ISO 27001 Certification Requirements in the UK (2026 guide)

This guide explains ISO 27001 certification requirements in the UK, covering clauses, Annex A controls, audit process, documentation checklist, and more.

Key takeaways

1. ISO 27001 certification succeeds when you understand clauses, controls and evidence - not just policies or security tools.
2. Auditors assess real implementation, documented evidence and ongoing improvement, not intentions or one-off preparation before audit.
3. Credible certification means accredited certification, structured internal reviews and consistent ISMS maintenance after certification.
4. In the UK and Europe this typically means UKAS-accredited certification, or certification from another certification body accredited by another reputable IAF accreditation body.

Most ISO 27001 projects fail before the audit even begins - not because security is weak, but because the requirements are misunderstood.

If you are a UK or European SME, SaaS company, professional services firm, or supplier bidding for contracts, this guide is for you. It is written from an auditor’s perspective and explains what certification bodies actually assess during a UKAS-accredited audit, or an audit accredited by another IAF-accredited certification body.

We will walk through the ISO 27001 requirements clause by clause, explain how Annex A controls fit in, outline internal audit expectations, and clarify what documentation is mandatory.

Just as importantly, we will separate 3 things that are often confused: requirements, controls, and certification.

What ISO 27001 is and why UK and European organisations adopt it?

ISO/IEC 27001 is the international standard for information security management. It was developed by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC).

The current version, ISO/IEC 27001:2022, sets out how organisations must establish, implement, maintain and continually improve an Information Security Management System (ISMS).

In the UK and European market, ISO 27001 often goes beyond best practice. It provides client assurance during procurement, strengthens supplier onboarding, and supports alignment with GDPR and contractual data protection obligations.

Although it is a voluntary standard, many UK and European organisations find it commercially mandatory when bidding for contracts or entering regulated supply chains.

What are the ISO 27001 certification requirements?

Under ISO/IEC 27001, the certification requirements are defined in Clauses 4-10 of the standard. These clauses are mandatory.

If an organisation wants certification, every requirement within the clauses must be met.

What the clauses are designed to do

Clauses 4–10 set the foundation of your ISMS. They require you to:

• Understand your organisational context and risks
• Demonstrate leadership and management accountability
• Plan how risks will be treated
• Provide resources, competence and awareness
• Operate the ISMS in a controlled way
• Monitor, measure and improve performance

In practice, they ensure your ISMS is structured, risk-based and actively managed.

Requirements vs controls: A common misunderstanding

A frequent mistake is treating Annex A as the certification requirement. It is not.

Annex A contains controls that support risk treatment

The clauses, on the other hand, define the mandatory framework. Without meeting Clauses 4-10, certification is not possible, regardless of how many controls are implemented.

Overview of the ISO 27001 clause structure

ISO/IEC 27001 is structured into 10 clauses. However, not all of them contain audit requirements.

• Clauses 0-3: Context and background - Clauses 0-3 provide introduction, scope, normative references and key terms. These sections explain how the standard works and how it should be interpreted. They are not requirements
• Clauses 4-10: Mandatory ISMS requirements - The ISO 27001 ISMS requirements are defined in Clauses 4–10. These clauses form the certifiable core of the standard, and are requirements.

Why evidence matters more than intent

In practice, auditors do not just assess what an organisation plans to do. They assess what is operating.

Policies without implementation, risk assessments without action, or processes without records will not satisfy certification requirements. Evidence, in the form of documented information and operating records, is what demonstrates compliance.

Clause-by-clause ISO 27001 requirements explained

‍

Clause 4 - Context of the organisation

Clause 4 requires you to define the foundation of your ISMS.

This includes:

1. Defining the ISMS scope

The scope must clearly state what parts of the business are included. It should define locations, services, systems and boundaries.

Scope errors are among the most common reasons for audit delays or failures. If the scope is vague, artificially narrow, or inconsistent with actual operations, auditors will challenge it.

