ISO 27001 Certification in Kenya: The Process, Step by Step

Who can certify you

Only a certification body can issue an ISO 27001 certificate, and the certificate is only meaningful if that body is accredited for ISO 27001 by a recognised accreditation body. In Kenya the national accreditation body is the Kenya Accreditation Service (KENAS). Certification bodies operating in Kenya may also hold accreditation from foreign accreditation bodies that are members of the International Accreditation Forum (IAF), which is generally recognised in the same way.

Consultants, including Neurobyte, cannot certify you. A consultant helps you build and prepare the ISMS; an independent certification body audits it. A firm that offers to do both for the same client, or that offers a certificate without an accredited audit, should be treated with suspicion. Ask any certification body which accreditation covers its ISO 27001 scheme, and check that the accreditation body is an IAF member.

The current version: ISO/IEC 27001:2022

The current edition is ISO/IEC 27001:2022. It reorganised Annex A into 93 controls grouped in four themes: organisational, people, physical and technological, and added controls for areas such as threat intelligence, cloud services, secure coding, data masking and monitoring activities. The transition period for certificates issued against the 2013 edition has ended, so any new certification, and any certificate you are shown by a supplier, should be against the 2022 version.

The core requirements in clauses 4 to 10 are what auditors spend most of their time on: understanding the organisation's context, leadership commitment, risk assessment and treatment, resources and competence, operational control, performance evaluation through monitoring, internal audit and management review, and continual improvement.

The certification process, step by step

The table above summarises the stages. Three of them deserve more attention because they are where projects go wrong.

• Scoping. A scope that is too broad stalls the project; one that is too narrow produces a certificate customers will not accept. Scope to what your customers and regulators actually care about, usually the systems and teams that handle their data, and make sure the scope statement on the certificate will say that clearly.
• Risk assessment. This is the heart of the standard and the part most often copied from a template. Auditors look for a method you actually use, risks that reflect your real environment, and a clear line from each risk to the controls that treat it.
• Operating evidence. A Stage 2 auditor needs records that controls have been running: access reviews completed, backups tested, incidents logged, training delivered, suppliers assessed. Documents written the month before the audit, with no history of use, are the most common reason for major nonconformities.

Stage 1 and Stage 2 audits

The certification audit happens in two stages. Stage 1 is mainly a documentation and readiness review: the auditor checks your scope, ISMS policy, risk assessment, Statement of Applicability, internal audit and management review, and tells you whether you are ready for Stage 2. Issues found here can be fixed before Stage 2.

Stage 2 tests whether the ISMS works in practice. The auditor interviews staff, samples records and observes controls. Findings are graded as major nonconformities, which must be corrected before a certificate is issued, or minor nonconformities, which need an accepted corrective action plan. Once findings are closed, the certification body issues the certificate.

How long it takes

There is no fixed duration, and anyone quoting one before seeing your organisation is guessing. The main drivers are the size and complexity of the scope, how mature your existing security practice is, how much leadership time is available, and how long you need to operate the controls to produce credible evidence. An organisation that already runs disciplined IT operations can move far faster than one building policies, asset inventories and access reviews from nothing.

Plan for the operating period explicitly. Certification bodies want to see the ISMS working, including at least one internal audit and one management review, before Stage 2. Compressing that period is the most common reason a first audit produces major findings.

After certification: surveillance and recertification

An ISO 27001 certificate is valid for three years. During that cycle the certification body carries out surveillance audits, normally annually, sampling parts of the ISMS to confirm it is still operating and improving. In the third year a recertification audit renews the certificate for another cycle.

This is why certification is a commitment rather than a project. Budget for the internal audit, management review and evidence collection every year, and assign an owner who will still be there at the next surveillance audit.

How to verify an ISO 27001 certificate

If a supplier tells you they are ISO 27001 certified, ask for the certificate and check four things: the certification body's name and accreditation mark, the standard version (it should be 2022), the expiry date, and the scope statement, which tells you which part of the business is actually certified. Many certification bodies list valid certificates on their websites, and the IAF CertSearch database can confirm accredited certificates.

Be careful with the phrase ISO 27001 aligned or compliant. It usually means the organisation follows the standard without independent certification. That can be entirely legitimate, but it is not the same claim, and our guide on certified versus aligned explains the difference.

Key takeaways

• Only an accredited certification body can issue a meaningful ISO 27001 certificate; in Kenya the national accreditation body is KENAS, and IAF-member accreditation is generally recognised.
• Consultants help you build and prepare the ISMS; they cannot certify you.
• Certification is against ISO/IEC 27001:2022, with 93 Annex A controls in four themes.
• Stage 1 checks documentation and readiness; Stage 2 tests that controls operate. Operating evidence is what most first audits lack.
• A certificate lasts three years with surveillance audits in between, so budget for the ISMS as an ongoing system.

Frequently asked questions