ISO 27001: Information security that works
ISO 27001 helps organizations to make information security mature, manageable and demonstrable. Not as a paper-based system, but as a strategic management tool that addresses risks, sets priorities, and supports decision-making.
What is ISO 27001?
ISO 27001 is the international standard for setting up, implementing, maintaining and continuously improving an information security management system (ISMS).
The goal is not to “lock everything down,” but to gain control over information security risks, make conscious choices regarding controls, and demonstrably manage the confidentiality, integrity, and availability of information.
ISO 27001 is emphatically not an IT standard, but a management system standard.
Certification demonstrates that an organisation has embedded information security structurally: not as a one-off project, but as a governance system that moves with risks and organisational changes.
Policy, governance, risk management, and steering are central. Technology follows.
At its core, ISO 27001 revolves around three elements:
- Understanding which risks you face and why. Based on context, processes, information, and dependencies.
- Making conscious choices about controls. Not applying everything, but addressing what truly matters.
- Ensuring that processes, behaviour, and steering actually work, even outside of audits.
Why ISO 27001 is relevant
Many organisations recognise this: information security feels fragmented, with isolated measures and little cohesion. Audits take up a lot of time but provide little direction. Policy is neatly documented but hardly used. Applications, suppliers, and AI applications are added faster than they are assessed. Incidents or audit findings do not lead to structural improvement.
ISO 27001 helps solve this, provided it is implemented correctly. Not as a checklist or compliance exercise, but as a risk-driven management system that grows with the organisation
From audit practice: The most common finding in ISO 27001 audits is not a technical problem, but a governance one: the management review has been conducted, but not used to set priorities. Risks have been identified, but their treatment has not been embedded in planning. ISO 27001 requires a demonstrable line from risk to decision to action. That line is absent more often than expected.
The structure of ISO 27001
1. The management system (chapters 4 to 10)
This forms the foundation: context and stakeholders, leadership and governance, risk management, objectives and planning, monitoring, audits and management review, and continuous improvement via the PDCA cycle. This is where maturity and administrative control arise.
2. Risk-driven control
Risks are identified, assessed, and prioritised, and translated into conscious choices: accept, mitigate, transfer, or avoid. Without risk management, no ISO 27001.
3. Annex A: controls
Annex A contains a reference list of information security measures across organisational, people-oriented, physical, and technological areas. Not everything is mandatory to apply, but everything must be considered and justified in the Statement of Applicability (SoA).
How iQomply approaches ISO 27001
STEP 01
Risks first
We start with context, processes and strategic goals. Everything we implement is traceable to what is truly important for your organisation.
STEP 02
Practical measures
We translate ISO 27001 measures into what fits your organisation. No overkill, no inadequacy, but appropriate and justifiable.
STEP 03
Governance and decision-making
Who is the risk owner? What is decided where? How is progress monitored? We make governance workable and supported.
STEP 04
Engagement team and audit
One lead consultant as a single point of contact, supported by a dedicated team for risk, governance, and audit. So that the audit is not a sprint but a formality
You will have a single point of contact. Our engagement team delivers the expertise your situation requires.
What ISO 27001 delivers
A mature information security management system that grows with your organisation. Clear roles, responsibilities and decision-making. Current risks with appropriate controls. Governance that works, beyond the audit. Better collaboration between security, IT, management and teams. A certificate that genuinely adds value.
For healthcare institutions: this system can be directly integrated with NEN 7510.
Our guidance is ideal for organisations that want to work structurally on information security, grow further in maturity, or deploy information security strategically. We work extensively for healthcare institutions, IT suppliers, SaaS platforms, hosting providers, educational institutions, and energy and utilities
Frequently asked questions about ISO 27001
How long does an ISO 27001 implementation take?
A realistic lead time from baseline assessment to certification is between six and twelve months, depending on the size of the organisation, current maturity, and available capacity. Organisations that already have a basic structure in place often progress through the process more quickly. iQomply works with a phased approach so that the organisation determines the pace, not the standard.
What does an ISO 27001 implementation cost?
Costs depend on the starting position, size, and complexity of the organisation. A baseline assessment quickly provides insight into the scope of the project. iQomply always works on the basis of a clear scope definition in advance, so you know what to expect. Schedule a non-binding introductory meeting for a tailored initial estimate.
Can iQomply also help with recertification?
Recertification is a good time to recalibrate the management system, not just to pass the audit. iQomply guides recertification with a targeted gap analysis of what has changed in the organisation, the standard, and the threat landscape. This ensures that recertification is not just a repeat of previous steps, but a move toward a higher level of maturity.
What is the difference between a gap analysis and a maturity assessment?
A gap analysis tests whether you meet the requirements of ISO 27001 and identifies what is missing. A maturity assessment goes a step further: it measures how mature your processes, governance, and risk management are, independent of the standard’s requirements. iQomply combines both in the baseline assessment, so you know not only what is missing but also where you stand and how you are growing.
Ready for an ISO 27001 management system that works?
Do you want information security that addresses risks, supports decision-making, and helps the organisation move forward? Then we start with what is truly important for your organisation.
Together, we look at where you stand, which risks matter, and how you can quickly grow in maturity. Non-binding, practical, and tailored to your situation.Schedule a c
Bart de Man, Founder of iQomply
Ready to grow from compliance to maturity?
No obligation, practical and focused on your situation.