An ISMS ISO 27001 audit does not certify your firewall, your policies or a list of controls in isolation. It certifies your ISMS (Information Security Management System): the management system that decides which information risks you treat, how you treat them, and how you prove that protection keeps working. Most delayed certifications come from treating the ISMS as a document pack instead of a running system. This guide explains what an ISMS is, exactly what the auditor checks at Stage 1 and Stage 2, which documents are mandatory, the most frequent nonconformities and why, in Belgium, the ISO 27001 audit has become a NIS2 milestone as much as a certification.
Key takeaways
- An ISMS = clauses 4 to 10 of ISO/IEC 27001:2022 (the management system) + the Annex A controls you select in your Statement of Applicability (93 controls, 4 themes).
- The certification audit has two stages: Stage 1 (design and documentation readiness) and Stage 2 (implementation and effectiveness).
- Before Stage 2 you need at least one completed internal audit (9.2) and management review (9.3): the ISMS must have run, not just been written.
- A certificate is valid 3 years, with yearly surveillance audits and a recertification audit. ISO 27001:2013 certificates expired on 31 October 2025.
- In Belgium, ISO 27001 is one of the two CCB-recognised NIS2 conformity routes for essential entities, and the CCB has scope rules of its own.
What is an ISMS in ISO 27001?
An ISMS (Information Security Management System, SMSI in French) is the set of policies, processes, roles, risk decisions and records an organisation uses to protect the confidentiality, integrity and availability of its information, and to improve that protection continuously. ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an ISMS. It is the only standard of the ISO 27000 family you can be certified against; ISO/IEC 27002 is implementation guidance for the controls, not a certifiable standard.
The distinction matters for the audit. Annex A controls (access control, backups, logging, supplier security…) are the what. The ISMS is the how you decide, run, measure and improve. An organisation can have excellent technical controls and still fail certification because nobody can show why those controls were chosen, who accepted the remaining risk, or whether anyone checks that they work. ISO 27001 uses the same harmonised structure as ISO 9001, ISO 22301 and ISO/IEC 42001 (AI management systems), which is why an ISMS is also a solid foundation for AI governance.
The ISMS structure: clauses 4 to 10
| Clause | Requirement | What the auditor looks for |
|---|---|---|
| 4. Context | Internal/external issues, interested parties, ISMS scope | Regulators (CCB for NIS2, NBB/FSMA for DORA, the Data Protection Authority for GDPR) and clients identified; a scope that matches reality. Since Amendment 1 (2024), climate change must be considered. |
| 5. Leadership | Commitment, policy, roles and responsibilities | Top management visibly involved, policy approved, an accountable ISMS owner. |
| 6. Planning | Risk assessment and treatment, SoA, objectives, planning of changes | A repeatable risk method, named risk owners, measurable objectives. |
| 7. Support | Resources, competence, awareness, communication, documented information | Training records, controlled documents, people who know the policy applies to them. |
| 8. Operation | Executing the risk treatment plan, operational control | Evidence that planned controls actually run (tickets, logs, reviews). |
| 9. Performance evaluation | Monitoring and measurement, internal audit, management review | KPIs that are reviewed, an impartial internal audit, a documented management review. |
| 10. Improvement | Continual improvement, nonconformity and corrective action | Root-cause analysis and corrective actions whose effectiveness is checked. |
What does an ISO 27001 audit actually check?
An ISO 27001 audit checks two layers: the management system (clauses 4 to 10, all mandatory, no exclusion possible) and the Annex A controls you declared applicable in your Statement of Applicability. Annex A of the 2022 version contains 93 controls grouped in four themes: organisational (37, A.5), people (8, A.6), physical (14, A.7) and technological (34, A.8).
The Statement of Applicability (SoA), required by clause 6.1.3 d), is the hinge between the two. It lists every Annex A control, whether it is included, why, whether it is implemented, and why any excluded control is excluded. Exclusions are allowed, but only when your risk assessment, legal obligations or business context justify them.
In practice, a good auditor follows an audit trail: risk → treatment decision → control in the SoA → evidence in operation. They pick a risk from your register (for example, ransomware on the ERP), check that its owner approved the treatment, find the related controls in the SoA (backups A.8.13, malware protection A.8.7, vulnerability management A.8.8), then ask for proof that those controls run: a restore test report, the endpoint console, the last patch cycle. If any link of that chain is missing, there is a finding.
