Frequently asked questions and answers about ISO 27001

How can we help you with ISO 27001?

ISO 27001

• What is ISO 27001?

  ISO 27001 is an international standard that describes how an organization establishes, implements, operates and continually improves an information security management system (LIS/ISMS). The key point is that information security is not seen as an isolated IT issue, but as a governance issue at the business level. 

  The standard is based on a risk-based approach where the organization identifies its most critical information assets, analyzes threats and vulnerabilities, and decides on proportionate protective measures. The result is a structured and auditable‑A flexible working method that enables both internal control and external verification. 

• What is an LIS/ISMS?

  An LIS is the framework that makes information security work systematic, repeatable and controllable. It typically includes: 

  • governing documents (policies, guidelines, goals) 

  • organization (roles, responsibilities, decision structures) 

  • processes (risk management, incident management, supplier management) 

  • controls (technical and organizational) 

  The LIS functions as the "engine" of security work - it is through this that the organization plans, implements, monitors and improves its security measures. 

  This means a shift from protecting systems to ensuring that operations function despite disruptions. 

• What is the goal of ISO 27001?

  The goal is to protect the organization's information by ensuring: 

  • confidentiality (the right people have access) 

  • accuracy (the information is correct) 

  • availability (the information is available when needed) 

  But at a higher level, it's about reducing business risks. ISO 27001 ensures that risks related to cyber threats, operational disruptions, data leaks and suppliers are managed in a structured manner and in line with the business's risk appetite. 

• What does an ISO 27001 certification mean?

  Certification means that an external, independent auditor verifies that the organization's LIS meets the requirements of the standard. 

  The important thing here is not the certificate itself, but what it represents: 

  • that processes are documented 

  • that responsibility is clearly defined 

  • that risks are managed systematically 

  • that the work is traceable and auditable 

  The certification thus serves as external proof that information security is not ad hoc but structured. 

• Which organizations can be certified?

  ISO 27001 is completely industry neutral and can be applied by: 

  • authorities 

  • SaaS companies 

  • industrial company 

  • finance company 

  • small and large organizations 

  The difference is not whether you can be certified, but how comprehensive the LIS needs to be. The standard is designed to be adapted to the size, complexity and risk profile of the business. 

• Why do organizations implement ISO 27001?

  The most common driving forces are: 

  1. Risk reduction

  The organization gains control over cyber risks, supplier risks and operational risks. 

  2. Governance and structure

  Safety work is moving from person-dependent to process-based. 

  3. Regulatory compliance

  ISO 27001 serves as a framework to meet requirements in NIS2, DORA, GDPR, etc. 

  4. Business value

  Certification is often required in procurement and strengthens customer confidence. 

  In practice, ISO 27001 is often a combination of compliance‑needs and business strategy. 

• How does ISO 27001 affect business?

  ISO 27001 has a direct connection to business: 

  • Many procurements require certification (or equivalent) 

  • It reduces the risk of business-critical incidents 

  • It increases trust among customers and partners 

  But most importantly, it allows the organization to demonstrate how risks are managed – not just claim it. This is often crucial in regulatory and commercial dialogues. 

  How does ISO 27001 create trust? 

  Trust comes from transparency and structure. ISO 27001 means that: 

  • responsibility is defined 

  • risks are documented 

  • decisions are traceable 

  • controls are implemented and monitored 

  This allows customers, auditors and authorities to understand how the organization works with security – which significantly reduces uncertainty. 

• Can ISO 27001 have economic effects?

  Yes, both directly and indirectly: 

  Directly: 

  • fewer incidents 

  • less downtime 

  • reduced restoration costs 

  Indirectly: 

  • better business opportunities 

  • more efficient processes 

  • reduced regulatory risk 

  Many organizations see ROI primarily through avoiding large incident costs.

• Is ISO 27001 just documentation?

  No – but that is a common misconception. 

  Documentation is a prerequisite for: 

  • traceability 

  • audit 

  • steering 

  But the value lies in how the documentation is used: 

  • as a basis for risk decisions 

  • as support for processes 

  • as a basis for follow-up 

  A good LIS is not a document archive, but an active control system. 

• What does ISO 27001 cover?

  ISO 27001 covers both governance and operational implementation of information security. This means that the standard covers the entire chain from decisions to implementation and follow-up. 

  Specifically, it includes: 

  • establishment of governing documents (policies, goals, guidelines) 

  • risk management (identification, analysis, treatment) 

  • introduction of security controls (technical and organizational) 

  • incident management 

  • supplier management 

  • internal audit and follow-up 

  • continuous improvement 

  The key point is that ISO 27001 not only defines What to be done, without how it should be managed and monitored. It is therefore a management system – not a control library.

• What does risk-based working method mean?

