What is ISO 27001?
ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). It provides a structured, risk-based framework for identifying, managing, and reducing information security risks across an organisation, helping protect sensitive information while demonstrating effective security governance.
The standard comprises management system requirements contained within Clauses 4 to 10, covering areas such as organisational context, leadership, planning, support, operation, performance evaluation, and continual improvement. These requirements are supported by 93 Annex A controls grouped into four themes: Organisational Controls, People Controls, Physical Controls, and Technological Controls. Together, these elements enable organisations to implement a comprehensive and auditable approach to information security.
For health-tech, digital health, medical device, and NHS suppliers, ISO 27001 certification provides independent assurance that information security risks are being managed systematically.
Increasingly, ISO 27001 is sought as part of NHS procurement, enterprise customer due diligence, and supply-chain assurance activities.
Who Needs ISO 27001 Compliance?
What Does ISO 27001 Certification Involve?
- 01
Define the ISMS Scope and Organisational Context
The process begins by determining the scope of the ISMS, including the services, systems, locations, people, and information assets it will cover. Organisations must also identify relevant internal and external factors, interested parties, and business objectives. The key output is a clearly defined ISMS Scope Statement that establishes the boundaries of the management system.
- 02
Conduct Risk Assessment and Risk Treatment
ISO 27001 compliance requires organisations to identify information security risks and assess their potential impact and likelihood. Appropriate risk treatment decisions are then made, whether through mitigation, transfer, acceptance, or avoidance. This stage produces a Risk Assessment and Risk Treatment Plan that forms the foundation of the ISMS.
- 03
Select Annex A Controls and Create Statement of Applicability
Based on identified risks, organisations determine which Annex A controls are required and how they will be implemented. These decisions are documented within the Statement of Applicability (SoA), one of the most important documents in the certification process. Annex A contains 93 controls covering organisational, people, physical, and technological security measures. A detailed explanation of the controls can be found in our ISO 27001 Annex A Controls Guide.
- 04
Implement Policies, Processes, and Controls
Once risks and controls have been defined, the organisation implements the necessary governance arrangements, policies, procedures, technical safeguards, awareness activities, and operational processes. The objective is to demonstrate that information security controls are operating effectively and consistently across the defined ISMS scope.
- 05
Complete Internal Audit and Management Review
Before ISO 27001 certification can be achieved, organisations must evaluate the effectiveness of the ISMS through internal audits and formal management reviews. These activities confirm that the management system is operating as intended and that identified issues are being addressed appropriately.
Typical outputs include Internal Audit Reports, Management Review Records, corrective actions, and evidence of continual improvement.
- 06
Undergo ISO 27001 Certification Audit
Certification is conducted by an independent UKAS-accredited certification body through a two-stage process. Stage 1 assesses the design and readiness of the ISMS, while Stage 2 evaluates the implementation and effectiveness of controls in practice. Successful completion results in ISO 27001 certification.
Following certification, organisations are subject to regular surveillance audits, typically conducted annually, and a full recertification audit every three years to demonstrate continued ISO 27001 compliance and continual improvement.
Common Challenges with ISO 27001 Implementation
ISO 27001 implementation can be challenging for health-tech, digital health, and medical device organisations, particularly where teams are small, fast-growing, or preparing for customer assurance requirements under time pressure. One common issue is scoping the Information Security Management System (ISMS) proportionately, so that it is credible and certifiable without becoming unnecessarily complex.
Organisations can also struggle to translate Annex A controls into practical, auditable processes that reflect how the business actually operates. For NHS suppliers, a further challenge is mapping ISO 27001 requirements to the Data Security and Protection Toolkit (DSPT) without duplicating evidence, controls, and governance activities.
Certification is not the end of the process. Organisations must sustain the ISMS through surveillance audits, internal audits, management reviews, corrective actions, and changes to systems, suppliers, services, and risks.
Experienced, healthcare-literate support from ISO 27001 consultants helps organisations with efficient implementation, avoid unnecessary complexity, and build a defensible ISMS that supports certification and long-term assurance.
For many healthcare technology suppliers, ISO 27001 has become a strategic business enabler as well as a recognised benchmark for information security maturity.
How AbedGraham Supports ISO 27001 Compliance
Gap Analysis and Readiness Assessment
We assess your current information security posture against the requirements of ISO/IEC 27001:2022, identifying compliance gaps, prioritising actions, and providing a clear roadmap towards certification readiness.
End-to-End ISO 27001 Implementation
Our specialists support the design, implementation, and operation of your Information Security Management System (ISMS), helping organisations develop the policies, processes, risk management activities, and evidence required to prepare confidently for Stage 1 and Stage 2 certification audits.
