By 2026, ISO 27001 has long since gone from nice-to-have to required proof. Cyber insurers and large customers ask for it. Through NIS2 supply-chain duties, more and more customers also require it from their B2B suppliers. The path to the certificate is well known, but it is long: usually 12–18 months, consulting costs in the five figures and many rounds of rework.
SecTepe.Core gives you a structured 6-phase roadmap with phase gating, templates and a guided wizard.
The Six Phases at a Glance
- Scope & stakeholders: scope, interfaces, interested parties and commitment from top management.
- Risk assessment & risk treatment: asset list, threat modelling, risk rating and treatment choices.
- Statement of Applicability (SoA): pick the Annex A controls and give reasons for each one you include or leave out.
- Implementation & documentation: policies, procedures, technical measures and awareness programs.
- Internal audit & management review: check what works, record nonconformities and plan corrective actions.
- Certification audit (stage 1 + stage 2): get ready, get support during the audit and fix the findings.
What Phase Gating Means in Practice
Each phase has clear entry and exit criteria. For example, you can only close phase 3 (SoA) once the risk assessment from phase 2 is done. Without it, you have no reason for any control choice. The platform does not block you rigidly. But it makes a skipped step visible and flags it in the audit report.
Templates That Save Weeks
Experience shows that a team building its first ISMS spends 20–30 % of the project time on standard documents:
- ISMS policy, statement of applicability, context analysis.
- Risk method, risk acceptance criteria, escalation paths.
- Asset classification, rules for handling information.
- Supplier security rules, BCDR plan templates, reporting paths.
SecTepe.Core ships templates for all these documents in German and English. They fit GDPR and BSI rules. A wizard adapts them to your company, so you don't start from an empty Word file.
ISO 27002:2022 Is Pre-Loaded in the SoA Step
The SoA module comes with the 93 controls from ISO 27002:2022 as an interactive list. For the most common include or exclude choices, it has default reasons ready. Say you don't run a cloud service. Then you can exclude A.5.23 (cloud security) with one click and a reason text that is already filled in.
Audit Prep: Evidence From Phase 5 Goes Straight Into the Stage 2 Report Folder
You don't have to copy 200 documents into an auditor folder by hand. SecTepe.Core builds a structured export in the layout auditors usually expect: chapters, cross-links to SoA controls and evidence for each measure. External ISOs know the structure at once. That makes audit support much faster.
Where the Platform Is Not Magic
A roadmap won't win commitment from top management for you. It won't run the awareness training, and it won't test the BCDR plan. But it takes the friction out of everything around those tasks. So the real work gets the full attention it needs, instead of getting lost in a pile of paperwork.
Conclusion
In 2026, ISO 27001 certification is a project you can plan, as long as you have structure, templates and phase gating. A platform like SecTepe.Core gives you all three. It replaces the usual mix of consulting handbook, Excel and SharePoint. The result: a shorter time to the certificate, lower consulting costs and more confidence going into the audit.