Three key tips to secure your ISO 27001 certification

To explore how to approach the process in the best possible way — and achieve both stronger security and the certification — we sat down with two experienced auditors: Lars Christensen and Mikkel Lundstrøm from Monthe Certificering.

Here are their three key tips:

Let strategy lead the way

When a company approaches Monthe Certificering, there are usually three main reasons they want to become certified.

Some face pressure from customers demanding stronger information security. Others must comply with regulatory requirements — for example from NIS2, DORA or CER legislation. And then there are those whose leadership teams strategically view cyber and information security as a core priority.

According to Mikkel Lundstrøm, the process works best when the motivation is strategic. As he puts it:

“If it’s purely about ticking off a few controls and you push the responsibility down the organisation just to get it done, you’ll end up with a less effective system.”

{{factbox-dark}}

Leadership support is essential

Leadership backing is absolutely crucial for success. That’s the clear experience from Monthe Certificering.

As Lars Christensen explains:

“There’s no doubt that when it’s anchored at leadership level — when it’s a strategic decision and they lead from the front — the chances of success with your management system are much higher.”

Leadership involvement has become increasingly important. As Christensen adds:

“In the past, top management could keep a comfortable distance — but that no longer works. They must now be actively involved.”

Get information security out of the binders

A strategic mindset and leadership support are a strong start — but information security must also live and breathe in the organisation, not just sit in dusty binders.

As Mikkel Lundstrøm puts it:

“In the old days you had metre-long shelves filled with binders of documents. Now it’s about making things less bureaucratic. If you work in a compliance department, you don’t always understand what’s happening on the shop floor. You need to involve the people doing the actual work. The more operational it is — and the fewer binders — the better.”

‍