Where the two stages come from
ISO 27001 says what an information security management system (ISMS) must contain. It does not say how a certification audit is run. That is set by the standards certification bodies are accredited against: ISO 17021-1, which applies to every management system certification, and ISO 27006-1:2024, which adds requirements specific to ISMS certification and replaced ISO 27006:2015. In Spain, certification bodies are accredited by ENAC against these standards.
Clause 9.3.1 of ISO 17021-1 splits the initial certification audit into two stages. The split has a practical purpose. Stage 1 lets the certification body understand the organisation well enough to plan Stage 2, and it gives the organisation a chance to fix weaknesses before they become formal findings.
The same two stages apply whatever the size of the organisation. What changes with size and complexity is the audit time, which ISO 27006-1 calculates from factors such as the number of people within scope, the number of sites and the complexity of the IT environment. A company of 40 people with one office and a cloud platform will have a much shorter audit than a group with several sites and on premises infrastructure, but it goes through exactly the same steps.
Accredited and non accredited certificates
Not every body that issues ISO 27001 certificates is accredited. Accreditation means a national accreditation body, ENAC in Spain, has assessed the certification body against ISO 17021-1 and ISO 27006-1 and keeps checking it. A certificate from an accredited body carries the accreditation mark and can be checked against the accreditation body's records and the IAF CertSearch database.
Customers and public sector buyers increasingly ask for an accredited certificate, because an unaccredited one gives no assurance that the two stage process was followed. Before signing with a certification body, it is worth confirming that its accreditation covers ISO 27001 and the sector in question.
Who is involved
The certification body appoints an audit team, led by a lead auditor who is responsible for the plan, the conduct of the audit and the report. Before each stage, the organisation receives an audit plan that sets out the dates, the areas or processes to be covered, the people the auditor wants to talk to and the language of the audit.
On the organisation's side, auditors expect to meet the person responsible for the ISMS, top management (at least for part of Stage 2), and the owners of the processes and controls being sampled: IT, HR, operations, procurement, development. An audit where only one person answers every question tells the auditor something about how the ISMS is run.
What Stage 1 reviews
Stage 1 is a readiness review. Under clause 9.3.1.2 of ISO 17021-1, the auditor's objectives include:
- Reviewing the documented information of the ISMS.
- Evaluating site specific conditions and talking to personnel to gauge how prepared the organisation is for Stage 2.
- Checking the organisation's understanding of the requirements of the standard.
- Confirming the scope, processes, locations and the legal and regulatory requirements that apply.
- Agreeing the details of Stage 2 and the resources it will need.
- Evaluating whether internal audits and management reviews are planned and performed, and whether the ISMS is implemented to a level that shows readiness for Stage 2.
The last point is where many first time candidates stall. ISO 27001 requires an internal audit (clause 9.2) and a management review (clause 9.3). If neither has happened, the auditor cannot conclude the system is ready, however complete the documentation looks.
The documents the auditor will ask for
ISO 27001 sets out the documented information the ISMS must hold. In Stage 1, the auditor typically works through these:
- The scope of the ISMS, including boundaries and interfaces with activities outside it (clause 4.3).
- The information security policy (clause 5.2).
- The risk assessment process and the results of the risk assessment (clauses 6.1.2 and 8.2).
- The risk treatment process, the risk treatment plan and its results (clauses 6.1.3 and 8.3).
- The Statement of Applicability, with the justification for including or excluding each Annex A control (clause 6.1.3).
- Information security objectives and how they are measured (clauses 6.2 and 9.1).
- Evidence of competence of the people doing ISMS work (clause 7.2).
- The internal audit programme and results (clause 9.2), and the management review results (clause 9.3).
- Records of nonconformities and corrective actions, if any have been raised internally (clause 10.2).
The Statement of Applicability gets particular attention, because it is the link between the risk assessment and the controls. An auditor will check that every excluded control has a reason connected to the risks and the scope, and that every included control traces back to a risk or a requirement.
