ISO 27001 for NZ and Australian SMEs: The Practical Path to Certification

The standard starts by asking what affects your ability to protect information: your market, regulators, customers, suppliers and, since the 2024 amendment, whether climate change is a relevant issue.

What the auditor checks

That internal and external issues and interested parties' requirements are identified, and that they visibly feed the scope and risk assessment.

Do this first

List the issues and interested parties on one page: customers and their contract requirements, regulators such as the Privacy Commissioner, key suppliers, staff and owners. Note climate change and whether it is relevant.

Evidence produced

• Context and interested parties register
• Legal, regulatory and contractual requirements list

The scope decides what the certificate covers. Customers will read it, so it must match what they think they are buying from you.

What the auditor checks

A documented scope covering boundaries, locations, products and interfaces with outside parties, consistent with context and risk.

Do this first

Write the scope statement in one paragraph naming the products, teams, locations and supporting systems covered, then test it against the question a customer will ask: does this include my data?

Evidence produced

• Documented ISMS scope
• Boundary and interfaces description

ISO 27001 is a management system. Auditors will interview leadership, not just the person who wrote the documents, to see that security is directed from the top.

What the auditor checks

An approved information security policy, assigned roles and responsibilities, and leaders who can explain the objectives and their part in the ISMS.

Do this first

Have the leadership team approve a one-page information security policy, name an ISMS owner, and assign each Annex A area to a person who will speak to it at audit.

Evidence produced

• Approved information security policy
• Roles and responsibilities matrix
• Leadership meeting minutes

Risk drives everything in ISO 27001: which controls you select, which you exclude, and where you spend. The method must give consistent, comparable results when repeated.

What the auditor checks

A documented risk assessment process with acceptance criteria, risks identified with owners, and results retained.

Do this first

Choose a simple likelihood and impact scale with a clear acceptance threshold, then assess the top risks to confidentiality, integrity and availability with a named owner for each.

Evidence produced

• Risk assessment methodology
• Risk register with owners and ratings
• Risk assessment results with date

The Statement of Applicability lists all 93 Annex A controls, says whether each applies, why, and whether it is implemented. It is the document auditors and many customers ask for first.

What the auditor checks

Every Annex A control addressed with a justification for inclusion or exclusion, consistent with the risk treatment plan, and approved by risk owners.

Do this first

Start from the risk register, select controls for each risk, then walk all 93 Annex A controls and record applicable or not, with a one-line reason for each.

Evidence produced

• Statement of Applicability
• Risk treatment plan
• Risk owner approval of residual risk

Objectives show what the ISMS is meant to achieve. The 2022 edition also asks you to plan changes to the ISMS rather than let them happen by accident.

What the auditor checks

Information security objectives that are measurable, monitored and communicated, with plans saying who, what, when and how results are evaluated.

Do this first

Set three to five objectives tied to the business, such as 100 percent MFA coverage or all critical vulnerabilities fixed within 14 days, and report them at management review.

Evidence produced

• Information security objectives with measures
• Objective tracking reports
• Change planning records

People with ISMS roles need the competence to do them, and everyone needs to know the policy, their part in it and what happens if they ignore it.

What the auditor checks

Evidence of competence for people in ISMS roles, and staff who can describe the policy and how to report an incident.

Do this first

Record the competence needed for each ISMS role and how each person meets it, and run short awareness training for all staff covering the policy, reporting and their responsibilities.

Evidence produced

• Competence records for ISMS roles
• Awareness training records
• Communication plan

ISO 27001 requires certain documents and records, and that they are controlled: versioned, approved, available to the people who need them and protected.

What the auditor checks

Mandatory documented information exists, with version control, approval and access control.

Do this first

Put the ISMS documents in one controlled location with version history, an owner and a review date for each, and retire copies held elsewhere.

Evidence produced

• Document register with owners, versions and review dates
• Controlled document repository

The largest theme: policies, asset inventory, access control, supplier and cloud security, incident management, continuity, legal requirements and threat intelligence.

What the auditor checks

That the organisational controls selected in your SoA are implemented and operating, with evidence, especially suppliers, access and incidents.

Do this first

Start with the controls customers ask about most: asset inventory, access control, supplier security, cloud services, incident management and business continuity.

