A few years ago, ISO 27001 was something only multinationals and banks worried about in Ghana. That has changed. Businesses bidding for government tech contracts, partnering with international NGOs, supplying services to financial institutions, or onboarding enterprise clients are now routinely asked for ISO 27001 certification — or evidence that they're working toward it.
The problem is that most information about ISO 27001 is written for large compliance teams in Europe or the US. It's jargon-heavy, cost estimates are wildly off for the Ghanaian market, and it rarely answers the practical question most local business owners actually have: can we realistically do this, and where do we start?
This guide is the answer to that question.
This is written for business owners, operations leads, and IT managers at Ghanaian SMEs and mid-sized companies who have been asked about ISO 27001 by a client or regulator — or who are proactively preparing for certification. You don't need prior compliance experience to follow it.
What ISO 27001 Actually Is
ISO/IEC 27001 is the internationally recognised standard for Information Security Management Systems (ISMS). Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it defines a systematic approach to managing sensitive company information so that it remains secure — protecting its confidentiality, integrity, and availability.
The most recent version, ISO/IEC 27001:2022, updated the previous 2013 standard with a restructured set of security controls and a stronger emphasis on threat intelligence, cloud security, and data masking. If you began a certification journey before October 2022, your organisation needs to transition to the 2022 version.
A few important clarifications that often cause confusion:
- ISO 27001 is a management system standard, not a technical checklist. It's about how your organisation identifies, manages, and continuously improves its approach to information security — not just whether you have a firewall.
- Certification is issued by an accredited certification body, not by ISO itself. ISO writes the standard; third-party auditors certify you against it.
- It covers all information, not just digital data. Physical documents, verbal information, and printed records all fall within scope if they contain sensitive business or customer data.
- Certification is valid for three years, with mandatory surveillance audits in years two and three to verify you're maintaining compliance.
These are often confused. ISO 27001 is an internationally recognised management system standard — certifiable and globally portable. SOC 2 is a US-focused audit report (not a certification) primarily used by SaaS companies selling to US clients. GDPR is European data protection law — legal compliance, not a certification framework. For Ghanaian businesses selling globally, ISO 27001 is the most versatile credential to pursue first.
Why It Matters for Ghanaian Businesses Now
The demand for ISO 27001 certification is accelerating in Ghana for several converging reasons — and the window to be an early mover is narrowing.
- Bank of Ghana supplier requirements: Financial institutions regulated by BoG are increasingly requiring third-party suppliers — fintech partners, IT vendors, cloud providers — to demonstrate ISO 27001 certification or equivalent controls before being approved for procurement.
- Government procurement (GIFMIS/PPA): Public Procurement Authority tenders for technology services now regularly include information security requirements. ISO 27001 is the most widely accepted evidence that a vendor meets those requirements.
- Ghana's Data Protection Act 2012 (Act 843): While Act 843 doesn't mandate ISO 27001 specifically, implementing an ISO 27001 ISMS is the most structured way to demonstrate compliance with the Act's obligations around data protection, access controls, and breach response.
- International client contracts: Ghanaian businesses working with European clients are increasingly subject to GDPR supply chain requirements. ISO 27001 certification is the most recognised way to demonstrate adequate security controls to European data controllers.
- Competitive differentiation: In markets where several capable vendors can compete on technical skill and price, a certification your competitors don't have is a genuine sales tool — particularly in financial services, healthcare IT, and BPO.
The worst time to start an ISO 27001 journey is when a major client has given you 60 days to produce a certificate as a contract condition. Certification takes 6 to 18 months from a standing start. Starting proactively means you control the timeline — and you can use the certification as a sales asset rather than scrambling to avoid losing a contract.
What the Standard Actually Requires
ISO 27001:2022 is built on two interlocking components: the management system clauses (Clauses 4–10), which are all mandatory, and Annex A controls, which are a reference set of 93 security controls you select from based on your risk assessment.
| Clause | What It Requires | Typical Evidence |
|---|---|---|
| 4 — Context | Understand your organisation, interested parties, and define the ISMS scope | Scope document, stakeholder register, internal/external issue analysis |
| 5 — Leadership | Management commitment, information security policy, and defined roles | Signed IS policy, role assignments, board-level accountability evidence |
| 6 — Planning | Risk assessment methodology, risk treatment plan, and security objectives | Risk register, risk treatment plan, Statement of Applicability (SoA) |
| 7 — Support | Resources, competence, awareness, communication, and documented information | Training records, staff awareness logs, document control procedures |
| 8 — Operation | Implement risk treatment controls and manage operational security processes | Implemented Annex A controls, supplier contracts, incident logs |
| 9 — Performance Evaluation | Monitor, measure, and conduct internal audits and management reviews | Internal audit reports, management review minutes, KPI dashboards |
| 10 — Improvement | Handle nonconformities and drive continual improvement | Corrective action records, nonconformity log, improvement register |
The Annex A controls in ISO 27001:2022 are organised into four themes: Organisational controls (37), People controls (8), Physical controls (14), and Technological controls (34). You're not required to implement all 93 — only those that are relevant to your risk profile. But you must document your reasoning for excluding any control in your Statement of Applicability (SoA).
