What Is ISO 27001?
ISO/IEC 27001 is the internationally recognised standard for Information Security Management Systems (ISMS). It provides organisations with a structured framework for identifying information security risks, implementing appropriate controls and continually improving how sensitive information is protected.
At its core, ISO 27001 is designed to protect the confidentiality, integrity and availability of information.
In practical terms, an ISO 27001 Information Security Management System helps organisations manage risks such as:
- Cyberattacks and malware.
- Data breaches.
- Unauthorised access.
- Accidental loss or disclosure of information.
- Supplier and third-party security failures.
- System outages and service disruption.
- Human error.
- Weak access controls.
- Poor document and data management.
- Risks associated with cloud services and remote working.
An ISMS is much broader than an organisation’s IT systems. It brings together people, processes, policies, technology, risk management, training, auditing and continual improvement within one structured management system.
The objective is not to eliminate every information security risk. Instead, organisations identify and assess their risks, determine how those risks should be treated and implement proportionate controls to reduce them to an acceptable level.
ISO/IEC 27001 can be used by organisations of any size or sector and can be particularly valuable for businesses handling sensitive, regulated or commercially important information.
For medical device manufacturers, healthcare organisations and digital health companies, this may include patient information, clinical data, software source code, Technical Documentation, design records, Quality Management System records and commercially sensitive information.
Implementing ISO 27001 Alongside ISO 13485?
Many medical device manufacturers integrate their Information Security Management System (ISO 27001) with their Quality Management System (ISO 13485). If you're looking for a complete guide to ISO 13485, including implementation, certification, audits and regulatory compliance, read our Complete Guide to ISO 13485.
Developing Medical Device Software?
Information security is increasingly important for Software as a Medical Device (SaMD). If you're developing medical device software, our Complete Guide to IEC 62304 explains the software lifecycle, risk management, validation and regulatory requirements under the EU MDR.
Why ISO 27001 Matters for Medical Device and Digital Health Companies
Medical device and digital health organisations increasingly rely on interconnected systems, cloud platforms, software applications and electronic data. This means information security is not simply an IT issue — it can affect regulatory compliance, business continuity and, in some circumstances, patient safety.
Manufacturers may be responsible for protecting a wide range of sensitive information, including:
- Patient and clinical data.
- Personal information.
- Medical device Technical Documentation.
- Clinical Evaluation and Performance Evaluation data.
- Software source code and development records.
- Design and development documentation.
- Risk management files.
- Quality Management System records.
- Post-Market Surveillance and vigilance information.
- Supplier and customer information.
- Commercially confidential information.
ISO/IEC 27001 provides a structured framework for identifying the information that needs protecting, understanding the threats and vulnerabilities associated with it and implementing proportionate controls to manage those risks.
Information Security and Connected Medical Devices
Information security becomes particularly important where medical devices incorporate software, connectivity or cloud-based services.
A cybersecurity vulnerability could potentially affect more than the confidentiality of information. Depending on the device and vulnerability, it could also affect the integrity or availability of the device, its data or associated services.
For manufacturers of Software as a Medical Device (SaMD), connected devices and digital health technologies, information security therefore needs to be considered alongside the wider medical device lifecycle.
ISO 27001 can complement other frameworks and standards used by medical device organisations, including:
- ISO 13485 for Quality Management Systems.
- ISO 14971 for medical device risk management.
- IEC 62304 for medical device software lifecycle processes.
- IEC 62366-1 for usability engineering.
- Applicable cybersecurity requirements and guidance.
- Data protection requirements such as the UK GDPR and EU GDPR.
ISO 27001 does not replace these requirements. Instead, it provides an organisation-wide framework for managing information security risks systematically.
What About Connected Medical Devices?
Connected medical devices can introduce additional cybersecurity, data protection and information security risks. Learn how connected devices, sensors, software and healthcare systems form the Internet of Medical Things and what this means for manufacturers in our Guide to the Internet of Medical Things (IoMT).
ISO 27001 and Digital Health
Information security is also increasingly important for organisations seeking to supply digital health technologies to healthcare providers.
For example, NHS organisations may expect suppliers to demonstrate appropriate arrangements for information governance, data protection and technical security. ISO 27001 certification can provide independent evidence that an organisation operates a structured Information Security Management System, although certification alone does not demonstrate compliance with every healthcare-specific requirement.
For digital health manufacturers, implementing ISO 27001 can therefore support a broader approach to cybersecurity, data protection, regulatory compliance and healthcare procurement readiness.
How Is AI Changing Medical Devices?
Artificial intelligence is increasingly being incorporated into medical devices and digital health technologies, creating new opportunities as well as considerations around data, cybersecurity and information security. Explore how AI is influencing healthcare technology in our Guide to AI in the Medical Device Industry.
The Three Principles of Information Security: Confidentiality, Integrity and Availability
At the heart of information security are three fundamental principles: Confidentiality, Integrity and Availability, often referred to as the CIA triad.
These principles help organisations understand what they are trying to protect and provide a useful foundation for identifying and assessing information security risks.
Confidentiality
Confidentiality means ensuring that information is only accessible to people, systems or organisations that are authorised to access it.
Organisations may use measures such as:
- User authentication and access controls.
- Role-based permissions.
- Encryption.
- Secure data transfer.
- Confidentiality agreements.
- Physical access restrictions.
- Staff information security training.
For a medical device or digital health organisation, confidential information could include patient data, clinical information, product designs, source code, Technical Documentation and commercially sensitive information.
Integrity
Integrity means protecting information from unauthorised or accidental modification and ensuring that it remains accurate, complete and reliable.
Controls used to protect integrity may include:
- Document and version control.
- Change management.
- Audit trails.
- Electronic signatures.
- Data validation.
- Access permissions.
- Backup and recovery arrangements.
- Software configuration controls.
Integrity is particularly important in regulated industries. If clinical data, device specifications, software, risk management records or Quality Management System documentation are altered incorrectly, decisions could be made using inaccurate or unreliable information.
Availability
Availability means ensuring that authorised users can access information and systems when they are required.
Threats to availability can include cyberattacks, hardware failures, software problems, power outages, accidental deletion and disruption to third-party or cloud services.
Organisations may manage these risks through measures such as:
- Data backups.
- Disaster recovery arrangements.
- Business continuity planning.
- System redundancy.
- Incident response procedures.
- Monitoring and maintenance.
- Resilient infrastructure and cloud services.
For medical device and healthcare organisations, availability can be particularly important where software, systems or information support the delivery of healthcare services or the safe operation of a medical device.
Why the CIA Triad Matters in ISO 27001
The three principles are interconnected. An organisation could successfully prevent unauthorised access to information but still have an information security problem if that information is inaccurate or unavailable when needed.
ISO 27001 therefore takes a risk-based approach to information security. Organisations identify the information and systems that are important to them, consider threats and vulnerabilities, assess the potential consequences and implement controls appropriate to the level of risk.
This approach allows information security controls to be proportionate to the organisation, its activities and the information it needs to protect.
What Is an Information Security Management System (ISMS)?
An Information Security Management System (ISMS) is a structured framework of policies, processes, responsibilities, risk management activities and controls used to manage information security across an organisation.
Rather than treating information security as a collection of individual IT measures, an ISMS provides a systematic way of determining:
- What information and information assets need to be protected.
- What information security risks the organisation faces.
