Why is ISO 27001 needed?
ISO/IEC 27001 is an international information security management standard (ISMS). For Kazakhstani organizations, certification increases partners’ trust, ensures compliance with regulatory requirements, and systematizes information security risk management.
Implementation roadmap
Stage 1: GAP analysis (2-4 weeks)
Assessment of the current information security state in relation to the standard’s requirements. Identification of discrepancies and development of a remediation plan.
Stage 2: Risk Assessment (3-4 weeks)
Identification of information assets, threats, and vulnerabilities. Assessment of probability and potential damage. Development of a risk treatment plan.
Stage 3: Documentation Development (4-6 weeks)
Information Security Policy, procedures, regulations, Statement of Applicability (SoA). The documentation must reflect the organization’s actual processes.
Stage 4: Implementation (8-12 weeks)
Implementation of technical and organizational measures. Staff training. Implementation of monitoring and incident management processes.
Stage 5: Internal audit (2-3 weeks)
Verification that the implemented QMS complies with the standard requirements. Identification and elimination of non‑conformities prior to the certification audit.
Stage 6: Certification audit
Two‑stage audit by an accredited certification body. Stage 1 — documentation review, stage 2 — on‑site inspection.
The average time from the start of a project to obtaining ISO 27001 certification is 6 to 12 months, depending on the size and maturity of the organization.
