Core documents include:

• ISMS scope document
• Information security policy
• Risk assessment and treatment methodology
• Risk register and treatment plan
• Statement of Applicability (SoA)
• Objectives and plans to achieve them
• Competence and training records
• Operational procedures for key controls
• Supplier security policy and agreements
• Incident management procedure
• Business continuity and ICT readiness plan

Implement the controls selected in your risk treatment plan. This is the longest phase: technical controls (access management, encryption, vulnerability management, logging) take time to configure and test; organisational controls (policies, training, supplier agreements) take time to roll out and embed.

Phase 5: Internal audit and management review (weeks 28–36)

Clause 9.2 requires internal audits at planned intervals. Before a Stage 2 certification audit, you need at least one complete internal audit cycle covering all ISMS clauses and applicable Annex A controls.

The internal audit produces a findings report. Clause 10 requires nonconformities to be addressed through documented corrective actions.

Clause 9.3 requires management review — a formal meeting where top management reviews ISMS performance, audit findings, risk status, and objectives. Minutes must be documented.

For the difference between an internal audit and a certification audit, see ISO 27001 internal audit vs certification audit.

Phase 6: Certification audit (weeks 34–44)

Certification audits are conducted by accredited certification bodies (CBs). The process has two stages:

Stage 1 (documentation review): The auditor reviews your ISMS documentation to assess readiness. A Stage 1 typically uncovers areas requiring attention before the Stage 2 — addressing these promptly prevents delay.

Stage 2 (implementation audit): The auditor verifies that your ISMS is implemented and operating effectively. They will interview staff, review records, and test controls. Nonconformities found at Stage 2 must be closed before the certificate is issued.

Upon successful completion, you receive an ISO 27001:2022 certificate valid for three years, subject to annual surveillance audits.

Timeline summary

Common implementation pitfalls

Scope creep. Defining scope too broadly before maturity is established is one of the fastest ways to fail a certification audit. Start with a focused, achievable scope.

Risk assessment as a formality. A risk register populated with generic threats and identical risk scores is a red flag for auditors. Risk assessment must reflect your actual environment.

Documentation without operation. Policies that staff have never read and procedures that are not followed in practice will not survive Stage 2 scrutiny.

Ignoring surveillance obligations. Certification is not a one-time milestone. Surveillance audits occur annually; ISMS records must be maintained continuously between them.

Frequently asked questions

How long does ISO 27001:2022 certification take?

For a medium-sized organisation starting from scratch, 9–18 months is a realistic range. Organisations with an existing security programme may move faster; those with complex multi-site environments may take longer.

What is the Statement of Applicability (SoA)?

The SoA is a mandatory document that lists all Annex A controls, indicates which apply to your ISMS, justifies inclusions and exclusions, and maps each selected control to the risks it addresses. It is one of the first documents a certification auditor will review.

Can a small business achieve ISO 27001 certification?

Yes. ISO 27001 is scalable. A small organisation with a well-defined, limited scope can achieve certification with a proportionate set of controls and documentation. The standard does not prescribe how large your ISMS must be — only that it must be effective.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 is the management system standard — it specifies what your ISMS must do. ISO 27002 is the code of practice — it provides guidance on how to implement each of the Annex A controls. Certification is against ISO 27001; ISO 27002 is a supporting reference.

---

ThreatBlock's ISO 27001:2022 Readiness course covers every phase of the implementation roadmap with practical exercises and document templates to accelerate your path to certification.

About the author: Samaksh is Lead Instructor at ThreatBlock and holds the OSCP, CRTP, CRTO, and CEH certifications, with expertise in cybersecurity compliance and risk management. Read more on the author page · Editorial policy.