- Who is responsible for managing those risks.
- What controls are required.
- How information security incidents are identified and managed.
- How employees and contractors are trained and made aware of their responsibilities.
- How suppliers and other third parties are managed.
- How the effectiveness of controls is monitored and measured.
- How the system is audited and reviewed.
- How information security is continually improved.
An ISMS therefore covers much more than cybersecurity technology. Firewalls, antivirus software, encryption and access controls may form part of the system, but ISO 27001 also considers people, physical security, organisational processes, suppliers, governance and management oversight.
A Risk-Based Approach to Information Security
A central principle of ISO 27001 is that information security controls should be based on risk.
An organisation first needs to understand its context, the information it holds, the systems and processes it relies upon and the threats that could affect them.
Information security risks are then assessed so that appropriate treatment can be determined.
For example, an organisation may identify risks associated with:
- Unauthorised access to sensitive information.
- Phishing and social engineering.
- Malware or ransomware.
- Loss or theft of equipment.
- Human error.
- Inadequate access permissions.
- Failure of critical IT infrastructure.
- Cloud service disruption.
- Supplier or third-party security incidents.
- Accidental deletion or corruption of data.
- Inadequate backup and recovery arrangements.
The organisation can then determine how each risk should be treated and what controls are necessary.
The ISMS Is a Continual Process
Implementing an ISMS is not a one-off exercise completed simply to achieve ISO 27001 certification.
The system needs to remain appropriate as the organisation changes.
New employees, products, software, suppliers, technologies, locations and business activities can introduce new information security risks. Cybersecurity threats and vulnerabilities also continue to evolve.
Organisations therefore need to continually monitor, review, audit and improve their ISMS.
This includes activities such as internal audits, management reviews, monitoring information security objectives, reviewing risk assessments, managing incidents and implementing corrective actions where problems are identified.
This continual improvement approach helps ensure that information security remains integrated into the organisation’s day-to-day operations rather than becoming a static set of policies and procedures.
Understanding the Structure of ISO/IEC 27001:2022
ISO/IEC 27001:2022 follows the common management system structure used by other ISO standards. This makes it easier for organisations to integrate an Information Security Management System with existing management systems such as ISO 9001 or ISO 13485.
The main requirements of ISO 27001 are contained within Clauses 4 to 10.
Clause 4 – Context of the Organisation
The organisation needs to understand the internal and external factors that could affect its Information Security Management System.
This includes identifying relevant interested parties and their requirements and defining the scope of the ISMS.
Interested parties could include customers, employees, regulators, suppliers, healthcare organisations and other organisations with information security requirements.
Clause 5 – Leadership
Senior management must demonstrate leadership and commitment to information security.
This includes establishing an information security policy, assigning appropriate responsibilities and ensuring that information security is integrated into the organisation’s activities.
ISO 27001 therefore makes information security a management responsibility, rather than something owned solely by the IT department.
Clause 6 – Planning
Organisations must identify information security risks and opportunities and determine how these will be addressed.
This includes establishing an information security risk assessment process, determining appropriate risk treatment and setting measurable information security objectives.
An important output of this process is the Statement of Applicability (SoA), which records the controls considered necessary by the organisation and explains their inclusion or exclusion.
Clause 7 – Support
The organisation must provide the resources necessary to establish, operate and continually improve its ISMS.
This includes requirements relating to:
- Resources.
- Competence.
- Awareness.
- Communication.
- Documented information.
Employees need to understand their information security responsibilities and have the appropriate competence and awareness to perform their roles securely.
Clause 8 – Operation
Clause 8 concerns the day-to-day operation of the ISMS.
Organisations must plan and control the processes necessary to meet their information security requirements and perform information security risk assessments and risk treatment activities at planned intervals and when significant changes occur.
The objective is to ensure that the controls and processes established through the ISMS are actually implemented and maintained in practice.
Clause 9 – Performance Evaluation
Once the ISMS is operating, the organisation needs to determine whether it is working effectively.
This includes:
- Monitoring and measurement.
- Evaluation of ISMS performance.
- Internal audits.
- Management review.
Internal audits provide an important independent check that the ISMS conforms to the organisation’s own requirements and ISO 27001 and that it is effectively implemented and maintained.
Clause 9 – Performance Evaluation
Once the ISMS is operating, the organisation needs to determine whether it is working effectively.
This includes:
- Monitoring and measurement.
- Evaluation of ISMS performance.
- Internal audits.
- Management review.
Internal audits provide an important independent check that the ISMS conforms to the organisation’s own requirements and ISO 27001 and that it is effectively implemented and maintained.
Clause 10 – Improvement
Organisations must respond when nonconformities occur, take appropriate corrective action and continually improve the suitability, adequacy and effectiveness of the ISMS.
This creates a cycle of risk assessment, implementation, monitoring, auditing, review and improvement.
ISO 27001 Clauses at a Glance
| Clause | Requirement | Main Purpose |
|---|---|---|
| 4 | Context of the Organisation | Understand the organisation and define the ISMS scope |
| 5 | Leadership | Establish management commitment, policy and responsibilities |
| 6 | Planning | Assess risks, plan risk treatment and establish objectives |
| 7 | Support | Provide resources, competence, awareness, communication and documentation |
| 8 | Operation | Implement and operate the ISMS and risk treatment activities |
| 9 | Performance Evaluation | Monitor, measure, audit and review the ISMS |
| 10 | Improvement | Address nonconformities and continually improve the ISMS |
Understanding these clauses is important because certification is not based simply on implementing a list of cybersecurity controls. An organisation must demonstrate that it has established and operates the complete management system required by Clauses 4–10.
ISO 27001 Annex A Controls Explained
Alongside the requirements contained in Clauses 4–10, ISO/IEC 27001:2022 includes Annex A, which contains a reference set of information security controls that organisations can consider when treating identified information security risks.
The 2022 edition contains 93 controls, organised into four themes:
| Control Theme | Number of Controls | Focus |
|---|---|---|
| Organisational Controls | 37 | Governance, policies, responsibilities, suppliers, incidents and information management |
| People Controls | 8 | Employees, contractors, awareness, responsibilities and remote working |
| Physical Controls | 14 | Physical premises, equipment and protection against physical threats |
| Technological Controls | 34 | Access, authentication, networks, systems, software, data and cybersecurity |
| Total | 93 |
Organisational Controls
The 37 organisational controls address how information security is governed and managed across the organisation.
They cover areas such as information security policies and responsibilities, segregation of duties, information classification, access control, supplier relationships, cloud services, incident management, business continuity and compliance.
For medical device organisations, these controls can be particularly relevant where sensitive information is shared between manufacturers, software developers, laboratories, consultants, healthcare organisations and other suppliers.
People Controls
The 8 people controls recognise that effective information security depends heavily on the individuals who access and handle information.
They address areas including:
- Screening.
- Terms and conditions of employment.
- Information security awareness and training.
- Disciplinary processes.
- Responsibilities following termination or changes of employment.
- Confidentiality agreements.
- Remote working.
- Information security event reporting.
Training and awareness are particularly important because technical security measures alone cannot eliminate risks arising from phishing, human error or inappropriate handling of information.
Physical Controls
The 14 physical controls address the protection of information, equipment and facilities against physical threats.
