/certification-roadmap

description: Generate ISO 27001 certification roadmap from readiness through surveillance audits

ISO 27001 Certification Roadmap

Generates a comprehensive roadmap for achieving and maintaining ISO 27001:2022 certification, including gap remediation, ISMS documentation, Stage 1 and Stage 2 audits, and ongoing surveillance requirements.

Usage

/iso:certification-roadmap [target-date] [options]

Arguments

• `$1` - Target certification date (optional): "2025-12-31" or "12-months" (default: "12-months")
• `$2` - Options (optional): `--current-maturity=low|medium|high`, `--scope=cloud-only|hybrid`, `--fast-track`

Examples

# Standard 12-month roadmap
/iso:certification-roadmap 12-months

# Aggressive 6-month fast-track
/iso:certification-roadmap 6-months --fast-track

# Specific target date with current state
/iso:certification-roadmap 2025-09-30 --current-maturity=medium

# Cloud-only scope (simpler)
/iso:certification-roadmap 12-months --scope=cloud-only

Output

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
ISO 27001:2022 CERTIFICATION ROADMAP
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Organization: Your Company, Inc.
Start Date: February 2025
Target Certification: January 2026 (12 months)
Scope: Cloud infrastructure and SaaS application
Current Maturity: Medium (some controls implemented)
Certification Body: TBD (select by Month 3)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
CERTIFICATION PROCESS OVERVIEW
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Timeline: 12 months total
  - Months 1-3:   Gap analysis and planning (Readiness)
  - Months 4-9:   Implementation and ISMS operation (Build & Operate)
  - Month 10:     Stage 1 audit (Document review)
  - Month 11:     Stage 2 audit (On-site assessment)
  - Month 12:     Certification issuance
  - Ongoing:      Annual surveillance audits

Total Estimated Cost: $95,000 - $145,000
  - Internal effort: $55,000 - $85,000 (550-850 hours @ $100/hour)
  - External costs: $40,000 - $60,000 (certification body, consultants)

Key Milestones:
  ✓ Month 3:  Gap remediation complete, ISMS documented
  ✓ Month 6:  3 months of ISMS operation (minimum required)
  ✓ Month 9:  6 months operation, evidence collected
  ✓ Month 10: Stage 1 audit passed
  ✓ Month 11: Stage 2 audit passed
  ✓ Month 12: Certificate received

Success Factors:
  - Executive management commitment and sponsorship
  - Dedicated ISMS owner (30-50% time commitment)
  - Cross-functional team involvement
  - Budget approved ($95k-$145k)
  - Realistic timeline (12+ months for first-time certification)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
MONTH 1-2: GAP ANALYSIS & PLANNING (Readiness Assessment)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Objectives:
  - Understand current state vs. ISO 27001 requirements
  - Identify gaps in controls, policies, and procedures
  - Develop remediation plan with priorities
  - Secure budget and resources

Week 1-2: Initial Assessment
  □ Conduct ISO 27001 readiness assessment
    Command: /iso:assess full --output=detailed
    Output: Gap analysis report with 93 Annex A controls

  □ Define ISMS scope
    Questions to answer:
      - What systems and processes are in scope?
      - What data do we protect (customer data, IP, etc.)?
      - What locations (cloud regions, offices)?
      - What organizational boundaries?

    Example Scope Statement:
      "The ISMS covers all systems and processes used to provide the
       [Product Name] SaaS application to customers, including AWS
       infrastructure in us-east-1 and us-west-2 regions, application
       development, and customer support operations. Excluded from scope:
       marketing website (separate infrastructure), mobile app (separate
       audit), corporate office IT (no customer data)."

  □ Identify key stakeholders
    - ISMS Owner: CISO (overall responsibility)
    - Implementation Team: Security, IT, DevOps, Legal, HR
    - Management Rep: CFO or COO (executive sponsor)
    - Internal Auditor: Internal audit or external consultant

Week 3-4: Planning & Prioritization
  □ Analyze gap assessment results
    - Categorize gaps: Critical, High, Medium, Low
    - Estimate effort and cost per gap
    - Identify dependencies

  □ Create implementation roadmap
    Command: Generate remediation plan from gaps
    Output: Prioritized list of controls to implement

  □ Define success criteria
    - 100% of applicable Annex A controls implemented
    - All mandatory ISMS documentation complete
    - 3+ months of evidence collection
    - Zero critical findings in Stage 1 audit

  □ Select certification body (start RFP process)
    Top Certification Bodies:
      - BSI Group (British Standards Institution)
      - NQA (National Quality Assurance)
      - LRQA (Lloyd's Register Quality Assurance)
      - DQS Inc
      - SGS

    Selection Criteria:
      - Accreditation (ANAB, UKAS, etc.)
      - Experience with cloud/SaaS companies
      - Geographic coverage
      - Cost ($25k-$40k for initial certification)
      - Timeline (can they meet your target date?)

    RFP Questions:
      - What is your audit process and timeline?
      - How many audit days required? (Typically 3-5 days Stage 2)
      - Do you charge for travel/expenses?
      - What is included in surveillance audits?
      - References from similar clients?

Deliverables:
  ✓ Gap analysis report (detailed findings)
  ✓ ISMS scope statement (approved by management)
  ✓ Implementation roadmap (12-month plan)
  ✓ Budget approval ($95k-$145k)
  ✓ Certification body RFP (responses due Month 3)

Effort: 120 hours (2-3 people full-time for 1 month)
Cost: $12,000 internal + $5,000 external (optional consultant)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
MONTH 3-4: POLICY DEVELOPMENT & DOCUMENTATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Objectives:
  - Create all mandatory ISMS documentation
  - Develop policies and procedure