ISO 27001 for IT managers 1: build a business-owned security programme

What an ISMS is for

ISO/IEC 27001 sets requirements for an information security management system, usually shortened to ISMS. An ISMS is the organisation's way of deciding what information matters, assessing risks, choosing controls and checking whether those decisions work. It includes people and business processes as well as technology.

Confidentiality means information is available only to authorised parties. Integrity concerns its accuracy and protection against inappropriate change. Availability concerns access when needed. An IT manager deals with all three: a misdirected file affects confidentiality, an unauthorised bank-detail change affects integrity, and an unusable recovery process affects availability.

The current international edition is ISO/IEC 27001:2022, with the 2024 climate-action amendment. Use an authorised copy of the applicable standard and amendment for implementation. This series explains practical work using public ISO and certification-body guidance; it does not reproduce the paid standard or replace a clause-by-clause assessment. ISO/IEC 27002 supplies control guidance rather than the ISMS certification requirements.

Why the organisation might want certification

A well-run ISMS gives repeated security decisions an owner and a record. It can make customer assurance more consistent, expose dependencies before an incident and help management decide where to spend limited money. Accredited certification provides independent assessment of the defined management system; it does not certify that every product is secure or guarantee compliance with every law.

Ask the commercial sponsor what a customer actually requires. Does the contract name ISO 27001, accredited certification, a specific service or a completion date? A narrow scope that excludes the delivery operation might not satisfy the requirement. Check this before turning an ambitious sales promise into an IT deadline.

Cyber Essentials can provide useful technical evidence, but it does not replace an ISMS. ISO 27001 is risk-based and includes management, audit and improvement processes. Equally, holding ISO certification does not automatically satisfy Cyber Essentials' specific technical rules. Reuse evidence where it fits; do not treat certificates as interchangeable.

Give the IT manager a realistic remit

You may coordinate the programme and operate many controls, but leadership must own the business decisions. HR knows employment processes; procurement owns supplier commitments; information owners decide business impact; legal or privacy specialists establish applicable obligations; facilities controls physical access. Assign work to those functions instead of creating an IT policy nobody else has accepted.

Our fictional Merefield Services has 48 staff, hybrid working and cloud-based business systems. Its IT manager can show how access is removed. HR must explain how IT learns that someone is leaving, and the department owner must confirm the appropriate handover. A leaver failure can begin outside the identity system even when the final technical action belongs to IT.

These are suggested responsibilities, not job titles prescribed by ISO. In a small organisation one person may hold several roles. Make that explicit and arrange objective review where a person would otherwise assess their own work.

Build a programme before buying a document library

Start with a scope and responsibility workshop, a gap assessment against the licensed standard, a risk workshop and a prioritised implementation plan. Establish document control and an evidence index early, but do not spend the first month renaming template policies. A policy needs to describe an approved arrangement that people can operate.

Plan time for controls to run and generate real records, for internal audit and management review, and for corrective action before external assessment. Ask prospective certification bodies how they judge readiness and what operational history they need. NQA, for example, describes a minimum operating period in its own process; that is not a universal promise that every organisation can finish in three months.

Use Stage 1 and Stage 2 as planned assessment milestones rather than dates that override readiness. Stage 1 examines readiness and the system's design; Stage 2 evaluates implementation and effectiveness. The later parts of this series cover both, including how to handle findings.

Agree the policy and objectives

Have leadership approve a concise information security policy consistent with the organisation's purpose and obligations. Make it accessible to the people who need to follow it. The policy should support the way objectives are set and the commitment to maintain and improve the ISMS; check its content against the current standard rather than treating this paragraph as a complete template.

Choose objectives with owners and a way to evaluate results. For example, Merefield might aim to demonstrate recovery of its priority delivery service against business-agreed targets by a funded exercise date. Record the resources, responsible person and evaluation method. “Achieve ISO” alone does not describe the security outcome the organisation needs. Track objectives through management review and revise them through an authorised decision when circumstances change.

Choose assurance deliberately

If UKAS-accredited certification is needed, verify the certification body's relevant accreditation and the intended certification scope. UKAS accredits certification bodies; ISO publishes standards and does not issue your organisation's certificate. UKAS CertCheck helps verify claims of accredited certification, including supplier certificates you may rely on.

Ask for an itemised proposal covering scope, locations, audit stages, ongoing surveillance, recertification and additional work. Keep consultancy support and certification roles clear. A consultant's readiness opinion is not an external certification decision.

Your first deliverable

Write a programme charter with the business purpose, proposed scope, sponsor, participating functions, budget decisions and readiness milestones. Add a sentence explaining what remains outside the programme and who owns those dependencies. Take it to the actual decision-makers.

You are ready for part 2 when management has accepted that this is a business system with IT contributions, not a certificate the IT manager can manufacture alone. Next, turn the proposed scope into an information and dependency map that risk assessment can use.

Check your understanding