ISO/IEC 27001:2022 certification roadmap: from gap analysis to audit
The ISO 27001 steps through a lead auditor’s eyes, with the most common mistakes and where auditors look first.
Published: · 2 min read · HilfeX Security Team
- ISO/IEC 27001:2022 Annex A has 93 controls in four themes: organisational, people, physical and technological.
- The heart of the process is the risk assessment and the Statement of Applicability.
- Certification has two audit stages, followed by yearly surveillance audits.
ISO/IEC 27001 sets the requirements for an information security management system (ISMS). Certification shows customers and partners that you manage information security systematically. The transition period from the 2013 to the 2022 version ended on 31 October 2025; new certifications follow the 2022 version.
The roadmap
- Gap analysis: where are you against the standard? This gives a realistic timeline and budget.
- Scope and context: which sites, processes and systems? What do interested parties expect?
- Risk assessment and treatment: identify risks via assets, threats and vulnerabilities and plan treatment against acceptance criteria.
- Statement of Applicability (SoA): document for all 93 controls whether and why they apply.
- Implementation: policies, procedures, technical controls and awareness training.
- Internal audit and management review: verify effectiveness yourself and record leadership decisions.
- Certification audit: stage 1 reviews documentation and readiness, stage 2 the effective implementation.
Annex A in the 2022 version
Controls are grouped into four themes: organisational (37), people (8), physical (14) and technological (34). New controls include threat intelligence, security for cloud services, data masking and secure coding.
Common mistakes
- Using template policies without tailoring them.
- Doing the risk assessment once and never updating it.
- Being unable to evidence awareness training (attendance, results).
- Leaving supplier security to the contract alone.
After certification
Certificates usually run for three years with yearly surveillance audits, then recertification. Keep the ISMS alive with regular internal audits and risk reviews.
The HilfeX team supports you with ISO 27001 and ISO 22301 lead‑auditor experience, and IQ Portal keeps awareness and supplier evidence audit‑ready.
Frequently asked questions
How long does ISO 27001 certification take?
It depends on maturity and scope; for mid‑sized organisations preparation usually takes a few months up to a year.
Do all Annex A controls have to be implemented?
No. You implement what your risk assessment requires and justify exclusions in the Statement of Applicability.
Is ISO 27001 the same as GDPR compliance?
No, but they overlap strongly. A good ISMS makes meeting GDPR’s security requirements much easier.
