ISO 27001 Readiness vs Certification: What Is the Difference?

Readiness work prepares the organisation; certification is the formal third-party decision performed by the certification body.

Published 2026-09-03 · Tech Turn Technology

The short version

ISO 27001 readiness is the work an organisation performs to establish, operate, review and improve its ISMS before certification. Certification is the formal third-party process performed by a certification body. A consultant can help define scope, assess gaps, build controls, organise evidence and support remediation. That does not make the consultant the certification body.

What readiness includes

A credible readiness programme normally covers ISMS scope, context, policies, risk assessment, risk treatment, the Statement of Applicability, control ownership, evidence, internal audit, management review and corrective action. Technical controls also need evidence that they are operating, not merely configuration screenshots taken once.

What certification adds

The certification body evaluates whether the ISMS meets the applicable requirements and whether controls are implemented and operating within the defined scope. Stage 1 generally focuses on readiness and documented foundations. Stage 2 evaluates implementation and effectiveness more deeply. Findings must be addressed according to the certification process.

Why the distinction matters commercially

If a consulting firm sells the idea that its own readiness report is an ISO certificate, the buyer is being misled. The useful promise is narrower and stronger: identify what is weak, help fix it, make the evidence defensible, and support the client through the independent certification process.

When to start with a gap assessment

Start with a gap assessment when leadership cannot answer how mature the current ISMS is, what evidence exists, or which deficiencies will block certification readiness. A bounded assessment is usually more useful than immediately purchasing a large implementation project.