2. Internal and external issues

Organisations must consider business model, technology, regulatory landscape, supplier dependencies and market pressures. This ensures the ISMS reflects reality rather than theory.

3. Interested parties

You must identify relevant stakeholders, such as customers, regulators, partners and employees, and understand their information security expectations.

4. ISO 27001 legal requirements

Legal, regulatory and contractual obligations relevant to information security must be identified and considered - typically in a legal register spreadsheet. In the UK or Europe, this commonly includes:

• GDPR requirements
• Data processing agreements
• Client security clauses in contracts

These obligations feed directly into the risk assessment and influence control selection. If legal risks are not reflected in your risk treatment decisions, auditors will question the effectiveness of your planning.

Clause 5 - Leadership and commitment

Clause 5 places accountability firmly with top management.

It requires:

• Demonstrable leadership commitment
• An approved Information Security Policy
• Clear assignment of roles and responsibilities

Auditors expect to see evidence that leadership is actively engaged. This may include:

• Signed policy approval
• Defined ISMS roles
• Participation in management reviews
• Participation in opening and closing meetings of Stage  and Stage 2 audits
• Resource allocation decisions

Clause 6 - Planning

Clause 6 introduces the risk-based core of ISO 27001.

Organisations must define:

• A risk assessment methodology
• A consistent risk treatment approach
• Measurable information security objectives

The methodology must explain how risks are identified, analysed and evaluated. It must be repeatable and applied consistently.

The Statement of Applicability (SoA) links risk assessment outcomes to selected Annex A controls. It must justify the inclusion or exclusion of controls and reflect actual risk decisions.

Without a clear link between risk assessment and the SoA, certification readiness is weak.

Clause 7 - Support

Clause 7 focuses on enabling the ISMS to function properly.

It covers:

• Adequate resources
• Competence and training
• Awareness of information security responsibilities
• Internal communication
• Document control requirements

Auditors assess whether people understand their security responsibilities and whether documentation is controlled, versioned and accessible.

Policies must not only exist; they must be communicated and understood.

Clause 8 - Operation

Clause 8 requires organisations to operate the ISMS in practice.

This includes:

1. ISO 27001 data protection requirements

ISO 27001 does not contain a standalone “data protection clause”. Instead, data protection is addressed through risk treatment decisions and Annex A controls, such as:

• Access control
• Encryption
• Secure data handling

The standard supports compliance with UK GDPR by embedding risk-based security management. However, ISO 27001 certification does not replace legal obligations under data protection law.

Organisations should avoid presenting ISO 27001 as a substitute for regulatory compliance.

2. ISO 27001 backup requirements

Under operational controls, backup arrangements must reflect identified risks.

This includes:

• Backup processes
• Restoration testing
• Defined retention periods
• Clear assignment of responsibility

ISO 27001 does not mandate specific backup tools, but requires evidence-based backup controls where risks justify them.

Auditors will request evidence of successful restoration testing, not just policy statements.

3. ISO 27001 business continuity requirements

Business continuity and disaster recovery planning must align with risk assessment outcomes and availability objectives.

Controls relating to continuity are selected through the risk treatment process. While ISO 27001 addresses resilience, organisations with more complex continuity needs may align their approach with ISO 22301 for business continuity management.

The key audit question is simple: are continuity arrangements proportionate to identified risks?

Clause 9 - Performance evaluation

Clause 9 ensures the ISMS is monitored and reviewed.

It requires:

• Monitoring and measurement
• Defined KPIs
• Internal audits
• Management reviews

Internal audits must be planned and conducted at defined intervals. They must assess conformity and effectiveness. The results of those audits should then feed into formal management reviews, where leadership evaluates overall ISMS performance, emerging risks, security objectives, audit findings and any required improvement actions.

Accredited certification bodies will also conduct annual surveillance audits. Evidence of ongoing monitoring is therefore essential.