Evidence produced

• Asset and supplier registers
• Access control policy and reviews
• Incident and continuity plans with test records

Screening, terms of employment, awareness, disciplinary process, leavers, confidentiality agreements, remote working and event reporting.

What the auditor checks

A sample of joiners and leavers showing screening, agreements and access removal, and a remote working approach that matches how people actually work.

Do this first

Add screening, confidentiality and policy acknowledgement to onboarding, and tie access removal to the leaver process with a same-day target.

Evidence produced

• Onboarding and offboarding records
• Signed confidentiality agreements
• Remote working policy

Secure areas, entry, equipment, clear desk, storage media, cabling, maintenance and secure disposal. For cloud-first SMEs many are inherited from providers or limited to the office and home working.

What the auditor checks

That applicable physical controls are in place at your locations, and that controls inherited from data centre providers are supported by their certifications.

Do this first

Walk the office with the SoA in hand, record what applies, and collect your cloud and data centre providers' ISO 27001 certificates or SOC 2 reports for the rest.

Evidence produced

• Office physical security review
• Provider certificates or reports
• Equipment disposal records

Endpoints, privileged access, authentication, malware, vulnerabilities, configuration, backup, logging, monitoring, network security, cryptography and secure development.

What the auditor checks

Configuration and records that show the technical controls in your SoA operate, sampled across the period since implementation.

Do this first

Use a security baseline such as NCSC's Critical Controls to implement the core: MFA, patching, endpoint protection, backups, logging and configuration management.

Evidence produced

• Configuration exports and reports
• Vulnerability and patch reports
• Backup and restore test records
• Log and monitoring evidence

NCSC Critical Controls ↗ (opens in a new tab)

You decide what to measure, how and when, and who analyses the results. Good measures come straight from your objectives and key controls.

What the auditor checks

Defined measures with methods and timing, and retained results that are evaluated, not just collected.

Do this first

Pick a handful of measures linked to your objectives, collect them monthly, and review the trend at management review.

Evidence produced

• Measurement plan
• Monitoring results and trend reports

Before certification, the whole ISMS must be internally audited by someone objective and impartial, with findings tracked to closure.

What the auditor checks

An audit programme, an internal audit covering the ISMS and Annex A before Stage 2, auditor independence from the work audited, and findings acted on.

Do this first

Plan an internal audit covering every clause and the applicable Annex A controls, and use someone who did not build the ISMS: an external auditor, or a trained colleague from another area.

Evidence produced

• Internal audit programme
• Internal audit report
• Corrective action log

Leadership must formally review the ISMS, covering a defined list of inputs, and record decisions about improvement and change.

What the auditor checks

A management review before Stage 2 covering all required inputs, with recorded decisions and actions.

Do this first

Book a 90-minute leadership meeting after the internal audit, use an agenda that covers every input the standard lists, and minute the decisions.

Evidence produced

• Management review agenda and minutes
• Decisions and actions log

When something goes wrong, the standard expects you to correct it, find the cause and stop it recurring, then improve the ISMS continually.

What the auditor checks

Nonconformities recorded with root cause, corrective action and a check that the action worked.

Do this first

Log every internal audit finding and incident lesson in one corrective action register with cause, action, owner, due date and an effectiveness check.

Evidence produced

• Corrective action register
• Effectiveness reviews

Certification is a two-stage external audit. Stage 1 reviews your documentation and readiness; Stage 2 tests whether the ISMS operates in practice.

What the auditor checks

Stage 1: scope, mandatory documents, SoA, internal audit and management review. Stage 2: interviews and samples showing the ISMS and selected controls operate.

Do this first

Get quotes from accredited certification bodies, check accreditation (JAS-ANZ in New Zealand and Australia, or another IAF member), and book Stage 1 once internal audit and management review are done.

Evidence produced

• Certification body proposal and accreditation
• Stage 1 report and actions
• Stage 2 report and certificate

Certificates run a three-year cycle with surveillance audits in the years between. The ISMS has to keep operating, not just exist on certification day.

What the auditor checks

At surveillance: internal audits, management reviews, corrective actions and a sample of controls since the last visit.

Do this first

Put the annual cycle in the calendar: risk review, internal audit, management review and surveillance audit, with an owner for each.

Evidence produced

• Annual ISMS calendar
• Surveillance audit reports
• Updated SoA and risk register