# How do we prepare for our first ISO 27001 certification audit?

Start with scope and evidence, not with documents for their own sake. First fix the scope: which organisation, sites, services and systems the certificate will cover, chosen so that it matters to customers and can be finished. Then do the core work the standard requires: a risk assessment and treatment plan, a statement of applicability, the mandatory policies and procedures, assigned roles, staff awareness, and controls that actually run. Let them run long enough to produce records, such as access reviews, change approvals, incident tickets, supplier checks and monitoring reviews, because auditors test evidence of operation, not intentions. Run an internal audit and a management review before the external audit, and fix what they find. Certification audits are usually done in two stages: first a review of your documentation and readiness, then an assessment of whether the system works in practice. Choose an accredited certification body, and keep the consultant who helps you separate from the auditor. For the monitoring controls, NetSenX’s network map, alert history, audit log and PDF compliance reports can be part of your evidence; NetSenX does not audit or certify anything.

FAQ: [Security standards: ISO 27001, SOC 2](https://netsenx.com/en/faq/standards) · https://netsenx.com/en/faq/how-to-prepare-for-a-first-iso-27001-audit

## Read next

- https://netsenx.com/en/compliance
- https://netsenx.com/en/security
- https://netsenx.com/en/nis2-readiness

## Related questions

- [What is ISO/IEC 27001, in plain terms?](https://netsenx.com/en/faq/what-is-iso-27001)
- [What is an information security management system?](https://netsenx.com/en/faq/what-is-an-isms)
- [What is a statement of applicability in ISO 27001?](https://netsenx.com/en/faq/what-is-a-statement-of-applicability)
- [What is SOC 2, and why do customers ask for it?](https://netsenx.com/en/faq/what-is-soc-2)
- [What is the difference between a SOC 2 Type 1 and a Type 2 report?](https://netsenx.com/en/faq/soc-2-type-1-vs-type-2)