Clause 10 - Improvement

Clause 10 focuses on addressing weaknesses and driving continual improvement.

It requires:

• Identification of nonconformities
• Corrective action processes
• Evidence of continual improvement

Auditors will examine how nonconformities are identified, investigated and resolved, paying close attention to whether root causes have been properly analysed. In accredited audits, repeated issues without clear root-cause analysis or effective corrective action are common findings.

Continual improvement does not mean achieving perfection. Instead, it requires clear evidence that the organisation learns from issues, takes structured corrective action and strengthens the ISMS over time.

Get ISO 27001 certified with confidence

If you are ready to move forward with ISO 27001, we can help. At Tempo Audits, we are a UKAS-accredited certification body built for modern tech companies. We understand SaaS, cloud systems and how fast-moving teams work.

You will work directly with experienced auditors who give clear guidance, honest feedback and a smooth audit process. Get a free quote today.

Annex A controls - How they relate to certification

Annex A is mandatory to consider, but it is not mandatory to implement in full. The 2022 version contains 93 controls, grouped into 4 domains:

• Organisational – Governance, policies and supplier security
• People – Screening, awareness and disciplinary processes
• Physical – Premises and environmental protection
• Technological – Access control, encryption and system security

Annex A draws from ISO/IEC 27002 and acts as the reference list for your Statement of Applicability (SoA).

Controls are selected based on risk. For example,

• A cloud-native SaaS company may justify physical data centre controls as not applicable if it does not operate infrastructure.
• A business with no mobile workforce may treat mobile device controls as low relevance.
• A startup with no contractors may have limited supplier-related controls initially.

During audits, certification bodies check that all 93 controls were considered, that exclusions are justified, and that selected controls operate effectively.

Mandatory ISO 27001 documentation checklist

The following documents are non-negotiable for ISO 27001 certification. Without them, certification is not possible.

Core ISMS documentation

ISMS scope statement

• Defines boundaries and applicability
• Clarifies what is included and excluded

Information security policy

• Approved by senior management
• Sets overall direction and commitment

Risk assessment methodology

• Defines how risks are identified, analysed and evaluated
• Includes risk acceptance criteria‍

Risk assessment (Current version)

• Identified assets, threats and vulnerabilities
• Risk ratings and risk owners

Risk treatment plan

• How risks are addressed
• Controls selected, responsibilities and timelines

Statement of Applicability (SoA)

• Lists all 93 Annex A controls
• Applicability decision for each control
• Justification for inclusion or exclusion
• Implementation status

Information security objectives and metrics

• Measurable security objectives
• Monitoring approach

Mandatory process records (Evidence of operation)

Internal Audit Programme and Reports

• Audit schedule
• Audit findings and outcomes
• Evidence of follow-up actions

‍Management review records

• Performance evaluation
• Audit and incident review
• Decisions and resource allocation

‍Corrective action log

• Nonconformities identified
• Root cause analysis
• Actions taken and effectiveness verification

Supporting policies and procedures

(Required where applicable based on your SoA)

• Access control
• Asset management
• Change management
• Backup and recovery
• Logging and monitoring
• Incident management
• Supplier security
• Business continuity
• Legal and regulatory register

Operational evidence

• User access reviews and joiner/leaver records
• Training and awareness records
• Vulnerability scan and patch records
• Backup logs and restoration tests
• Change approvals and deployment records
• Security event logs and incident records

Certification bodies will not only check that documents exist, but that they are current, controlled and actively used.

ISO 27001 audit process in the UK and Europe

Certification follows a structured, evidence-based process. In the UK or Europe, this typically involves internal audits, a two-stage external audit, and ongoing surveillance by a UKAS-accredited or other accredited certification body

1. Internal audit

Before certification, you must conduct internal audits at planned intervals. These audits assess whether your ISMS conforms to ISO 27001 and whether it operates effectively in practice.

