ISO 27001 — Information Security

What does ISO/IEC 27001:2022 require?

The standard has two parts. Clauses 4 to 10 set out the management system requirements, and every one of them applies to a certified organization. Annex A lists reference controls, which you select from based on your risk assessment rather than implement wholesale.

The Statement of Applicability is the document that ties the two parts together. It lists every Annex A control, states whether it applies, explains why, and records whether it is implemented. Auditors use it as a map of the whole ISMS.

Who needs ISO 27001 certification in Canada?

ISO/IEC 27001 certification is voluntary. Organizations pursue it when information security becomes part of how they win and keep work.

Software and managed service providers selling to larger organizations meet it in vendor risk reviews. Aerospace and defense suppliers hold controlled drawings and technical data their customers expect them to protect. Healthcare and medical device companies handle patient-related and product data that buyers want handled under a recognized framework.

Privacy law sits alongside the standard. PIPEDA applies to private-sector organizations that collect, use or disclose personal information in the course of commercial activity, and Alberta, British Columbia and Quebec have their own private-sector privacy laws that apply within those provinces. ISO/IEC 27001 certification shows that information security is managed systematically, but it is not a privacy compliance certificate. Consent, purpose limits and individual access rights remain separate obligations.

How long does ISO 27001 certification take?

A first ISO/IEC 27001 certification typically takes four to nine months. The range depends mostly on scope: certifying one product or service is a smaller project than certifying the whole organization, and every location, cloud service and supplier inside the scope must be accounted for.

The other driver is how much evidence already exists. An organization with an asset inventory, documented access reviews, tested backups, security awareness training and an incident log is formalizing and connecting work it already does. An organization without them needs time to put the controls in place and then run them long enough to produce records an auditor can sample.

Certification body fees are quoted in audit days, which depend mainly on the number of people working within the scope and the complexity of the systems involved.

A free readiness check gives you a scored view of your current position.

Preparing for the ISO 27001 certification audit

The certification audit runs in two stages. Stage 1 reviews the documented ISMS: the scope, the information security policy, the risk assessment method and results, the risk treatment plan and the Statement of Applicability. Stage 2 tests whether the controls operate as described.

In Stage 2, auditors sample real records. Expect requests for evidence of joiner and leaver access changes, periodic access reviews, a backup restore test, supplier security assessments, security awareness training and the handling of at least one incident or event. A control listed as implemented in the Statement of Applicability needs evidence behind it.

Before Stage 1, complete an internal audit of the whole ISMS and a management review, and close the corrective actions they raise. Keeping the Statement of Applicability, policies and audit program in one compliance system makes it easier to show the auditor that each control has an owner and a current status.

Choose a certification body accredited for ISO/IEC 27001, either by the Standards Council of Canada or by another signatory to the International Accreditation Forum (IAF) Multilateral Recognition Arrangement. After certification, expect annual surveillance audits and a recertification audit in the third year. The six-stage certification process shows how ISO Certification Consultants plan the work from gap analysis to certificate.