ISMS and Annex A Advisory
We provide expert guidance on ISMS design, risk management, Statement of Applicability development, and the practical implementation of Annex A controls, ensuring security measures remain proportionate, effective, and aligned with business objectives.
Internal Audit and Certification Support
We conduct independent internal audits, identify improvement opportunities, and help organisations prepare for external certification audits conducted by UKAS-accredited certification bodies.
Alongside ISO 27001 consultancy, we can also provide outsourced information security leadership, supporting governance, risk management, surveillance audits, continual improvement, and the ongoing evolution of the ISMS as the organisation grows.
Why Work with The AbedGraham Group for ISO 27001 Consulting Services?
The AbedGraham Group combines deep expertise in healthcare, digital health, medical devices, and information security to help organisations achieve and maintain ISO 27001 compliance with confidence. Our specialists bring together ISO 27001, NHS DSPT, cybersecurity, and clinical safety expertise under one roof, providing a joined-up approach that reflects the realities of operating within healthcare and life sciences environments.
We take a proportionate, risk-based approach tailored to organisations of all sizes, from startups pursuing their first certification to multinational suppliers managing complex security and compliance programmes. Our focus is on creating clear, audit-ready documentation, practical governance processes, and sustainable security controls that stand up to scrutiny.
Rather than operating as external advisors alone, our ISO 27001 consultants integrate closely with your team to accelerate progress, transfer knowledge, and support long-term success.
Interested in Other Services Related to ISO 27001?
ISO for Cybersecurity
Broader cybersecurity and resilience support across standards including ISO 22301 and ISO 27036 helping organisations build integrated management systems and governance frameworks.
Virtual Chief Information Security Officer (vCISO)
Strategic information security leadership to support ISO 27001 implementation, governance, risk management, continual improvement, and ongoing certification readiness.
Cybersecurity
Talk to an ISO 27001 Specialist
Contact our experts today to discuss your ISO27001 compliance requirements.
Frequently asked questions
ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). It provides a risk-based framework for managing information security across people, processes, and technology. Organisations implementing ISO 27001 identify security risks, apply appropriate controls, monitor performance, and continually improve their approach to information security through a structured management system.
ISO 27001 certification is not generally a legal requirement in the UK. However, many organisations pursue certification because it is increasingly expected by customers, procurement teams, regulators, insurers, and investors. For health-tech companies, NHS suppliers, medical device manufacturers, and organisations handling sensitive data, ISO 27001 is often an important source of independent assurance and competitive advantage.
ISO 27001 certification timescales depend on the size, complexity, and maturity of the organisation. Businesses with established governance, policies, and security controls may be ready within a few months, while organisations building an ISMS from scratch often require longer. The timeline is influenced by factors such as risk assessment, control implementation, evidence collection, internal audits, and readiness for external certification audits.
The total ISO 27001 certification cost varies according to organisational size, ISMS scope, existing security maturity, consultancy requirements, and certification body fees. Costs typically include implementation activities, internal audits, staff time, external certification audits, and ongoing surveillance audits. Organisations with mature governance and security processes generally require less effort to achieve certification than those starting from a lower baseline.
ISO 27001 is an internationally recognised certifiable standard that defines how an organisation should establish and operate an Information Security Management System. SOC 2 is an assurance framework commonly used in North America that assesses controls against trust service criteria such as security, availability, confidentiality, processing integrity, and privacy. Some organisations maintain both to satisfy different customer and market requirements.
The NHS Data Security and Protection Toolkit (DSPT) and ISO 27001 have different purposes but share many common principles. Both emphasise governance, risk management, information security controls, staff awareness, incident management, and continual improvement. Organisations with a well-implemented ISO 27001-certified ISMS are often well positioned to support DSPT compliance, although the DSPT contains additional NHS-specific requirements that must still be addressed separately.
ISO 27001 compliance is not typically a mandatory requirement for supplying products or services to the NHS. However, NHS organisations and healthcare customers increasingly expect suppliers to demonstrate strong information security practices and may request evidence of security assurance during procurement and due diligence activities. ISO 27001 certification can strengthen supplier credibility and help satisfy customer assurance requirements.
ISO 27001 is the certifiable standard that specifies the requirements for an Information Security Management System. ISO 27002 is a supporting guidance standard that provides recommendations and implementation guidance for information security controls. Put simply, ISO 27001 explains what organisations must achieve, while ISO 27002 provides practical guidance on how controls can be implemented and managed.
Related services
DSPT Audit & Compliance Readiness Services
The NHS Data Security and Protection Toolkit (DSPT) is a mandatory assurance requirement for IT…
vCISO for Healthcare & Life Sciences
Cybersecurity leadership is no longer optional in regulated healthcare markets. Whether you are…
Incident Response for Healthcare & Life Sciences
When a cyber incident occurs, speed and precision matter. But in healthcare and life sciences, the…