---
tags:
  - iso27001
  - audit
---

Our Stage 1 audit is coming up soon. If you’ve done this before as a startup, what did your auditor focus on during Stage 1?

> Buy the standards:
> - ISO27001 - it describes the "what"
> - ISO27002 - it describes the "how" in relation to the controls
> - ISO27003 - it describes the "how" in relation to the harmonised structure.

>All depends on your auditor, but in general they look if you are ready for the audit. You should have had an internal audit, that should give you a lot of information on what you are missing. In my experience they focus on the management system, so not so much the annex. Just read this part of the standard and make sure you comply with all that is requested there. 
>Focus on risk analysis, stakeholders, incident response, policies, internal audit, improvement register.

> You need to first perform a gap assessment. Document each requirement in the standard, including those defined in the Management Clauses, and simply measure yourself against how you meet each control.
> 
> 1: Not Ready 2: We’re there 3: We’re there and have evidence.
> 
> Additionally, you’ll need to have an Internal Audit performed by a competent 27001 auditor before you can get certified, it’s a requirement of the management clauses. This Internal Audit can prepare you for what you may be missing before the certification body auditors find issues.

> Stage 1 is a "readiness assessment" and document audit.
> There are very few documents that ISO 27001 actually mandates - like, about 12. The auditor will be checking that you have those required docs, and that you have any docs that you have said you need.
> Search the Standard for: "shall be documented" and "documentation shall be maintained", you'll find most of the stuff you MUST have.
> 
> You also MUST do a whole system internal audit BEFORE you reach Stage 2 (or MajorNC), and it's a really good idea to do it, or most of it, before Stage 1. A decent internal audit will help you find anything that's missing.

> As others said, first stage is primarily ISMS strategy and having documentation/processes in order.