Common Stage 1 findings
The concerns raised in Stage 1 follow familiar patterns:
- A scope that excludes something the business clearly depends on, such as the production platform or a development team, without explaining the interface.
- A risk assessment that cannot be repeated, because the method for scoring likelihood and impact is not written down. ISO 27001 requires the process to produce consistent, valid and comparable results. The mechanics are covered in our guide to the ISO 27001 risk assessment.
- A Statement of Applicability where exclusions say only "not applicable".
- Objectives with no measure, such as "improve security awareness".
- An internal audit that covered only part of the scope or part of the clauses.
- A management review held before the internal audit finished, so it could not consider its results.
Stage 1 is not a gap analysis. The impartiality rules in ISO 17021-1 prevent the certification body from advising on how to design or fix the ISMS. The auditor records what is missing; working out the remedy is the organisation's job.
The output is a documented set of findings, including any areas of concern that could be classified as nonconformities during Stage 2. Depending on the certification body and the scope, Stage 1 can take place on site, remotely, or both.
Between Stage 1 and Stage 2
The interval between the two stages is not fixed by the standard. ISO 17021-1 asks the certification body to set it taking into account the time the organisation needs to resolve the areas of concern raised in Stage 1. If Stage 1 surfaces significant changes, the certification body may also need to revise its plan for Stage 2.
How to use the interval
This window is where the remaining evidence gets built. Typical work includes:
- Completing a full internal audit cycle across the scope, if Stage 1 found it incomplete.
- Holding a management review that considers the internal audit results and the Stage 1 findings.
- Closing the documentation gaps Stage 1 identified, and recording why each change was made.
- Checking that every control marked as applicable in the Statement of Applicability has records showing it operates.
- Briefing the control owners the auditor is likely to interview, so they can explain their own process in their own words.
An organisation that treats the interval as waiting time tends to arrive at Stage 2 with the same concerns, now graded as nonconformities.
How much operating history is enough
ISO 27001 does not set a minimum period during which controls must have operated before certification. What the auditor needs is enough records to see that a control repeats as described. A quarterly access review needs at least one completed cycle, and ideally more. A monthly vulnerability scan with one report on file is a single data point, not a process.
That is why the interval is often planned backwards from the controls with the longest cycles. If a control runs quarterly, the organisation needs time for it to run, produce a record, and be acted on.
What Stage 2 tests
Under clause 9.3.1.3 of ISO 17021-1, the purpose of Stage 2 is to evaluate the implementation of the ISMS, including its effectiveness. Stage 1 asks whether the system is designed and ready. Stage 2 asks whether it works.
The auditor gathers evidence on conformity with every requirement of ISO 27001, on performance monitoring against the information security objectives, on operational control, and on internal audit, management review and management's responsibility for the policies.
How auditors sample
An auditor cannot check every record, so Stage 2 is built on sampling. The Statement of Applicability works as the map. For a sample of applicable controls, the auditor asks for records that show them operating over a period, for example:
- Access reviews completed, with the changes that followed.
- Backup restore tests, not only backup job logs.
- Change tickets showing approval before deployment.
- Training and awareness completion records.
- Supplier security assessments for suppliers in scope.
- Vulnerability findings with their remediation dates.
- Incident records, including events that were assessed and closed as not being incidents.
Auditors often pick samples themselves, from a list the organisation provides. If the auditor asks for the leavers from the last six months, then checks whether each one's accounts were removed on time, the sample shows whether offboarding works in practice, not just on paper.
Interviews and observation
Interviews test whether people know what the ISMS expects of them. An auditor might ask a developer how a change reaches production, an HR manager what happens on an employee's last day, or a manager how they would report a suspected incident. The answers are compared with the procedures. Gaps between what is written and what people describe are a common source of findings.
Observation covers what can be seen: a screen lock policy, a visitor log at reception, the configuration of a firewall rule or a cloud storage bucket.