These include areas such as secure premises, physical entry controls, monitoring, protection against environmental threats, secure working areas, clear desk and clear screen practices, equipment protection and secure disposal or reuse of equipment.
Physical security remains relevant even where an organisation operates primarily using cloud-based systems because laptops, mobile devices, offices and other physical assets may still provide access to sensitive information.
Technological Controls
The 34 technological controls cover many of the technical measures commonly associated with cybersecurity and information security.
These include areas such as:
- User devices.
- Privileged access.
- Authentication.
- Malware protection.
- Vulnerability management.
- Data deletion and masking.
- Data leakage prevention.
- Backups.
- Logging and monitoring.
- Network security.
- Cryptography.
- Secure development.
- Application security.
- Change management.
For software and digital health organisations, these controls can form an important part of the wider approach to protecting systems, applications and sensitive data.
Do You Have to Implement All 93 Annex A Controls?
No. ISO 27001 does not simply require every organisation to implement all 93 Annex A controls.
The controls selected should be appropriate to the organisation and the information security risks it has identified.
As part of the risk treatment process, the organisation determines which controls are necessary to manage its risks. Annex A provides an important reference set, but organisations may also identify additional controls where required.
The organisation must compare the controls it has determined as necessary with those in Annex A to verify that no necessary controls have been overlooked.
The outcome is documented within the organisation’s Statement of Applicability (SoA).
The Statement of Applicability identifies the necessary controls, explains why they are included, records whether they have been implemented and provides justification for the exclusion of Annex A controls that are not considered necessary.
This makes the SoA one of the most important documents within an ISO 27001 Information Security Management System.
ISO 27001 Risk Assessment and Risk Treatment
Risk management is at the heart of ISO/IEC 27001. Rather than prescribing the same security measures for every organisation, the standard requires organisations to understand their own information security risks and determine appropriate ways of managing them.
This allows the Information Security Management System to be proportionate to the organisation’s size, activities, technology, information assets and risk profile.
What Is an Information Security Risk Assessment?
An information security risk assessment is a structured process for identifying and evaluating risks that could affect the confidentiality, integrity or availability of information.
The organisation needs to establish and maintain a risk assessment process that produces consistent, valid and comparable results.
A typical assessment considers:
- Information, systems and processes that require protection.
- Potential threats and vulnerabilities.
- Possible consequences if an information security event occurs.
- The likelihood of the risk occurring.
- Existing controls.
- The resulting level of risk.
- Whether the risk is acceptable or requires further treatment.
For example, an organisation storing sensitive clinical information in a cloud-based system might consider the risk of unauthorised access, account compromise, data loss or disruption to the cloud service.
Identifying Information Security Risks
Information security risks can arise from many different sources.
Examples include cyberattacks, phishing, malware, human error, inadequate access controls, equipment failure, lost devices, supplier failures, software vulnerabilities and physical security incidents.
Organisations should also consider changes that could introduce new risks, such as implementing new software, changing suppliers, introducing remote working arrangements or launching new products and services.
For medical device and digital health organisations, risk assessments may also need to consider systems used for software development, clinical information, Technical Documentation, complaint handling, Post-Market Surveillance and other regulated activities.
Evaluating Information Security Risks
Once risks have been identified, they need to be analysed and evaluated using defined criteria.
The organisation should determine the potential consequences and likelihood associated with each risk and compare the resulting risk level against its established risk acceptance criteria.
This enables risks to be prioritised so that resources can be focused on areas where additional controls are most important.
ISO 27001 Risk Treatment
Where a risk is not considered acceptable, the organisation needs to determine how it will be treated.
Depending on the circumstances, this may involve:
- Reducing the risk by implementing additional controls.
- Avoiding the risk by stopping or changing the activity creating it.
- Sharing or transferring the risk, for example through contractual arrangements or insurance.
- Retaining the risk where the organisation determines that the remaining risk is acceptable.
The selected treatment should be appropriate to the nature and level of the risk.
Creating a Risk Treatment Plan
The organisation must establish an information security risk treatment plan describing how the selected risk treatments will be implemented.
This can include the controls required, responsibilities, actions and timescales necessary to reduce risks to an acceptable level.
The organisation also needs to obtain approval of the risk treatment plan and acceptance of the remaining, or residual, information security risks from the appropriate risk owners.
Linking Risk Assessment to Annex A
Risk assessment and Annex A are closely connected.
Once the organisation has determined the controls necessary to treat its information security risks, these controls are compared with those contained in Annex A of ISO/IEC 27001:2022 to ensure that no necessary controls have been overlooked.
The resulting control decisions are then reflected within the organisation’s Statement of Applicability.
This creates a clear relationship between:
Risk Assessment → Risk Treatment → Controls → Statement of Applicability
Importantly, Annex A should not be treated simply as a checklist of 93 controls to implement. The organisation’s control environment should be driven by its information security risks and the requirements applicable to the organisation.
What Is a Statement of Applicability in ISO 27001?
The Statement of Applicability (SoA) is one of the key documents within an ISO/IEC 27001 Information Security Management System. It provides a clear record of the information security controls that an organisation has determined are necessary and how those controls apply to its ISMS.
The Statement of Applicability links the organisation’s risk assessment and risk treatment activities with the controls it has selected to manage information security risks.
What Does the Statement of Applicability Include?
The Statement of Applicability should document:
- The controls that the organisation has determined are necessary.
- Justification for including those controls.
- Whether the necessary controls have been implemented.
- Justification for excluding any Annex A controls.
This provides a concise overview of the organisation’s approach to information security controls and demonstrates that control selection has been considered systematically.
How Is the Statement of Applicability Developed?
The SoA should be developed as part of the organisation’s information security risk treatment process.
The process can broadly be considered as:
Identify Risks → Assess Risks → Determine Risk Treatment → Select Necessary Controls → Compare Against Annex A → Create the Statement of Applicability
The organisation first identifies and assesses its information security risks and determines how unacceptable risks will be treated.
Controls necessary to implement the selected risk treatment are then determined. These controls are compared against the controls listed within Annex A of ISO/IEC 27001:2022 to ensure that no necessary controls have been overlooked.
The resulting decisions are recorded within the Statement of Applicability.
Can Annex A Controls Be Excluded?
Yes. An organisation does not necessarily need to implement every Annex A control.
Where an Annex A control is not necessary based on the organisation’s information security risks and requirements, it may be excluded. However, the organisation needs to provide a justification for that exclusion within the Statement of Applicability.
For example, some controls may not be relevant because of the organisation’s activities, technology, infrastructure or operating model.
Controls should not simply be excluded because they are difficult or expensive to implement. The organisation needs to be able to demonstrate that its control decisions are appropriate in relation to its identified risks.
Is the Statement of Applicability Just an Annex A Checklist?
No. Treating the Statement of Applicability as a simple checklist of the 93 Annex A controls can miss an important part of ISO 27001.
The organisation first determines the controls it needs based on its risks and information security requirements. Annex A is then used as a reference to check that necessary controls have not been overlooked.
Organisations may therefore identify and implement additional controls that are not contained within Annex A where these are necessary to manage their particular information security risks.
Why Is the Statement of Applicability Important for ISO 27001 Certification?
During ISO 27001 certification, the Statement of Applicability helps the certification body understand which controls the organisation considers necessary, why they have been selected and how they relate to the ISMS.