  The risk-based approach is at the core of ISO 27001. 

  This means that the organization: 

  1. Identifies their information assets (systems, data, processes) 
  2. Analyzes threats and vulnerabilities 
  3. Assessing consequences for the business 
  4. Decides which measures are proportionate 

  The important thing here is that: 

  • not all controls need to be implemented 

  • the security level should correspond to the business risk 

  So it is not “maximum safety” that is the goal, but the right security based on risk and business needs.

• What are security checks?

  Security controls are the concrete measures the organization puts in place to manage identified risks. 

  They can be: 

  • technical (e.g. MFA, logging, encryption) 

  • organizational (e.g. policies, division of responsibilities) 

  • process-related (e.g. incident management, change management) 

  An important point in ISO 27001 is that controls: 

  • should always be linked to risk 

  • must be documented and justified (via SoA) 

  • should be monitored and measured 

  So it is not controls per se that are the focus – but controls as a consequence of risk decisions.

• How much documentation is required?

  Documentation is central but must be appropriate. 

  ISO 27001 requires documentation to ensure: 

  • traceability (what has been decided and why) 

  • responsibility (who does what) 

  • audit (can this be audited externally/internally) 

  Typical documents: 

  • information security policy 

  • risk register 

  • process descriptions 

  • guidelines and instructions 

  • audit reports 

  The important thing is that the documentation: 

  • actively used (not just existing) 

  • reflects how the organization actually works 
• What does continuous improvement mean?

  ISO 27001 is based on a PDCA‑logic (Plan–Do–Check–Act). 

  This means that LIS is not static but should: 

  • be followed up (measurement, KPIs) 

  • reviewed (internal audit) 

  • evaluated (management review) 

  • improved (actions, updates) 

  In practice, this means that: 

  • risks change → measures are updated 

  • incidents occur → processes improve 

  • requirements change → LIS is adjusted 

  This is crucial to ensure that LIS does not become a “shelf warmer”. 

• How to implement ISO 27001?

  A typical implementation takes place in steps: 

  1. Current situation analysis
     What is the organization doing today?
  2. Scope definition
     What should be covered? 
  3. GAP analysis
     Difference between current situation and requirements
  4. Establishment of LIS
     Policies, roles, processes
  5. Risk management
     Identify and address risks
  6. Introduction of controls
     Technical and organizational measures
  7. Internal audit & improvement
     Prepare for certification

  The important thing is that the implementation is run as a business initiative – not an IT project.

• What is a GAP analysis?

  A GAP analysis compares the organization's current way of working with the requirements of ISO 27001. 

  The result is: 

  • identified deficiencies (gaps) 

  • priority actions 

  • a roadmap for implementation 

  It is used to: 

  • create a realistic plan 

  • avoid overwork 

  • focus on real shortcomings 

  In practice, the GAP analysis is often the most important first step in structuring the work. 

• What role does management play?

  Management is crucial in ISO 27001. 

  They are responsible for: 

  • to set goals and direction 

  • to decide on risk acceptance 

  • to allocate resources 

  • to follow up on the work 

  This is also an important connection to NIS2 and DORA, where: 

  • management has formal responsibility 

  • deficiencies can have regulatory consequences 

  An LIS where management is not actively involved will almost always be ineffective. 

• Are external consultants needed?

  No – but often yes in practice. 

  Consultants are typically used to: 

  • accelerate implementation 

  • contribute with methodology and experience 

  • avoid common mistakes 

  • ensure auditable quality 

  But: 
  It is crucial that the organization itself: 

  • owns his/her LIS 

  • understands their processes 

  • conducts its security work 

  Otherwise, the solution will be dependent on an external party.

• Can the work be digitized?

  Yes – and it is often a key to success. 

  Digital tools are used to: 

  • manage risk registers 

  • structure controls and requirements 

  • follow up compliance 

  • document and share information 

  • manage supplier risks 

  The great value is that: 

  • the work becomes scalable 

  • responsibility and status become transparent 

  • follow-up is simplified 

  Without support, LIS risks becoming cumbersome and manual. 

• How does certification work?

  The certification process usually takes place in several steps and is basically about verifying that the organization's LIS works in practice – not just on paper. 

  Step 1 – Preparation 

  • LIS is established 

  • risk management is carried out 

  • controls are implemented 

  • internal audit is carried out 

  Stage 2 – Audit (Stage 1) 

  • overall review of documentation and structure 

  • ensures that the organization is ready for the main audit 

  Step 3 – Audit (Stage 2) 

  • in-depth review of how LIS works in practice 

  • interviews, sampling, verification of processes 

  Step 4 – Certificate 

  • issued if the requirements are met 

  • with any requirements for action 

  The crucial thing is that the audit tests actual working method, not just documentation. 