Technical evidence in cloud environments
For companies that run on cloud platforms, much of the evidence is technical: identity provider settings, logging configuration, encryption at rest, network rules, backup policies. Auditors may ask for screenshots or exports, or ask someone to share their screen and show the configuration live. Exports taken from a tool on the day carry more weight than screenshots of unknown date, and evidence that shows a setting over time, such as a log of who changed it and when, carries more weight still.
A policy that says access is reviewed quarterly, with one review on file, tells the auditor the control is not operating as described. The detail of how auditors reason through this is covered in what a certification audit actually tests.
How nonconformities are graded and closed
ISO 17021-1 distinguishes two grades. A major nonconformity affects the capability of the management system to achieve its intended results. A minor nonconformity does not. Auditors may also record opportunities for improvement, which are not nonconformities and do not block certification.
Examples help, although the grade always depends on the evidence. No internal audit across the scope, or a risk assessment that was never carried out, would normally be major. So would a set of related failures that together show a control area is not working. A single missed access review in an otherwise working process would normally be minor.
For every nonconformity, the organisation must analyse the cause and describe the correction and corrective action within a time the certification body defines. For minor nonconformities, the certification body reviews the plan. For major nonconformities, it must verify that the correction and corrective action were effective before it can grant certification, which may mean a follow up visit.
Writing a corrective action plan that holds
Cause analysis matters here. A correction fixes the instance; a corrective action removes the reason it happened. Writing "access review completed" against a missed review fixes nothing if the review has no owner.
A plan the certification body can accept usually covers, for each finding:
- The finding as the auditor wrote it.
- The root cause, stated plainly: no owner, no reminder, a tool that was not configured, a procedure nobody knew existed.
- The correction, with its date.
- The corrective action that addresses the cause, with an owner and a date.
- How the organisation will check that the corrective action worked, for example by reviewing the next two cycles of the control.
The same structure is what ISO 27001 clause 10.2 expects for nonconformities the organisation finds itself, so the habit pays off well beyond the certification audit.
Who makes the certification decision
The audit team does not grant the certificate. The Stage 2 report includes a recommendation, and under clause 9.5 of ISO 17021-1 the decision is taken by a person or group within the certification body who was not involved in the audit. They review the report, the nonconformities and the evidence that they were addressed.
The certificate states the scope of the certified ISMS. ISO 27006-1 also requires the certification documents to reference the version of the Statement of Applicability, which is why a customer reviewing a supplier's certificate will often ask for the scope statement and, sometimes, the Statement of Applicability itself.
When the decision is not to certify
If major nonconformities are not closed within the time the certification body allows, or the evidence of correction is not convincing, the certification body can decide not to grant certification. In practice, it will normally require a new Stage 2, or part of it, once the organisation has addressed the issues. The cost of that is mostly time: the commercial deadline that made the certificate urgent does not move.
The three year cycle
Certification starts a three year cycle. ISO 17021-1 requires surveillance audits at least once a calendar year, with the first no later than 12 months after the certification decision, and a recertification audit before the certificate expires.
Surveillance audits are shorter than Stage 2 and do not cover every requirement each time, but they always look at internal audit, management review, the handling of nonconformities, changes to the ISMS and a sample of controls. They sample the same kind of evidence Stage 2 did, so the controls that passed in year one have to keep producing records in years two and three. Significant changes to scope, such as a new site or a new product, should be reported to the certification body, because they may require extra audit time.
That is the practical difference between preparing for Stage 2 and maintaining an ISMS. Qalea combines a compliance platform with guided support from a security team: the platform maps the evidence each applicable control needs and tracks it continuously, and our team works with yours through internal audit, management review and both audit stages. Because Qalea also operates EDR, SIEM and a 24/7 SOC, the monitoring and incident records an auditor samples come from controls that are running, not from a folder assembled the week before.