Auditors may use the SoA alongside the risk assessment, risk treatment plan and supporting policies and procedures when assessing whether the organisation has established and implemented an effective ISMS.
The Statement of Applicability should therefore reflect the organisation’s actual information security arrangements rather than being created simply as a document for certification.
It should also be reviewed as the organisation and its risks change so that it continues to accurately represent the controls required within the ISMS.
ISO 27001 Policies and Documented Information
Documentation is an important part of an ISO/IEC 27001 Information Security Management System, but implementing ISO 27001 does not mean creating policies and procedures simply for the sake of having documents.
The purpose of documented information is to help ensure that information security activities are defined, controlled, consistently followed and capable of being demonstrated.
The documentation required will vary depending on the organisation’s size, complexity, activities, information security risks and the controls it has determined are necessary.
What Documentation Is Required for ISO 27001?
ISO 27001 requires organisations to maintain and retain certain documented information as part of their ISMS.
This can include information relating to:
- The scope of the Information Security Management System.
- Information security policy.
- Information security objectives.
- Information security risk assessment processes.
- Information security risk treatment processes.
- Risk assessment results.
- Risk treatment results.
- The Statement of Applicability.
- Evidence of competence where appropriate.
- Monitoring and measurement results.
- Internal audit activities and results.
- Management review results.
- Nonconformities and corrective actions.
Additional policies, procedures, records and other documents may also be required depending on the controls selected by the organisation and how those controls are implemented.
Common ISO 27001 Policies and Procedures
Depending on the organisation and its identified risks, an ISMS may include policies or procedures covering areas such as:
- Access control.
- Acceptable use of information and systems.
- Information classification and handling.
- Passwords and authentication.
- Information security incident management.
- Backup and recovery.
- Business continuity.
- Supplier and third-party security.
- Remote working.
- Mobile devices.
- Physical security.
- Change management.
- Vulnerability management.
- Secure software development.
- Data retention and disposal.
- Information security awareness and training.
Not every organisation will require exactly the same set of documents. Policies and procedures should reflect the organisation’s actual risks, controls and working practices rather than being copied from a generic ISO 27001 template library without appropriate review.
Controlling ISMS Documentation
Documents forming part of the ISMS should themselves be appropriately controlled.
Organisations need to ensure that documented information is appropriately identified, reviewed, approved, available where required and protected against unauthorised access, loss or inappropriate alteration.
Document control may include:
- Document titles and unique identifiers.
- Version numbers.
- Review and approval records.
- Revision histories.
- Defined document owners.
- Access permissions.
- Retention arrangements.
- Controls for obsolete documents.
For organisations already operating an ISO 13485 Quality Management System, many of these principles will be familiar. Existing document control and record control processes may be capable of supporting both management systems, provided the specific requirements of each standard are addressed.
Avoid Creating an ISMS That Exists Only on Paper
One of the biggest mistakes when implementing ISO 27001 is creating an extensive library of policies that does not reflect how the organisation actually operates.
For example, having an access control policy is of little value if user permissions are not actually reviewed, former employees retain access or privileged accounts are inadequately controlled.
The documentation should describe and support the organisation’s real information security arrangements.
This is also important during certification audits. Auditors will not simply check that a policy exists; they may seek evidence that the processes and controls described within the ISMS have been implemented and are operating effectively.
A well-designed ISMS should therefore contain enough documentation to provide effective governance and objective evidence without creating unnecessary administrative burden.
How to Implement ISO 27001: Step-by-Step
Implementing ISO/IEC 27001 involves more than creating information security policies. An organisation needs to establish an Information Security Management System that reflects its activities, risks and information security requirements and can be demonstrated to operate effectively.
The exact implementation process will vary between organisations, but the following steps provide a practical pathway.
Step 1 – Define the Scope of the ISMS
The first step is determining what will be covered by the Information Security Management System.
The scope may cover the entire organisation or specific business activities, locations, products, services or systems.
When defining the scope, organisations should consider their internal and external context, interested parties, dependencies and interfaces with other parts of the business.
The scope should be clear and appropriate to the organisation’s information security objectives.
Step 2 – Conduct an ISO 27001 Gap Assessment
A gap assessment can be used to compare the organisation’s existing arrangements against the requirements of ISO/IEC 27001.
This helps identify what is already in place and where additional work is required.
For organisations with established management systems such as ISO 9001 or ISO 13485, some processes may already be capable of supporting the ISMS, including document control, training, internal audits, management review and corrective action.
Step 3 – Establish Information Security Governance
Roles and responsibilities for information security should be established.
Senior management needs to demonstrate commitment to the ISMS, establish the information security policy and ensure that appropriate resources and responsibilities are assigned.
Information security objectives should also be established and aligned with the organisation’s activities and business objectives.
Step 4 – Perform the Information Security Risk Assessment
The organisation should establish its risk assessment methodology and identify information security risks that could affect the confidentiality, integrity and availability of information.
Risks are analysed and evaluated against defined criteria to determine which risks require treatment.
The results of the risk assessment should be documented and maintained.
Step 5 – Develop the Risk Treatment Plan
The organisation then determines how unacceptable risks will be treated.
This may involve reducing, avoiding, sharing or retaining risks, depending on the circumstances.
Where controls are required, these should be selected based on the organisation’s identified risks and information security requirements.
Step 6 – Create the Statement of Applicability
The organisation’s necessary controls are compared against the controls contained within Annex A of ISO/IEC 27001:2022.
The resulting Statement of Applicability identifies the controls considered necessary, provides justification for their inclusion, records whether they have been implemented and explains any exclusions from Annex A.
Step 7 – Implement the Required Controls
The organisation must put its selected information security controls into practice.
Depending on the identified risks, this could include organisational, people, physical and technological controls covering areas such as access management, cybersecurity, suppliers, physical security, backups, incident management and secure development.
Policies and procedures should reflect how these controls actually operate.
Step 8 – Train Employees and Build Awareness
Employees and contractors should understand their information security responsibilities and receive appropriate training and awareness.
Training may cover areas such as phishing, passwords, handling sensitive information, incident reporting, remote working and acceptable use of organisational systems.
Information security awareness should be maintained rather than treated as a one-off activity before certification.
Step 9 – Monitor and Measure the ISMS
Once implemented, the organisation needs to monitor the performance and effectiveness of its ISMS.
This may involve reviewing information security objectives, incidents, vulnerabilities, control effectiveness, audit findings and other relevant indicators.
The results provide evidence of whether the ISMS is achieving its intended outcomes and identify opportunities for improvement.
Step 10 – Conduct an ISO 27001 Internal Audit
Before certification, the organisation should conduct an internal audit of its ISMS.
The audit assesses whether the ISMS conforms to the organisation’s own requirements and the requirements of ISO 27001 and whether it has been effectively implemented and maintained.
Any nonconformities or weaknesses identified should be investigated and appropriately addressed.
Step 11 – Conduct Management Review
Top management must review the ISMS at planned intervals.
Management review considers the performance of the system, audit results, information security objectives, changes affecting the ISMS, feedback from interested parties, risks and opportunities, and opportunities for continual improvement.
This provides senior management with oversight of whether the ISMS remains suitable, adequate and effective.
Step 12 – Prepare for ISO 27001 Certification
Once the ISMS has been implemented, operated, internally audited and reviewed by management, the organisation can prepare for independent certification.