Mandatory documents for an ISO 27001 audit
ISO 27001 explicitly requires the documented information below. Use the third column as a self-test: it is the question the auditor will implicitly ask about each document.
| Clause | Documented information | The auditor’s test question |
|---|---|---|
| 4.3 | ISMS scope | Does it match the real sites, teams, cloud services and outsourced IT? |
| 5.2 | Information security policy | Approved by top management and communicated? |
| 6.1.2 | Risk assessment process, incl. acceptance criteria | Would two assessors reach comparable results? |
| 6.1.3 | Risk treatment process | Are risk owners named, and did they approve the residual risk? |
| 6.1.3 d) | Statement of Applicability | Is every inclusion and exclusion justified, with implementation status? |
| 6.2 | Information security objectives | Measurable, owned, dated and tracked? |
| 7.2 | Evidence of competence | Can key roles prove their skills (training, experience, certifications)? |
| 8.1 | Operational planning and control | Were processes carried out as planned? |
| 8.2 / 8.3 | Risk assessment and risk treatment results | Dated, repeated at planned intervals and after significant changes? |
| 9.1 | Monitoring and measurement results | Are KPIs actually analysed and acted upon? |
| 9.2 | Internal audit programme and results | Full scope covered, by someone who did not audit their own work? |
| 9.3 | Management review results | Were all required inputs covered and decisions recorded? |
| 10.2 | Nonconformities and corrective actions | Was the root cause found and the fix verified? |
The Annex A controls you select add their own records: asset inventory (A.5.9), access control rules (A.5.15), supplier agreements (A.5.20), incident management (A.5.24 to A.5.28), the register of legal and regulatory requirements (A.5.31), documented operating procedures (A.5.37), logs (A.8.15) and more. Keep documents short and controlled (clause 7.5: versioned, approved, available); auditors value evidence that a process runs far more than a thick policy.
The ISO 27001 certification audit cycle, step by step
ISO 27001 certification follows a three-year cycle run by an independent certification body: an initial audit in two stages, surveillance audits in years one and two, and a recertification audit in year three. The ISMS must already have produced its first internal audit and management review before the external audit starts.
| Audit | When | Focus |
|---|---|---|
| Internal audit + management review | Before Stage 1/Stage 2 | Prove the ISMS has run at least one full cycle |
| Stage 1 | Start of certification | Design, documentation and readiness for Stage 2 |
| Stage 2 | Typically a few weeks after Stage 1 | Implementation and effectiveness of the ISMS and controls |
| Surveillance audits | At least once per calendar year (first within 12 months of certification) | Sample of clauses and controls; follow-up of previous findings |
| Recertification audit | Before the 3-year certificate expires | Full ISMS performance over the cycle |
Who audits you? A certification body accredited to ISO/IEC 17021-1 and ISO/IEC 27006-1, which also determines how many audit days are needed based on the number of people in scope and the complexity of the ISMS. In Belgium the national accreditation body is BELAC; certificates issued under other IAF-recognised accreditation bodies (RvA, DAkkS, COFRAC…) are also recognised, and the CCB publishes a list of conformity assessment bodies for NIS2. Independence is strict: the consultant who helped build your ISMS cannot be your certification auditor, and the certification body cannot consult. That is why ICTLAB prepares and accompanies organisations, but never certifies them.
Stage 1 vs Stage 2: what the auditor checks
Stage 1 answers “is this ISMS ready to be audited?” and Stage 2 answers “does this ISMS work?”. Issues raised at Stage 1 are areas of concern to fix before Stage 2; if they are still open at Stage 2, they usually become nonconformities.
| Stage 1 | Stage 2 | |
|---|---|---|
| Objective | Readiness: is the ISMS designed and documented as the standard requires? | Conformity and effectiveness: are the ISMS and controls implemented and working? |
| Evidence | Scope, context, risk method, SoA, policy, objectives, internal audit and management review | Records, samples, system screenshots, observation, staff interviews across departments |
| Who is interviewed | ISMS manager, management, key document owners | Management, IT, HR, operations, suppliers’ interfaces, end users |
| Typical outcome | Readiness report with areas of concern, Stage 2 plan | Recommendation (or not) for certification, nonconformity report |
| Duration | Short, often one to two days, sometimes remote | Longer, computed from headcount in scope and complexity |
Nonconformities: major, minor and opportunities for improvement
Auditors grade findings in three levels. How you respond, through clause 10.2, matters as much as the finding itself.