Auditors will expect to see:

• A defined internal audit programme
• Audit reports with findings
• Evidence that issues were addressed
• Evidence of the competence of the internal auditor (typically evidence of experience with ISO 27001 or some other ISO 27001 qualification)

Internal audits are not optional preparation exercises. They are mandatory ISO 27001 requirements and form part of the evidence reviewed during certification.

2. Stage 1 audit - Readiness and documentation review

Stage 1 focuses on documentation and overall readiness.

At this stage, auditors review:

• ISMS scope
• Policies and procedures
• Risk assessment and treatment
• Statement of Applicability
• Internal audit and management review records

The objective is to confirm that the mandatory ISMS framework is in place and that the organisation is prepared for Stage 2. Any gaps identified must be addressed before proceeding.

At Tempo Audits, Stage 1 is conducted remotely by default. The audit plan is shared in advance, including the schedule, key focus areas and requested evidence. Also, where documentation is well organised, much of the review can be conducted asynchronously, reducing disruption.

3. Stage 2 audit - Implementation and evidence testing

Stage 2 tests whether your ISMS works in practice.

This involves:

• Evidence sampling
• Control testing
• Interviews across departments
• Review of operational records

The focus shifts from documented intent to real-world implementation. Auditors assess whether controls are operating, risks are managed, and processes are followed consistently.

At the end of Stage 2, nonconformities (if any) are presented immediately, allowing corrective actions to begin without delay.

Working with a UKAS-accredited certification body

In the UK or Europe, organisations seeking recognised ISO 27001 certification use certification bodies accredited by the United Kingdom Accreditation Service (UKAS) or other reputable accreditation bodies, as this ensures independent oversight and broad market acceptance.

UKAS requires certification bodies to demonstrate:

• Independence / Impartiality – Auditors cannot consult on the ISMS they certify
• Auditor competence – Auditors must be qualified and sector-competent, following a rigorous competence framework
• Ongoing surveillance – Annual surveillance audits after certification
• Recertification – A full reassessment typically every 3 years

During audits, findings are classified as:

• Minor nonconformities – isolated gaps that do not undermine the ISMS.
• Major nonconformities – significant failures that prevent certification until resolved.

Certification is granted only once major nonconformities are closed and corrective actions are accepted. This structured approach ensures ISO 27001 certification in the UK is consistent, credible and independently verified.

Typical audit flow

If you are preparing for certification, our pre-audit FAQs provide practical answers to common audit questions and what to expect before Stage 1.

What causes ISO 27001 certification suspension or withdrawal | Maintaining your certification

ISO 27001 certification is not permanent. It can be suspended or withdrawn if the ISMS is no longer maintained or if audit obligations are not met.

The most common cause is major nonconformities during surveillance audits. Examples include:

• Failing to update risk assessments,
• Not conducting internal audits or management reviews,
• Critical controls such as backups not operating, or
• Widespread non-compliance with your own policies.

If major issues are not resolved within the agreed timeframe, certification may be withdrawn.

Administrative failures also trigger suspension, such as

• Repeatedly postponing audits,
• Denying access to evidence, or
• Non-payment of certification fees.

Less common but serious causes include fraudulent evidence or misrepresentation.

Therefore, maintaining certification requires ongoing audits, active ISMS management, timely corrective action and open communication with your certification body.

How Tempo Audits supports ISO 27001 readiness

At Tempo Audits, we are built specifically for technology companies. Over 200 organisations, primarily SaaS and cloud-native businesses across Europe, have achieved ISO 27001 certification with us.

We understand how modern tech teams operate, including DevOps workflows, cloud-native infrastructure and continuous deployment environments.

Our founder, Rob Hall, is an experienced tech entrepreneur who created Tempo after seeing how poorly traditional certification bodies served fast-moving technology businesses. We are not a side service within a larger firm. We are a purpose-built, UKAS-accredited certification body that speaks your language.

What this means for you

‍

This approach ensures rigorous certification without unnecessary complications.

‍