Certification is normally conducted by an external certification body and involves assessment of both the design of the ISMS and evidence that it has been implemented effectively.
Achieving certification is not the end of the process. The ISMS must continue to be maintained, audited, reviewed and improved to retain certification.
The ISO 27001 Certification Process
Organisations can implement ISO/IEC 27001 without becoming certified. However, independent certification provides external assurance that the organisation’s Information Security Management System has been assessed against the requirements of the standard.
For organisations seeking certification, the process is typically conducted by an independent certification body and includes a Stage 1 audit and Stage 2 audit, followed by ongoing surveillance.
Choosing an ISO 27001 Certification Body
Organisations seeking accredited certification should select an appropriately accredited certification body.
In the UK, certification bodies may be accredited by the United Kingdom Accreditation Service (UKAS) to perform ISO/IEC 27001 certification.
Before appointing a certification body, organisations should consider factors such as:
- Appropriate accreditation.
- Experience within the organisation’s sector.
- Technical competence.
- Audit availability and timescales.
- Certification and surveillance costs.
- Geographic coverage where multiple sites are involved.
The certification body remains independent from any consultant assisting the organisation with implementation of its ISMS.
Stage 1 Audit – Readiness and Documentation Review
The first formal stage of certification is generally the Stage 1 audit.
The purpose of Stage 1 is to assess whether the organisation is sufficiently prepared to proceed to the more detailed Stage 2 assessment.
The auditor will typically review areas such as the scope of the ISMS, key documented information, information security risk assessment, risk treatment, Statement of Applicability, internal audit arrangements and management review.
If significant areas are not sufficiently developed, additional work may be required before progressing to Stage 2.
Stage 2 Audit – Certification Assessment
The Stage 2 audit is the main certification assessment.
At this stage, the auditor assesses whether the ISMS conforms to ISO/IEC 27001 and whether it has been effectively implemented and maintained.
The assessment may include:
- Interviews with employees and management.
- Review of policies, procedures and records.
- Sampling of information security controls.
- Examination of risk assessment and treatment activities.
- Review of the Statement of Applicability.
- Evidence of training and competence.
- Internal audit and management review records.
- Information security incident management.
- Corrective actions and continual improvement.
The focus is therefore not simply on whether the organisation has the correct documents. The auditor will seek objective evidence that the ISMS operates in practice.
What Happens if Nonconformities Are Identified?
Certification audits may identify nonconformities where the organisation has not met a requirement of ISO 27001 or its own ISMS requirements.
The organisation will need to investigate the cause of the nonconformity and take appropriate corrective action.
Depending on the nature and significance of the findings, evidence of corrective action may need to be reviewed before certification can be granted.
ISO 27001 Certification
Once the certification body is satisfied that the organisation meets the applicable certification requirements, an ISO/IEC 27001 certificate can be issued covering the defined scope of the ISMS.
Certification demonstrates that the organisation’s ISMS has been independently assessed, but it does not mean that the organisation can never experience an information security incident.
ISO 27001 is designed to demonstrate a systematic approach to identifying, managing, monitoring and continually improving information security risks.
Surveillance Audits
Certification requires ongoing maintenance of the ISMS.
Following initial certification, the certification body conducts surveillance audits during the certification cycle to confirm that the management system continues to operate effectively.
These audits typically sample different areas of the ISMS and consider changes to the organisation, information security performance, internal audits, management reviews, corrective actions and continued implementation of relevant controls.
Recertification
ISO management system certification normally operates on a three-year certification cycle.
Before the end of the cycle, a recertification audit is conducted to evaluate the continued conformity and effectiveness of the ISMS and determine whether certification should be renewed.
Organisations must therefore continue to maintain and improve their ISMS throughout the certification cycle rather than treating certification as a one-time project.
How Long Does ISO 27001 Certification Take?
There is no fixed timescale for achieving ISO/IEC 27001 certification. The time required depends on the organisation’s size, complexity, existing information security arrangements and how much work is required to establish an effective Information Security Management System.
An organisation that already operates mature management systems and information security processes may be able to implement ISO 27001 considerably faster than an organisation starting from scratch.
What Can Affect the ISO 27001 Implementation Timescale?
Factors that can influence the implementation and certification timeline include:
- The size and complexity of the organisation.
- The number of employees and locations.
- The proposed scope of the ISMS.
- The complexity of IT systems and infrastructure.
- The type and sensitivity of information being processed.
- Existing cybersecurity and information security controls.
- Existing management systems such as ISO 9001 or ISO 13485.
- The number and complexity of suppliers and cloud service providers.
- The results of the initial gap assessment.
- The availability of internal resources.
- The number of controls requiring implementation.
- The time required to generate evidence that the ISMS is operating effectively.
- Certification body availability.
Can ISO 27001 Be Implemented Quickly?
Some organisations may be able to establish an ISMS relatively quickly, particularly where strong information security and management system processes are already in place.
However, certification should not be approached simply as an exercise in producing documents as quickly as possible.
Before certification, the organisation needs to demonstrate that its ISMS has been implemented and is operating effectively. This includes completing activities such as risk assessment and treatment, implementing controls, staff awareness and training, monitoring the ISMS, internal auditing and management review.
The organisation also needs sufficient evidence to demonstrate these activities during the certification audit.
Existing ISO Management Systems Can Help
Organisations already certified to standards such as ISO 9001 or ISO 13485 may have a useful foundation for ISO 27001.
Processes for document control, competence and training, internal audits, management review, corrective action and continual improvement may already exist and can potentially be integrated with the ISMS.
For medical device manufacturers, integrating ISO 27001 with an existing ISO 13485 Quality Management System can reduce duplication and create a more consistent approach to organisational governance.
The objective should therefore be to establish an ISMS that is appropriate, effective and sustainable, rather than aiming for certification within an arbitrary timescale.
ISO 27001 and ISO 13485: How Do They Work Together?
For medical device manufacturers, ISO/IEC 27001 will often sit alongside an existing ISO 13485 Quality Management System (QMS). Although the two standards have different purposes, there are areas where their management system processes can work together.
ISO 13485 focuses on the consistent design, manufacture and supply of medical devices that meet applicable regulatory and customer requirements, while ISO 27001 focuses on establishing an Information Security Management System to manage information security risks.
ISO 27001 vs ISO 13485
The two standards address different objectives:
| Area | ISO/IEC 27001 | ISO 13485 |
|---|---|---|
| Primary focus | Information security | Medical device quality management |
| Management system | Information Security Management System (ISMS) | Quality Management System (QMS) |
| Risk focus | Information security risks | Risks associated with QMS processes and medical device regulatory requirements |
| Information security | Core purpose of the standard | May be relevant to QMS processes but is not the primary purpose |
| Internal audits | Required | Required |
| Management review | Required | Required |
| Document control | Required | Required |
| Competence and training | Required | Required |
| Corrective action | Required | Required |
| Continual improvement | Integral to the ISMS | Improvement requirements apply within the ISO 13485 framework |
Where Can ISO 27001 and ISO 13485 Be Integrated?
Organisations do not necessarily need to operate two completely separate management systems.
Existing QMS processes may be extended or adapted to incorporate information security requirements where appropriate.
Potential areas for integration include:
- Document and record control.
- Employee competence and training.
- Supplier management.
- Internal audits.
- Management review.
- Corrective action.
- Roles and responsibilities.
- Change management.