- Major nonconformity: a requirement is not met at all, or a breakdown puts the ISMS outcomes in doubt (no internal audit, no management review, a risk assessment never performed). It blocks certification until the certification body accepts your correction and corrective action.
- Minor nonconformity: an isolated lapse (one leaver whose account was disabled late, one supplier without a security assessment). An accepted corrective action plan is enough; it is verified at the next audit. Several minors on the same requirement can be escalated to a major.
- Observation / opportunity for improvement: no requirement breached, but a weakness worth fixing. Ignoring it is how next year’s minor is born.
A sound response has four parts: correction (fix the instance), root-cause analysis(why did the process allow it?), corrective action (change the process so it cannot recur) and an effectiveness check. “We re-trained the employee” is rarely accepted as a root cause.
The 10 most frequent ISMS audit findings
These are the findings that recur most often in ISO 27001 audits, with the clause or control they relate to. Each one is cheaper to fix before Stage 1 than after Stage 2.
- A scope that does not match reality (4.3): cloud platforms, outsourced IT or a second site silently left out.
- A non-repeatable risk assessment (6.1.2): no acceptance criteria, no defined scales, results that depend on who fills in the spreadsheet.
- Residual risk never accepted (6.1.3 f): risk owners not identified or not signing off.
- A copy-paste SoA (6.1.3 d): every control “implemented”, no justification, no link to risks.
- Objectives that cannot be measured (6.2, 9.1): “improve security” instead of a dated, owned metric.
- An internal audit that is not impartial or complete (9.2): the ISMS manager auditing their own work, or half the scope never audited.
- A management review without the required inputs (9.3): no review of audit results, risk status or objectives; top management absent.
- Supplier and cloud security not evidenced (A.5.19 to A.5.23): no assessment of key SaaS providers, no security clauses in contracts.
- Access reviews and leaver process gaps (A.5.15 to A.5.18): reviews planned but not performed, active accounts of former staff.
- Vulnerability and incident processes on paper only (A.8.8, A.5.24 to A.5.28): scans without remediation tracking, an incident plan never tested. See our vulnerability scanning vs pentesting guide and incident response plan template.
ISMS audits in Belgium: NIS2, CCB, DORA and GDPR
In Belgium, an ISO 27001 audit is no longer only a commercial certificate: it is one of the recognised ways to demonstrate NIS2 conformity, and a strong evidence base for DORA and GDPR. The scope you choose must therefore fit the regulatory purpose, not only the sales argument.
NIS2: ISO 27001 as a CCB conformity route
Under the Belgian NIS2 law of 26 April 2024, applicable since 18 October 2024, essential entitiesmust undergo regular conformity assessment. The Centre for Cybersecurity Belgium (CCB) recognises two routes: CyberFundamentals (CyFun®) certification or ISO/IEC 27001 certification. For the ISO route, the CCB expects the scope to cover the organisation and its NIS2-relevant services; environments can only be excluded when IT/OT separation is demonstrable and documented, with proof that the excluded part has no impact on the risks inside the scope. The first milestone (18 April 2026, when entities following the ISO route had to share their scope, SoA and latest internal audit with the CCB) has passed; the next one is 18 April 2027. Confirm your exact obligations with the CCB. Important entities are not required to certify but can do so voluntarily to benefit from a presumption of conformity. For the full mapping, read NIS2 and ISO 27001 in Belgium.
DORA: an ISMS is the backbone, not the finish line
For banks, insurers and other financial entities, ISO 27001 is not a DORA compliance certificate. A working ISMS, however, provides most of the machinery the ICT risk-management framework (DORA Art. 5 to 16) needs: governance, risk assessment, asset inventory, incident handling. You then add DORA-specific layers such as the register of information, incident classification and resilience testing. See our guide to DORA for Belgian financial institutions.
GDPR: evidence of “appropriate measures”
GDPR Art. 32 requires “appropriate technical and organisational measures” without saying which. An ISMS that includes personal data in its risk assessment turns that vague duty into documented, audited decisions, which is exactly what the Data Protection Authority asks for after a breach. More in GDPR vs NIS2.
