Notifications
Clear all
Topic starter
12/06/2026 1:03 am
TL;DR: ISO 27001 certification depends on scoping controls, documenting them in a statement of application, and proving they work through audit and recertification, according to Zluri’s breakdown of the process. The real governance test is whether identity and access reviews can produce reliable evidence fast enough to withstand scrutiny.
NHIMG editorial — based on content published by Zluri: ISO 27001 Certification Process: Detailed Breakdown Of Phases
Questions worth separating out
Q: How should organisations prepare for ISO 27001 certification without creating audit chaos?
A: Start by fixing scope, ownership, and evidence collection before the external audit begins.
Q: Why do access reviews matter so much in ISO 27001 certification?
A: Access reviews prove that entitlements are being checked and corrected, not merely documented.
Q: What breaks when ISO 27001 evidence is assembled manually at the end of the process?
A: Manual assembly creates inconsistent records, slows down corrective action, and makes it harder to prove that controls were operating continuously.
Practitioner guidance
- Map certification evidence to named owners Assign ownership for scope, SoA updates, internal review evidence, and corrective action records before the audit cycle begins so each artefact can be traced to a responsible team.
- Standardise access review outputs Use a consistent format for user, application, decision, and remediation records so internal reviews can be reused as pre-assessment evidence without manual reconstruction.
- Separate stage 1 readiness from stage 2 effectiveness Check that documentation completeness, control design, and actual control performance are assessed independently so gaps are not hidden by well-written policy.
What's in the full article
Zluri's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step phase checklist for planning, audit, and certification maintenance
- Detailed explanation of stage 1 versus stage 2 audit expectations and nonconformity handling
- Access review workflow examples, including automated remediation and audit reporting outputs
- Estimated timelines and certification cost ranges for the full ISO 27001 process
👉 Read Zluri's breakdown of the ISO 27001 certification process →
ISO 27001 certification process: where access reviews break down?
Explore further
12/06/2026 10:42 am
ISO 27001 succeeds or fails on evidence discipline, not just control intent. The article shows that certification hinges on whether organisations can translate policy into auditable records, corrective actions, and repeatable review cycles. That is a governance problem first and a tooling problem second. The practitioner takeaway is that evidence generation has to be built into the operating model, not assembled after the fact.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI, even as the majority continue to expand autonomous adoption.
A question worth separating out:
Q: Who is accountable when ISO 27001 controls fail during recertification?
A: Accountability sits with the teams that own the ISMS scope, the control set, and the evidence trail, not with the auditor. Recertification exposes whether governance is still aligned to current operations, so organisations need clear ownership for updating policies, access reviews, and corrective actions before renewal.
👉 Read our full editorial: ISO 27001 certification process exposes access review gaps