- Management of outsourced processes and services.
- Control of software and electronic records.
For example, an organisation could operate a combined internal audit programme that covers both its QMS and ISMS while ensuring that auditors have the necessary competence and that the requirements of each standard are adequately assessed.
Why Information Security Matters to the Medical Device QMS
Modern medical device Quality Management Systems can contain significant amounts of sensitive and business-critical information.
This may include:
- Design and development records.
- Technical Documentation.
- Clinical data.
- Risk Management Files.
- Supplier information.
- Complaint and vigilance records.
- Post-Market Surveillance information.
- Software source code and development records.
- Patient or user information.
Loss, unauthorised alteration or unavailability of this information could potentially affect regulatory compliance, product development or the organisation’s ability to operate effectively.
ISO 27001 provides a structured framework for identifying and managing these information security risks alongside the organisation’s existing quality and regulatory processes.
Does ISO 13485 Certification Mean You Are Compliant With ISO 27001?
No. Certification to ISO 13485 does not demonstrate conformity with ISO/IEC 27001.
Likewise, ISO 27001 certification does not demonstrate that an organisation operates an ISO 13485-compliant medical device QMS.
They are separate standards with different scopes and requirements.
However, organisations already operating an effective ISO 13485 QMS may have a strong management-system foundation on which to build an ISMS. Integrating common processes can also help avoid unnecessary duplication and make both systems easier to maintain.
ISO 27001 and GDPR
ISO/IEC 27001 and the UK GDPR and EU GDPR are closely related in their approach to protecting information, but they are not the same thing.
GDPR establishes legal requirements relating to the processing and protection of personal data, while ISO 27001 provides a structured management system for identifying and managing information security risks.
For organisations handling patient, clinical, employee or customer information, the two frameworks can therefore complement one another.
How Can ISO 27001 Support GDPR Compliance?
Data protection legislation requires organisations to implement appropriate technical and organisational measures to protect personal data.
An ISO 27001 Information Security Management System can help organisations establish and manage many of these measures systematically.
Relevant areas can include:
- Access control and user permissions.
- Authentication and password management.
- Encryption.
- Information classification.
- Secure transfer of information.
- Backup and recovery.
- Information security incident management.
- Supplier and third-party security.
- Physical security.
- Employee awareness and training.
- Logging and monitoring.
- Vulnerability management.
- Business continuity.
- Secure disposal of information and equipment.
The risk-based approach used by ISO 27001 can also help organisations identify threats to personal information and determine proportionate controls for managing those risks.
Does ISO 27001 Certification Mean You Are GDPR Compliant?
No. ISO 27001 certification does not automatically demonstrate compliance with the UK GDPR or EU GDPR.
GDPR contains requirements that extend beyond information security, including requirements relating to lawful bases for processing, transparency, data subject rights, data minimisation, retention and accountability.
An organisation could therefore operate an ISO 27001-certified ISMS and still fail to meet other data protection obligations.
Equally, an organisation does not have to be ISO 27001 certified in order to comply with GDPR.
ISO 27001 should instead be viewed as a framework that can support an organisation’s wider data protection programme, particularly in relation to information security risk management and the protection of personal data.
ISO 27001 and Health Data
Information security can be particularly important for medical device, healthcare and digital health organisations because they may process information relating to an individual’s health.
Health data is treated as special category personal data under the UK GDPR and EU GDPR and requires appropriate protection.
Depending on the organisation and its activities, this could include:
- Patient information.
- Clinical investigation data.
- Diagnostic information.
- Device-generated health data.
- Remote patient monitoring information.
- Digital health application data.
- Complaint and vigilance information containing patient details.
An effective ISMS can help organisations identify where this information is stored, who can access it, how it is transferred and what controls are required to protect its confidentiality, integrity and availability.
ISO 27001 and Data Breaches
ISO 27001 also requires organisations to establish arrangements for managing information security incidents.
Where an incident involves personal data, the organisation may additionally need to consider its obligations under applicable data protection legislation, including whether the incident constitutes a personal data breach and whether notification requirements apply.
Information security incident management and GDPR breach management should therefore work together rather than operating as completely separate processes.
ISO 27001 for NHS and Digital Health Suppliers
Information security is particularly important for organisations supplying digital health technologies to the NHS. These technologies may process sensitive health information, integrate with NHS systems or provide services that healthcare professionals and patients rely upon.
Organisations therefore need to demonstrate that information security, data protection and cybersecurity risks are being appropriately managed.
ISO/IEC 27001 can provide a strong foundation for this by establishing a structured Information Security Management System (ISMS).
How Does ISO 27001 Relate to NHS DTAC?
The Digital Technology Assessment Criteria (DTAC) is used within the NHS to assess digital health technologies across several important areas, including:
- Clinical safety.
- Data protection.
- Technical security.
- Interoperability.
- Usability and accessibility.
Information security is therefore an important part of the wider DTAC assessment.
ISO 27001 can support organisations in demonstrating that information security risks are being systematically identified, assessed and managed.
An established ISMS can provide evidence relating to areas such as:
- Information security governance.
- Risk assessment and risk treatment.
- Access control.
- Security policies and procedures.
- Incident management.
- Supplier security.
- Business continuity.
- Vulnerability management.
- Employee training and awareness.
- Monitoring, auditing and continual improvement.
Does ISO 27001 Certification Mean You Are DTAC Compliant?
No. ISO 27001 certification does not automatically demonstrate compliance with DTAC.
DTAC covers areas that extend beyond the scope of ISO 27001, including clinical safety, interoperability, usability and accessibility.
A digital health technology may therefore operate within an ISO 27001-certified organisation while still requiring additional work and evidence to satisfy the wider DTAC requirements.
However, an effective ISO 27001 ISMS can provide a valuable foundation for the data protection and technical security elements of an organisation’s wider NHS compliance strategy.
ISO 27001 and Clinical Safety
For digital health technologies, information security and clinical safety may also overlap.
A security incident does not necessarily affect only the confidentiality of information. Depending on the technology, compromised data integrity or loss of system availability could potentially affect how a digital health product performs or how healthcare professionals use the information it provides.
Organisations should therefore consider information security alongside their wider clinical risk management and medical device risk management activities where applicable.
For NHS health IT systems, this may include considering the requirements of DCB0129, which addresses the application of clinical risk management by manufacturers of health IT systems.
Building an Integrated Digital Health Compliance Framework
Rather than treating information security, data protection, clinical safety and medical device compliance as completely separate activities, digital health organisations can benefit from considering how these systems interact.
Depending on the technology and its intended purpose, this may involve frameworks and standards such as:
- ISO/IEC 27001 for information security management.
- ISO 13485 for medical device Quality Management Systems.
- ISO 14971 for medical device risk management.
- IEC 62304 for medical device software lifecycle processes.
- DCB0129 for clinical risk management of health IT systems.
- UK GDPR and applicable data protection legislation.
- NHS DTAC requirements.
The exact requirements will depend on the product, its intended purpose, the information it processes and the healthcare environment in which it will be used.
For digital health manufacturers seeking NHS adoption, information security should therefore form part of a broader regulatory, clinical safety and procurement strategy rather than being considered in isolation.
Preparing a Digital Health Technology for the NHS?
