ISO 27001 Implementation: Steps and Timeline

Last updated: 16 October 2026

Quick Answer: An illustrative ISO 27001 implementation plan for a mid-size company runs 6 to 12 months in six phases, ending with internal audit and management review. Scope, sites and the maturity of existing IT controls set where a company falls in that range. An accredited certification body then audits the working system in two stages.

For a mid-size manufacturer, ISO 27001 implementation often starts when a customer contract, an export buyer or a group parent asks for it. The task is to build a management system, not to buy tools: a scope, a risk process, chosen controls and records that prove they run.

What Does ISO/IEC 27001:2022 Require a Company to Build?

An information security management system (ISMS) that meets every requirement in clauses 4 to 10, with controls chosen through risk assessment. The requirements of ISO/IEC 27001:2022 let no company claiming conformity exclude any of those clauses. Annex A, by contrast, is a reference list of controls. Amendment 1 of 2024 adds climate action changes to the 2022 edition.

• Clause 4, context: issues, interested parties and the ISMS scope.
• Clause 5, leadership: commitment, the security policy and roles.
• Clause 6, planning: risk assessment, risk treatment and objectives.
• Clause 7, support: resources, competence, awareness, communication and documents.
• Clause 8, operation: carrying out the plans, including risk treatment.
• Clause 9, performance evaluation: monitoring, internal audit and management review.
• Clause 10, improvement: continual improvement and corrective action.

The standard says clause order does not imply implementation order, so the project plan sets the steps.

ISO 27001 Implementation Steps for a Mid-Size Company

Ten steps lead from a board decision to an internally audited ISMS (clauses of ISO/IEC 27001:2022 in brackets).

1. Secure the mandate. The MD names an ISMS lead and commits time from the IT, HR, plant and finance heads (5.1, 5.3).
2. Set context and scope. List interested parties and define the sites and systems covered (4.1 to 4.3).
3. Approve the policy. Top management signs an information security policy and sets information security objectives (5.2, 6.2).
4. Assess risks. Agree how likelihood, impact and acceptable risk are judged, then assess risks to information in scope (6.1.2).
5. Treat risks. Choose controls, check them against Annex A, and record a risk treatment plan and a Statement of Applicability (6.1.3).
6. Implement. Write procedures, close technical gaps and add security terms to supplier contracts (7.5, 8.1, 8.3).
7. Train. Build competence in control owners and awareness in everyone else (7.2, 7.3).
8. Operate and measure. Run the controls, keep records such as ERP access reviews, and measure the objectives (9.1).
9. Audit internally. Auditors who did not build the area test whether the ISMS works (9.2).
10. Review and correct. Management reviews the results; each nonconformity is corrected, its causes are found and corrective action is taken where needed (9.3, 10.2).

How Long Does ISO 27001 Implementation Take?

For a company with one or two sites and a central ERP, an illustrative plan runs 6 to 12 months. The range is a planning figure, not a requirement or a promise.

The operating period cannot be rushed. STQC, the certification directorate of the Ministry of Electronics and Information Technology, states in its published ISMS assessment procedure that stage 1 checks that at least one complete cycle of internal audit and management review, covering the entire scope, is already done.

What moves a company within that range?

• Scope: one office, or every plant and the ERP.
• Maturity: existing access reviews, tested backups and an asset register save weeks.
• Technical gaps: logging or network segregation may need purchase lead time.
• People time: control owners also run production and the month-end close.

How Should a Manufacturer Draw the ISMS Scope?

Around the information customers and the business most need protected, with boundaries an auditor can test. For manufacturers in sectors such as textiles, engineering and dairy, five questions decide the scope:

• Sites: the head office alone, or every plant and warehouse.
• ERP: purchasing, production, sales and payroll records.
• Design data: drawings and buyer technical packs shared with job workers.
• Shop-floor systems: shared terminals, weighbridge software and attendance devices.
• Suppliers: the ERP partner, hosting and outsourced IT support.

A narrower scope is quicker, but customers check that it covers what they buy. Illustrative example: a Coimbatore pump maker scopes its design office and ERP but not the foundry, so it must show how drawings sent there stay protected.

Risk Assessment, Annex A and the Statement of Applicability

Risk assessment decides which controls the company needs, and the Statement of Applicability records that decision against Annex A. The ISO/IEC committee's journal notes that Annex A does not say how a control is implemented.

How are Annex A controls grouped?

Annex A is aligned with ISO/IEC 27002:2022, which groups controls into four themes:

What does the Statement of Applicability record?

It lists the necessary controls and records, for every Annex A control, whether it applies, why, and whether it is in place. Certification auditors review it with the risk treatment at stage 1, as STQC's published ISMS assessment procedure shows.

ISO 27001 Implementation Plan by Phase (Illustrative)

The ten steps group into six phases for a company with one or two sites. Durations are illustrative, overlap and depend on scope.

Where Does the DPDP Act Fit Into ISO 27001 Implementation?

As minimum safeguards the ISMS can carry, not as a certification requirement. Rule 6 of the Digital Personal Data Protection Rules, 2025 requires a Data Fiduciary to take reasonable security safeguards. They include encryption or masking, access control, monitored logs kept for one year unless another law requires otherwise, backups and contract terms with Data Processors.

ISO/IEC 27001 is not mentioned in the Rules. As of 16 October 2026, rule 6 is not in force: it commences eighteen months after publication on 13 November 2025, in May 2027. Until then, rule 8 of the Information Technology (Reasonable Security Practices) Rules, 2011 names IS/ISO/IEC 27001 as one standard for the reasonable security practices that section 43A of the IT Act requires, and CERT-In's April 2022 directions already require incident reports within 6 hours and 180 days of logs kept in India. Adding these safeguards to the risk assessment now lets one control set serve all three.

What Happens After Implementation: The ISO 27001 Certification Process

Certification is optional, and ISO itself certifies no one. An accredited certification body audits in two stages, documents and readiness first and then whether controls operate. A certificate runs on a three-year cycle with surveillance audits.

Should You Implement In-House or Engage a Consultant?

Either works if three roles stay separate: whoever builds the ISMS, the internal auditor who tests it and the certification body. In-house suits a company whose IT and internal audit teams have time; a consultant suits a first ISMS or a fixed customer deadline.

Clause 9.2 calls for auditors chosen to keep the audit objective and impartial, so ask any provider which areas its auditors helped design. A certification body should not consult on what it certifies: STQC's published IT certification policy, for example, bars any consultancy that could create a conflict of interest.

Astral Business Consulting LLP, a Coimbatore-based management consulting and audit firm, provides ISO 27001 ISMS implementation support from gap assessment to internal audit. Its services page lists ISMS gap assessment, IT risk assessment and mitigation plans, policies and procedures, facilitating ISMS implementation, and ISMS internal audits and management review meetings. It does not provide certification. Its team combines information systems auditors and engineers with Chartered Accountants.

Its ITGC audit services in Tamil Nadu test the access and backup controls that overlap with Annex A and with the ERP access rows of an internal audit checklist for manufacturing.

Planning an ISMS for Your Plants and Offices?

Write down what the ISMS must protect and where, then test current controls against the standard before fixing dates. To plan the project, contact Astral Business Consulting LLP about its information systems services.