ISO/IEC 27001 for a Moroccan SME: steps, realistic timeline and mistakes to avoid

A software company in Casablanca, forty employees, hosts payroll for French clients. In March, the largest of them sends its annual supplier questionnaire. One line has changed: ISO/IEC 27001 certification is now a condition for renewing the contract, with eighteen months to obtain it. The managing director calls his CIO that same evening. He wants to know what it involves, how long it takes and what to avoid. Here are the answers.

Why a Moroccan SME takes it on

The request rarely comes from inside. It arrives through a client. European principals pass on to their Moroccan suppliers the requirements their own regulators impose on them, and a certificate spares them auditing every supplier. Tenders from large groups and some public buyers list it as a selection or scoring criterion.

Two Moroccan frameworks add to that pressure. In the financial sector, institutions supervised by Bank Al-Maghrib must demonstrate documented governance of their information system security, and they pass that expectation on to their suppliers by contract. Law 05-20 on cybersecurity and its implementing decree 2-21-406 require vital-importance infrastructures and entities operating sensitive information systems to apply protection measures defined by the DGSSI. Neither text mentions the certificate. An ISMS does, however, provide the structure for applying those measures, tracing them and reporting on them to the authority.

What the 2022 edition contains

The standard describes an information security management system, the ISMS. It lists no products to buy. It asks the organisation to know its risks, decide how to treat them, act, then check and correct. The requirements fit in seven clauses, numbered 4 to 10 and shared by all ISO management standards: context, leadership, planning, support, operation, performance evaluation, improvement.

Annex A provides the reference list of security controls. In the edition published in October 2022 it holds 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological controls. The 2013 edition had 114, spread across 14 domains. Eleven controls are new, among them threat intelligence, cloud services security, configuration management, data masking, data leakage prevention, web filtering and secure coding. None applies by itself: the statement of applicability states, for each control, whether it is retained or excluded, and why. The auditor reads that document first and returns to it at every interview.

One thing to know before speaking to a certification body: the transition period between the two editions ended on 31 October 2025. A certificate issued against the 2013 version no longer holds any value and all certification is carried out against the 2022 version. An amendment of February 2024 added climate change to the issues to be examined in the context analysis, without altering Annex A.

The steps, in the order they happen

1. 1Framing and scope. Management appoints an ISMS owner and a sponsor. The scope is drawn by activities, sites, teams and systems, then written down. A gap assessment against the clauses and Annex A produces the list of what is missing.
2. 2Risk assessment. A method is chosen, often ISO/IEC 27005 or EBIOS Risk Manager, acceptance criteria are set, then risks are identified and evaluated. Each risk receives a decision: reduce, accept, transfer or avoid.
3. 3Treatment plan and statement of applicability. The selected controls are planned, each with an owner and a deadline. The statement of applicability records, for all 93 controls, the choice made and its justification.
4. 4Implementation. Policies and procedures written with the teams that will apply them, technical controls deployed, staff awareness, records that will serve as evidence. This is the longest stage.
5. 5Internal audit. A competent person independent of the activities audited checks conformity and the effectiveness of the controls. Findings are dealt with before the certification body is called in.
6. 6Management review. Management examines the audit results, indicators, incidents and the state of risks, then decides on resources and changes.

The certification audit comes in two stages

Stage 1 is a review of documentation and readiness. The auditor checks the scope, the risk method, the statement of applicability, that an internal audit and a management review have taken place, and flags anything that would prevent passing stage 2. Stage 2 looks at actual operation: interviews with teams, examination of records, tests on a sample of controls. Findings are classified as major or minor nonconformities. A major one must be corrected and verified before the certificate is issued.

The certificate is valid for three years. A surveillance audit takes place at least once per calendar year, the first within twelve months of the certification decision. Before the three years run out, a recertification audit, comparable to a stage 2, opens a new cycle. A missed surveillance exposes the organisation to suspension of its certificate.

How long it really takes

The durations below match what we observe in Moroccan SMEs of thirty to two hundred people, with a bounded scope and a part-time team. A vague scope or an absent management lengthens them.

• Framing, scope and gap assessment: three to six weeks.
• Risk assessment and treatment, through to the statement of applicability: one to two months, provided business owners attend the workshops.
• Implementation: four to eight months. Tools are deployed in a few weeks, working habits take months to change.
• Internal audit and management review: three to four weeks, corrections included. The certification body will also expect records covering several months of operation.
• Securing an audit date: often two to three months of waiting, to be requested as soon as the risk assessment is done.
• Between stage 1 and stage 2: a few weeks to three months, depending on the findings.

End to end, a realistic project runs nine to fourteen months to the certificate. Six months remain within reach with a security policy already applied, an up-to-date asset inventory and incident management in place. Faced with an offer promising the certificate in three months to an SME starting from scratch, one question is enough: what will actually be running on the day of stage 2?

The mistakes that cost an audit

The same causes come up in audit reports and in projects that bog down before stage 1.

• A scope that is too wide. Certifying the whole company in the first cycle multiplies assets, interviews and findings. A scope centred on the activity the client is looking at, extended in the next cycle, gets there more reliably.
• Documentation detached from reality. Policies bought or copied from another sector describe a company that does not exist. The auditor sees it at the first interview, when the interviewee does not recognise their own procedure.
• Risks copied from a template. A generic register reflects neither the real assets nor the real threats. The treatment plan and statement of applicability built on it become impossible to justify.
• No steering. Without a sponsor on the executive committee, a monthly review and arbitration of resources, the project rests on one person in the IT department and stops at their first busy period.
• A complacent internal audit. Entrusted to the person who built the system, it finds nothing. Stage 1 detects this and records it as a finding in its own right.
• A certification body without accreditation. Outside accreditation, the certificate carries no weight with a European client or a regulator. The body must be accredited for ISO/IEC 27001 under ISO/IEC 17021-1 and ISO/IEC 27006-1, by an accreditation body that signs the multilateral recognition arrangement, run by the IAF until 2025 and by the Global Accreditation Cooperation since January 2026. The accreditation number appears on the certificate and can be checked.

Who carries the system once the certificate is in

The certificate opens the longest part: three years of surveillance, an internal audit every year, a management review, risks to reassess at every change of activity, supplier or architecture. An SME that delegated everything to a consultancy finds itself, at the first surveillance, with nobody able to explain its own statement of applicability.

The answer lies in two or three trained people. The ISMS owner follows a Lead Implementer course: five days on running an implementation project, from scope to audit preparation. The person in charge of internal audits follows the Lead Auditor course to plan an audit, gather evidence and classify findings. PECB certifications, issued after an examination and validation of professional experience, give the auditor and the client alike a proof of competence they know how to read.

Corevia Technologie works on both fronts, separately or together: consulting, from framing to certification, with risk assessment, the security policy and, where needed, a fractional CISO; and training, as a PECB training and examination centre for the ISO/IEC 27001 Foundation, Lead Implementer and Lead Auditor courses and ISO/IEC 27005 Risk Manager.

What to start this month

For the CIO of the Casablanca software company, with eighteen months ahead of him, the first month comes down to five actions.

1. 1Obtain a written decision from the managing director: target scope, named sponsor, time allocated to the teams.
2. 2Commission a gap assessment against clauses 4 to 10 and the 93 controls.
3. 3Choose the risk assessment method and schedule the workshops with business owners.
4. 4Request quotes from two or three certification bodies and check their accreditation.
5. 5Enrol the future ISMS owner on a Lead Implementer course before the risk assessment starts.

In eighteen months the client will receive a copy of the certificate, with the scope written on it, and the next supplier questionnaire will find its answers in the ISMS documents.