Information security is an important part of NHS digital health assurance, but it sits alongside requirements for clinical safety, data protection, interoperability, usability and accessibility. For a practical overview of the complete framework, read our Complete Guide to NHS DTAC Compliance for Digital Health Manufacturers.
ISO/IEC 27001:2022 Amendment 1:2024 – Climate Action Changes
In 2024, ISO published Amendment 1: Climate action changes for ISO/IEC 27001:2022. This amendment forms part of a wider change introduced across ISO management system standards to ensure organisations consider whether climate change is relevant to their management systems.
The amendment does not introduce a new set of information security controls. Instead, it modifies the requirements relating to the context of the organisation and interested parties.
What Changed in ISO 27001?
The amendment affects two areas of Clause 4.
Under Clause 4.1 – Understanding the organisation and its context, organisations are now explicitly required to determine whether climate change is a relevant issue.
Clause 4.2 – Understanding the needs and expectations of interested parties also includes a note recognising that relevant interested parties may have requirements related to climate change.
What Does This Mean for an ISMS?
Organisations implementing or maintaining ISO 27001 should consider whether climate change could affect the context, risks, dependencies or interested-party requirements relevant to their Information Security Management System.
Depending on the organisation, considerations could include:
- Increased risk of flooding, storms, extreme temperatures or other events affecting offices or data infrastructure.
- Disruption to power, telecommunications or other critical utilities.
- Business continuity and disaster recovery arrangements.
- Resilience of data centres and cloud service providers.
- Supplier and third-party dependencies.
- Remote working arrangements following disruption to physical locations.
- Customer, contractual or regulatory requirements relating to climate resilience.
This does not mean that every organisation must identify climate change as a significant information security risk.
The requirement is to consider whether climate change is relevant to the organisation and its ISMS and, where it is relevant, ensure that it is appropriately addressed within the management system.
Do Existing ISO 27001 Systems Need to Be Updated?
Organisations operating an ISO/IEC 27001:2022 ISMS should ensure that consideration of climate change is incorporated into their evaluation of organisational context and relevant interested parties.
Where climate change is determined to be relevant, any resulting risks, requirements or actions should be addressed through the organisation’s existing ISMS processes.
For many organisations, this may require only a relatively small update to their existing context and interested-party assessments, rather than substantial changes to the overall ISMS.
Common ISO 27001 Mistakes and How to Avoid Them
Implementing ISO/IEC 27001 can significantly strengthen an organisation’s approach to information security, but problems can arise when the standard is treated as a documentation exercise rather than a functioning management system.
Understanding some of the most common mistakes can make implementation more efficient and improve readiness for certification.
Treating Annex A as a Checklist
One common mistake is assuming that ISO 27001 simply requires an organisation to implement all 93 Annex A controls.
ISO 27001 is risk-based. Organisations should identify and assess their information security risks, determine appropriate risk treatments and then select the controls necessary to manage those risks.
Annex A is used as a reference to ensure that necessary controls have not been overlooked.
How to avoid it: Build the ISMS around the organisation’s actual information security risks rather than starting with a generic list of controls.
Using Generic Policies Without Adapting Them
Templates can provide a useful starting point, but policies copied into an ISMS without being adapted to the organisation can create significant problems.
For example, a policy might describe security processes, responsibilities or technologies that the organisation does not actually use.
How to avoid it: Ensure policies and procedures reflect the organisation’s real systems, working practices, responsibilities and controls.
Defining the ISMS Scope Poorly
An unclear or inappropriate ISMS scope can create difficulties throughout implementation and certification.
The scope needs to clearly establish the boundaries and applicability of the management system while considering relevant activities, locations, technologies, interfaces and dependencies.
How to avoid it: Define the scope early and ensure that it accurately reflects what the organisation intends to protect and certify.
Performing a Weak Risk Assessment
A superficial risk assessment can undermine the entire ISMS.
If important information security risks are not identified or evaluated appropriately, the organisation may select inadequate controls or fail to address significant vulnerabilities.
How to avoid it: Establish a consistent risk assessment methodology and ensure risks reflect the organisation’s actual information, systems, processes, threats and dependencies.
Creating a Poor Statement of Applicability
The Statement of Applicability should not simply be a copied list of Annex A controls marked as applicable or not applicable.
It needs to reflect the controls determined necessary through the organisation’s risk treatment process and provide appropriate justification for inclusion and exclusion decisions.
How to avoid it: Maintain a clear relationship between the risk assessment, risk treatment plan, selected controls and Statement of Applicability.
Focusing Only on IT
ISO 27001 is sometimes treated as an IT department project.
Although technology is an important part of information security, an ISMS also covers people, physical security, suppliers, governance, policies, business processes and management oversight.
How to avoid it: Involve relevant functions across the organisation and ensure senior management remains engaged with the ISMS.
Failing to Generate Objective Evidence
Having a procedure does not demonstrate that the procedure is being followed.
During an audit, organisations may need to provide evidence showing that controls and processes are actually operating. This could include training records, access reviews, audit records, monitoring results, incident records or completed supplier assessments.
How to avoid it: Consider what evidence each important ISMS process will generate and ensure records are appropriately retained.
Leaving Internal Audits Until the Last Minute
Internal auditing is an essential part of evaluating whether the ISMS conforms to requirements and is operating effectively.
Leaving the internal audit until immediately before certification can result in insufficient time to investigate findings, implement corrective actions and demonstrate that improvements have been effective.
How to avoid it: Build internal auditing into the implementation programme and allow sufficient time to address findings before certification.
Preparing for an ISO 27001 Internal Audit?
Internal audits are an essential part of maintaining an effective Information Security Management System and preparing for certification and surveillance audits. Learn how to plan, conduct and document an effective audit in our Guide to ISO 27001 Internal Audits.
Treating Certification as the End Goal
Achieving ISO 27001 certification does not mean the organisation’s information security work is complete.
Threats, technologies, suppliers, employees and business activities change over time, and the ISMS needs to change with them.
How to avoid it: Treat certification as part of an ongoing cycle of monitoring, auditing, management review, corrective action and continual improvement.
Rushing Into Certification Too Early
An organisation may have produced all of the required documentation but still not have enough evidence to demonstrate that its ISMS is operating effectively.
Moving to certification before processes have been embedded can result in avoidable audit findings.
How to avoid it: Ensure the ISMS has been implemented in practice, key controls are operating, records are available, an internal audit has been completed and management review has taken place before proceeding to certification.
How Patient Guard Can Help With ISO 27001
Implementing ISO/IEC 27001 can be challenging, particularly for organisations that need to integrate information security requirements with existing quality, regulatory or medical device processes.
Patient Guard can support organisations through the development, implementation and maintenance of an Information Security Management System (ISMS) aligned with ISO/IEC 27001.
Our approach is designed to develop a practical management system that reflects how your organisation actually operates rather than creating unnecessary documentation solely for certification.
ISO 27001 Gap Assessment
A gap assessment provides a useful starting point for organisations preparing for ISO 27001.
Patient Guard can review your existing information security arrangements against the requirements of ISO/IEC 27001 to identify:
- Processes and controls already in place.
- Gaps against the standard.
- Documentation requiring development or improvement.
- Areas requiring additional controls.
- Priorities for implementation.
- Opportunities to integrate the ISMS with existing management systems.
The results can then be used to develop a structured implementation plan.
ISO 27001 ISMS Implementation
Patient Guard can support the development and implementation of the ISMS, including areas such as:
- ISMS scope and organisational context.