• How often is the system monitored?

  A certified LIS is subject to both internal and external monitoring: 

  • Annual follow-up audits (external) 

  • Recertification every three years 

  • Ongoing internal monitoring (KPIs, controls, risks) 

  But the most important thing is the internal rhythm: 

  • risk analyses are updated regularly 

  • management follows up on LIS 

  • incidents and deviations are analyzed 

  This means that LIS must be a living control system, not something you “update for revision”.

• What happens in case of deviations?

  Deviations are a natural part of a functioning LIS and are not seen as a failure – but as part of the improvement work. 

  When a non-conformity is identified, the organization shall: 

  1. Document the deviation 
  2. Analyze root cause 
  3. Take corrective action 
  4. Ensure that the problem does not recur 

  In an external audit, there is normally: 

  • minor deviations (must be addressed) 

  • major deviations (may affect certification) 

  The important thing is to show control and systematic management, not to be completely flawless. 

  How do you keep LIS alive? 

  This is one of the most common pitfalls – that LIS “stops” after certification. 

  A functioning LIS is kept alive by: 

  • recurring risk analyses 

  • continuous follow-up of controls 

  • regular internal audit 

  • active management involvement 

  • education and awareness 

  The key is to integrate LIS into: 

  • business planning 

  • change work 

  • decision-making 

  If LIS becomes a separate activity, it quickly loses its effectiveness. 

• How does ISO 27001 relate to NIS2?

  ISO 27001 and NIS2 overlap to a large extent, but have different roles: 

  ISO 27001: 

  • framework for how to work systematically 

  • focus on structure, process and risk 

  NIS2: 

  • legal requirement (legally binding) 

  • specifies what organizations must do 

  ISO 27001 covers many of the core requirements of NIS2, for example: 

  • risk-based work 

  • governance and responsibility 

  • documentation 

  • control of suppliers 

  But NIS2 imposes additional requirements, such as: 

  • mandatory incident reporting 

  • clearer management responsibilities 

  • supervision and sanctions 

  In practice, ISO 27001 is often used as basic, which is then supplemented for full NIS2‑compliance. 

• How does ISO 27001 relate to DORA?

  The relationship between ISO 27001 and DORA is similar to NIS2, but even clearer: 

  ISO 27001: 

  • generic framework (all industries) 

  • focus on information security 

  DORA: 

  • sector-specific (finance) 

  • focus on operational resilience and ICT risk 

  ISO 27001 covers parts of DORA, such as: 

  • management and governance 

  • risk management 

  • control structure 

  But DORA goes further in: 

  • ICT risk management (in more detail) 

  • incident reporting to authorities 

  • resilience testing (e.g. scenario/tests) 

  • third-party and supplier management 

  This means that ISO 27001 is a strong foundation – but not sufficient in itself. 

• Is ISO 27001 sufficient for DORA?

  No – and that is an important point in dialogue with customers. 

  ISO 27001 provides: 

  • structure 

  • processes 

  • steering 

  But DORA requires: 

  • regulatory adaptation 

  • sector-specific controls 

  • more detailed documentation and reporting 

  • explicit focus on operational resilience 

  So the right way to see it: 

  ISO 27001 = platform 
  DORA = expansion + stricter requirements 

  However, organizations that already have ISO 27001 have a clear advantage in DORA work.

• What is scope in ISO 27001?

  Scope defines: 

  • which parts of the organization are covered 

  • which systems, services and processes are included 

  It is a strategic demarcation and affects: 

  • scope of certification 

  • what risks are being managed 

  • what is reviewed in an audit 

  A too narrow scope can: 

  • reduce the value 

  • create risks outside LIS 

  A scope that is too broad can: 

  • make implementation heavy 

  Therefore, scope is one of the most important decisions early in the project. 

• What is SoA (Statement of Applicability)?

  The SoA is a key document in ISO 27001 that: 

  • lists which controls are included 

  • justify why they are chosen 

  • specifies how they are implemented 

  • shows which controls are not being used (and why) 

  It acts as a “bridge” between: 

  • risk analysis 
    and 

  • the implementation 

  SoA is also central to auditing because it shows that the organization: 

  • understands its risks 

  • makes conscious decisions 

  • can justify their safety work 
• What is the biggest success factor when implementing ISO27001?

  The single most important factor is integrating information security into business governance. 

  This means that: 

  • management is actively involved 

  • risks are linked to business decisions 

  • LIS is used in everyday life 

  • responsibilities are clearly distributed 

  Failed implementations are often characterized by: 

  • that it is run as an IT project 

  • that it lacks management support 

  • that it is not connected to the business 

  Successful implementations: 

  • uses LIS as a tool for management 

  • links security to business goals 

  • works continuously – not project-based 

More from Omegapoint