Getting audit-ready: a 90-day plan before Stage 1
This plan assumes your core policies and technical controls already exist. Starting from scratch, an SME should plan for several months (commonly six to twelve) before Stage 1, starting with an ISO 27001 gap analysis.
- Weeks 1 to 3, frame: confirm the scope with the regulatory purpose in mind (NIS2 services, DORA functions), list interested parties and legal requirements, fix the risk methodology and acceptance criteria.
- Weeks 3 to 6, decide: run the risk assessment, build the treatment plan, write the SoA with real justifications, get risk owners to accept residual risk.
- Weeks 6 to 10, operate and record: perform access reviews, awareness sessions, supplier assessments, vulnerability remediation and an incident exercise, and keep the evidence.
- Weeks 10 to 12, evaluate: run an impartial internal audit over the full scope, hold the management review, open corrective actions, then book Stage 1.
How ICTLAB helps you pass your ISMS audit
ICTLAB’s ISO 27001 practice is led by Caner Korkut, ISO 27001 Lead Implementer. We work on the regulatory angle first: a scope that holds for NIS2 and DORA, a risk method your team can repeat, and evidence an auditor can sample. Concretely, we deliver the gap analysis, ISMS design, risk assessment and SoA, the technical controls (from penetration testing to cloud hardening), a mock Stage 1 review, and support during the certification audit and corrective action plans. See our ISO 27001 certification support and security audit services, or book a readiness call.
ISMS and ISO 27001 audit: frequently asked questions
What is the difference between an ISMS and ISO 27001?
An ISMS (Information Security Management System) is the system itself: the policies, processes, roles, risk decisions and records an organisation uses to manage information security. ISO/IEC 27001 is the international standard that sets the requirements an ISMS must meet. You do not certify ISO 27001; you certify your ISMS against ISO 27001.
What is the difference between an ISO 27001 Stage 1 and Stage 2 audit?
Stage 1 checks whether the ISMS is designed and documented well enough to be audited: scope, risk methodology, Statement of Applicability, internal audit and management review. Stage 2 is the certification audit itself: the auditor samples evidence, interviews staff and tests whether the controls are implemented and effective in day-to-day operations.
Is an internal audit mandatory before ISO 27001 certification?
Yes. Clause 9.2 requires an internal audit programme, and clause 9.3 a management review. Certification bodies expect at least one complete internal audit covering the full scope and one management review to have taken place before Stage 2. Missing either is one of the most common reasons a certification is delayed.
How long is an ISO 27001 certificate valid?
Three years. During that cycle the certification body performs surveillance audits at least once per calendar year (the first within 12 months of the certification decision), then a recertification audit before the certificate expires. ISO/IEC 27001:2013 certificates are no longer valid since 31 October 2025; all audits now use the 2022 version.
Which documents are mandatory for an ISO 27001 audit?
The core documented information is: ISMS scope (4.3), information security policy (5.2), risk assessment and treatment processes (6.1.2, 6.1.3), Statement of Applicability (6.1.3 d), security objectives (6.2), evidence of competence (7.2), operational planning records (8.1), risk assessment and treatment results (8.2, 8.3), monitoring results (9.1), internal audit programme and results (9.2), management review results (9.3) and nonconformities with corrective actions (10.2).
Does ISO 27001 certification make you NIS2 compliant in Belgium?
It can be your conformity route, but not automatically. In Belgium, essential entities can demonstrate NIS2 conformity through CyberFundamentals or ISO/IEC 27001 certification. For the ISO route, the CCB requires the scope to cover the organisation and its NIS2 services, with exclusions only for demonstrably separated IT/OT environments. A narrow certificate obtained for commercial reasons may not be accepted.
What happens if the auditor finds a major nonconformity?
A major nonconformity (a requirement not met, or a breakdown that puts the ISMS outcomes in doubt) blocks the certification decision. You must correct it, analyse the root cause and implement a corrective action, and the certification body must accept the evidence, sometimes through a follow-up visit, within the deadline it sets. Minor nonconformities only require an accepted corrective action plan.
General information based on ISO/IEC 27001:2022 (incl. Amendment 1:2024), ISO/IEC 17021-1, ISO/IEC 27006-1 and the Belgian NIS2 framework as published by the CCB; not legal advice. Certification bodies and the CCB may apply specific rules and timelines, so verify them for your situation.