- Information security policies and objectives.
- Roles and responsibilities.
- Risk assessment methodology.
- Information security risk assessments.
- Risk treatment planning.
- Statement of Applicability.
- Policies and procedures.
- Documented information.
- Information security controls.
- Training and awareness.
- Monitoring and measurement.
- Corrective action and continual improvement.
The level of support can be adapted according to the organisation’s existing systems, internal resources and certification objectives.
Integrating ISO 27001 With Existing Management Systems
For medical device organisations already operating an ISO 13485 Quality Management System, Patient Guard can help identify opportunities to integrate common management system processes.
This may include document control, training, supplier management, internal audits, management review and corrective action.
An integrated approach can help reduce duplication while ensuring that the specific requirements of both the QMS and ISMS remain appropriately addressed.
ISO 27001 Internal Audits
Patient Guard can also support organisations with ISO 27001 internal audits.
Internal audits provide an independent assessment of whether the ISMS conforms to planned arrangements and the requirements of ISO 27001 and whether it has been effectively implemented and maintained.
They can also help identify weaknesses and improvement opportunities before external certification or surveillance audits.
Preparing for ISO 27001 Certification
Where certification is the objective, Patient Guard can help organisations prepare for the Stage 1 and Stage 2 certification audits.
This can include reviewing the readiness of the ISMS, addressing identified gaps and ensuring that the organisation has appropriate evidence to demonstrate that its information security processes and controls have been implemented in practice.
The certification decision itself is made independently by the organisation’s chosen certification body.
ISO 27001 Support for Medical Device and Digital Health Companies
Patient Guard’s wider experience in medical device quality, regulatory compliance and digital health means that ISO 27001 can be considered alongside related requirements rather than in isolation.
For medical device and digital health organisations, this can include consideration of ISO 13485, ISO 14971, IEC 62304, GDPR, NHS DTAC and clinical safety requirements, where applicable.
This can be particularly valuable for organisations developing connected medical devices, Software as a Medical Device (SaMD) and digital health technologies where information security, cybersecurity, quality management and regulatory compliance increasingly overlap.
Frequently Asked Questions About ISO/IEC 27001
ISO 27001 is the international standard for Information Security Management Systems. It helps organisations identify information security risks, implement appropriate controls and continually improve how they protect sensitive information.
An Information Security Management System, or ISMS, is a structured framework of policies, procedures, controls and risk management activities used to protect information from threats such as cyberattacks, data breaches and unauthorised access.
ISO 27001 certification is not usually legally mandatory, but it is often required by customers, procurement teams, investors or commercial partners. It may also support compliance with data protection and cybersecurity expectations.
The timeframe depends on the size of the organisation, the scope of the ISMS and the maturity of existing processes. Some organisations may be ready within a few months, while larger or more complex businesses may require longer.
Annex A contains information security controls that organisations may use to treat identified risks. The current standard includes 93 controls grouped into Organisational, People, Physical and Technological themes.
The Statement of Applicability is a key ISO 27001 document that explains which Annex A controls apply to the organisation, which do not and why. It links the risk assessment to the controls selected for implementation.
Internal audits should be performed at planned intervals. Certified organisations also undergo external surveillance audits during the certification cycle, with recertification normally required every three years.
Yes. ISO 27001 can be integrated with ISO 13485 by aligning common processes such as document control, internal audits, management review, supplier controls, training and CAPA. This is particularly useful for medical device manufacturers and SaMD developers.
ISO 27001 can support medical device cybersecurity by providing a structured approach to information security risk management, access control, incident response, supplier security and secure management of software and data systems.
Yes. Patient Guard supports organisations with ISO 27001 gap analysis, ISMS implementation, risk assessments, Statement of Applicability preparation, internal audits, staff training and certification readiness support.
References
This guide is based on ISO/IEC 27001:2022, supporting ISO information security guidance, UK data protection requirements and relevant NHS digital health guidance relating to Information Security Management Systems, risk management, information security controls, certification and the protection of sensitive information.
| Organisation | Reference | Why it's relevant |
|---|---|---|
| ISO / IEC | ISO/IEC 27001:2022 – Information Security Management Systems | The international standard specifying requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). It provides the core framework for information security risk management, organisational governance, performance evaluation and continual improvement. |
| ISO / IEC | ISO/IEC 27001:2022/Amd 1:2024 – Climate Action Changes | Introduces climate change considerations into the management system requirements relating to organisational context and interested parties. Organisations should determine whether climate change is relevant to their ISMS and address any resulting risks or requirements where applicable. |
| ISO / IEC | ISO/IEC 27002:2022 – Information Security Controls | Provides guidance on the implementation of information security controls and supports the controls referenced in Annex A of ISO/IEC 27001:2022. It covers organisational, people, physical and technological controls used to manage information security risks. |
| Information Commissioner's Office | ICO – A Guide to Data Security | Provides UK regulatory guidance on protecting personal information, including information security risk assessment, organisational and technical measures, confidentiality, integrity and availability, employee responsibilities and security of processing under the UK GDPR. |
| Information Commissioner's Office | ICO – Security Outcomes | Explains the security outcomes organisations should consider when protecting personal data, including governance, risk management, asset management, access control, data security, system security and management of supply-chain risks. |
| Information Commissioner's Office | ICO – Data Protection by Design and by Default | Provides guidance on integrating data protection into systems, products and organisational processes from the design stage and throughout their lifecycle. This is particularly relevant to digital health and medical device organisations processing personal or health information. |
| NHS England | NHS England – Medical Devices and Digital Tools | Provides NHS England guidance relating to medical devices and digital health technologies, including the Digital Technology Assessment Criteria (DTAC). DTAC considers clinical safety, data protection, technical security, interoperability, and usability and accessibility. |
| United Kingdom Accreditation Service | UKAS – Accredited Certification | UKAS is the UK's national accreditation body and provides accreditation of certification bodies. Organisations seeking accredited ISO/IEC 27001 certification should ensure that their chosen certification body holds the appropriate accreditation. |
ISO standards are periodically reviewed and updated. Organisations should always verify that they are working to the current edition of ISO/IEC 27001 and applicable supporting standards, amendments, regulatory guidance and certification requirements.
Patient Guards Recent Posts
FDA Medical Device Classification: Class I, Class II and Class III Explained
Does your medical device require FDA 510(k) clearance? This step-by-step guide explains the 510(k) process, substantial equivalence, predicate devices, testing, eSTAR submissions, FDA review and what manufacturers need to do after clearance.
FDA 510(k) Clearance: A Step-by-Step Guide for Medical Device Manufacturers
Does your medical device require FDA 510(k) clearance? This step-by-step guide explains the 510(k) process, substantial equivalence, predicate devices, testing, eSTAR submissions, FDA review and what manufacturers need to do after clearance.
FDA Medical Device Regulations: A Complete Guide for Manufacturers
Planning to place a medical device on the US market? This complete guide explains FDA medical device regulations, including device classification, 510(k), De Novo and PMA pathways, QMSR and ISO 13485, establishment registration, device listing, U.S. Agent requirements, UDI and post-market obligations.
Patient Guards Related Services
Patient Guards Regulatory Tools
Need Training?
Do you need training on Quality Management Systems or EU MDR/ EU IVDR? then check out our training courses.
