ISO 27001 Compliance
Assessment

ISO 27001 Certification Process

The certification process is divided into two stages: The "Stage 1 Audit" and the "Stage 2 Audit". The "Stage 1 Audit" consists of documentation review.

During Stage 1, the ISO 27001 assessor reviews policies and procedures to ensure that appropriate policies and procedures are in place to meet requirements of the ISMS. The "Stage 2 Audit" consists of the ISO 27001 auditor performing tests of effectiveness to ensure that controls have been implemented to meet the requirements of the ISMS.

Additional ISO 27001 Certification Requirements

In addition to the Stage 1 and Stage 2 audits, the following must be performed in order to become ISO 27001 certified:

• A periodic and independent internal audit of the ISMS against the requirements of the ISO 27001 standard.
• Many organizations have trouble meeting the internal audit requirement do to the following reasons:
• They do not have personnel that are truly independent. Those responsible for conducting the internal audit should not be auditing functions over which they have operational control or ownership.

To combat these issues, organizations are outsourcing the internal audit requirement to CPA firms, such as Schneider Downs, that possess the appropriate knowledge of internal audit and ISO 27001.