ISO 27001 Certification: Closing the Gap Between Policy and Practice in Information Security

Why ISO 27001 Policies Alone Are Not Enough

Thousands of organisations have documented information security policies. Far fewer have an Information Security Management System (ISMS) that actually works day-to-day. ISO 27001:2022 — the international standard for information security management — is not a documentation exercise. It is a framework for embedding security into organisational culture, processes, and decision-making.

If your organisation has policies sitting in a shared drive that nobody reads, controls that exist on paper but are never tested, and risk assessments that are updated once a year as a compliance ritual, this article is for you. Here is how to close the gap between ISO 27001 policy and practice — and what certification actually demands.

What ISO 27001:2022 Actually Requires

The 2022 revision of ISO 27001 restructured Annex A from 114 controls across 14 domains to 93 controls across four themes: Organisational, People, Physical, and Technological. This is more than a cosmetic change — it reflects how modern security threats actually operate across blended environments.

At its core, the standard requires organisations to:

• Define the scope of the ISMS and document the organisational context (Clause 4)
• Demonstrate visible leadership commitment and assign clear security roles (Clause 5)
• Conduct a structured information security risk assessment and produce a risk treatment plan (Clause 6)
• Implement controls from Annex A that are proportionate to identified risks (Clause 6.1.3)
• Maintain documented evidence of operational controls and monitoring (Clause 8–9)
• Run internal audits and management reviews at planned intervals (Clause 9)
• Manage nonconformities and drive continual improvement (Clause 10)

Certification auditors do not just read your policies. They interview staff, inspect logs, test controls, and look for evidence that the ISMS is alive — not archived.

The Five Most Common Gaps Auditors Find

1. Risk Assessments That Are Not Risk-Based

Many organisations produce risk registers that list generic threats without linking them to specific information assets, business processes, or realistic impact scenarios. ISO 27001 requires a repeatable, documented methodology. Risks must be assessed against defined criteria, owned by named individuals, and tracked through treatment to acceptance.

2. Controls Selected Without Justification

The Statement of Applicability (SoA) is one of the most scrutinised documents in a certification audit. Every Annex A control must be listed with a clear justification for inclusion or exclusion. Selecting all 93 controls without tailoring them to your risk profile is as problematic as excluding controls without documented rationale.

3. Supplier and Third-Party Risk Ignored

ISO 27001:2022 introduced new controls specifically addressing supplier relationships and cloud services (A.5.19–A.5.23). Organisations that treat third-party risk as an afterthought — or rely on a supplier's self-attestation without due diligence — will face findings. Every supplier with access to your information assets needs to be assessed and managed.

4. Incident Management Without Evidence

Having an incident response procedure is not the same as having an incident management capability. Auditors look for records of actual incidents (including near-misses), evidence that the procedure was followed, and documented lessons learned. If your incident log is empty, that is a red flag — not a clean record.

5. Internal Audits That Lack Independence

Internal auditors must be objective. An IT manager auditing their own team's controls does not meet this requirement. Organisations need either a dedicated internal audit function, cross-departmental audit teams, or external support for internal audit activities.

Practical Steps to Operationalise Your ISMS

Embed Security in Business Processes

Security controls should be integrated into how work actually gets done — not bolted on as separate compliance tasks. This means including information security requirements in project initiation, procurement decisions, HR onboarding and offboarding, and change management processes.

Make Risk Assessment Continuous

Annual risk assessments are a minimum, not a best practice. Significant changes — new systems, acquisitions, regulatory changes, major incidents — should trigger a targeted risk review. Build risk assessment into your change management process so it happens automatically when it matters most.

Test Your Controls

Controls that are never tested are controls you cannot rely on. Schedule regular testing of technical controls (access reviews, backup restoration, vulnerability scans), physical controls (access logs, visitor records), and people controls (phishing simulations, security awareness assessments). Document the results and act on findings.

Use Metrics That Drive Decisions

ISO 27001 Clause 9.1 requires performance evaluation. Choose metrics that tell you whether your ISMS is working — not just whether activities were completed. Useful metrics include mean time to detect and respond to incidents, percentage of staff completing security awareness training, number of open high-risk items, and patch compliance rates.

Benefits of ISO 27001 Certification Beyond Compliance

Organisations that achieve ISO 27001 certification — and maintain it meaningfully — report tangible business benefits beyond the certificate itself:

• Competitive differentiation: Many enterprise customers and public sector buyers now require ISO 27001 certification as a minimum supplier qualification.
• Reduced cyber insurance premiums: Insurers increasingly offer preferential rates to certified organisations with demonstrable security controls.
• Faster incident recovery: Organisations with mature ISMSs detect and contain breaches faster, reducing financial and reputational damage.
• Regulatory alignment: ISO 27001 maps closely to GDPR, NIS2, and sector-specific regulations, reducing duplicated compliance effort.
• Board-level confidence: Certification provides leadership with structured assurance that information security risks are being managed systematically.

Preparing for Your ISO 27001 Certification Audit

Certification audits are conducted in two stages. Stage 1 is a documentation review — auditors assess whether your ISMS is designed to meet the standard's requirements. Stage 2 is an implementation audit — auditors verify that the ISMS is operational and effective through interviews, observation, and evidence review.

The most effective preparation is not a last-minute documentation sprint. It is running your ISMS as if you are always audit-ready: maintaining current risk assessments, keeping control evidence up to date, completing internal audits on schedule, and closing nonconformities promptly.

Partner with MaxStandards for ISO 27001 Certification

At MaxStandards Certification, we work with organisations at every stage of the ISO 27001 journey — from initial gap assessment and ISMS design through to certification audit and ongoing surveillance support. Our auditors bring deep technical expertise and practical industry experience, helping you achieve certification that reflects genuine security maturity, not just paperwork compliance.

Whether you are pursuing ISO 27001 for the first time or preparing for your recertification audit, our team can guide you through the process efficiently and effectively. Contact MaxStandards today to discuss your ISO 27001 certification pathway.