The SoA is one of the most scrutinised documents in an ISO 27001 audit. It lists every Annex A control, states whether it's applicable to your organisation, provides justification for each decision, and references the evidence of implementation. Auditors will check it against your actual practices. A poorly reasoned or inconsistent SoA is one of the most common causes of audit failure.
The Readiness Self-Assessment
Before engaging a certification body or consultant, work through these six questions honestly. Your answers will tell you whether you're six months from certification or eighteen months out — and where to focus first.
-
Do you have a documented information security policy signed by senior management?
Not a general IT policy or an acceptable use notice — a formal information security policy that defines your commitment to protecting information, assigns accountability, and is reviewed at least annually. If this doesn't exist, it's your first task. -
Have you conducted a formal risk assessment of your information assets?
ISO 27001 is risk-driven. You must identify what information your business holds, what threats and vulnerabilities apply to it, the likelihood and impact of those risks materialising, and how you treat each one. An informal mental model doesn't satisfy this — it must be documented and repeatable. -
Do you have documented procedures for your key security processes?
This includes access control (how staff are granted, changed, and revoked access), incident response (what happens when a breach occurs), change management (how system changes are authorised and tested), and backup and recovery (how data is protected and how long restoration takes). Undocumented processes are a significant audit gap. -
Can you demonstrate that staff receive regular security awareness training?
ISO 27001 requires evidence that employees understand their information security responsibilities. Training records, sign-off sheets, or completion logs from an awareness programme are the typical evidence. A single onboarding briefing from two years ago will not satisfy an auditor. -
Do your supplier and vendor contracts include information security obligations?
If you share data with cloud providers, outsourced IT partners, or cleaning staff with physical access to your premises, the standard requires that those relationships include defined security responsibilities. This is a common gap for businesses that have relied on informal arrangements with long-standing partners. -
Have you conducted an internal audit of your own ISMS in the past 12 months?
Internal audits are a mandatory Clause 9 requirement. You must audit your own ISMS at planned intervals, document findings, and act on any nonconformities identified. This cannot be performed by the person responsible for the area being audited. Many businesses at pre-certification stage have never done this — which means it must be built into the readiness timeline.
If you answered yes to 5–6 questions: you're likely 3–6 months from a Stage 1 audit with focused gap-closing work. Yes to 3–4: 6–9 months, with significant documentation and process work required. Yes to 0–2: 12–18 months minimum — but that's not a reason to delay starting. The sooner the gap is understood, the sooner it can be closed.
The Certification Process Step by Step
ISO 27001 certification follows a defined path. Understanding each stage in advance prevents the most common sources of delay and unexpected cost.
Define Scope and Appoint an ISMS Owner
Scope defines exactly what parts of your business the ISMS covers — which locations, business units, information systems, and processes. A tightly defined scope reduces the audit surface area and makes the project more achievable. A named, senior ISMS owner (often the IT Manager or Operations Director) must have clear authority and management backing for the programme. Without executive sponsorship, ISO 27001 projects stall at the documentation phase.
Conduct a Gap Assessment
A gap assessment compares your current state against the full requirements of ISO 27001:2022. It produces a prioritised list of what needs to be created, fixed, or formalised before you're audit-ready. This can be done by an internal team with knowledge of the standard, or by an external consultant. Either way, it should result in a structured remediation plan with owners, deadlines, and status tracking — not just a list of deficiencies.
Build and Implement the ISMS
This is the largest phase of the project. It involves completing the risk assessment, producing the risk treatment plan, writing the Statement of Applicability, developing all required policies and procedures, implementing the technical and organisational controls, delivering staff training, and beginning to generate the records and logs the auditor will review. For a typical 20–80 person business, this phase takes 3–9 months depending on the starting point and available internal capacity.
Run an Internal Audit
Before inviting an external auditor, conduct a full internal audit of your ISMS against all mandatory clauses. This identifies residual gaps, allows corrective actions to be completed, and gives the ISMS owner confidence in the system's readiness. The internal audit must be conducted by someone independent of the area being reviewed — this usually means either a trained internal auditor from another department, or a consultant hired specifically for this phase.
Stage 1 Audit — Documentation Review
The external certification body conducts a Stage 1 audit, which is primarily a review of your documentation: scope, risk assessment, SoA, key policies, and ISMS structure. The auditor is checking that your documented system is complete, coherent, and covers all mandatory clauses. Stage 1 typically results in a findings report identifying any areas that must be addressed before Stage 2. You usually have 2–6 months to close those findings.
Stage 2 Audit — Implementation Verification
The Stage 2 audit is a deeper on-site assessment where the auditor verifies that what your documents say is actually happening in practice. They will interview staff, review system configurations, check access control logs, examine training records, and test whether your incident response process is understood and operable. If no major nonconformities are found, the auditor recommends certification. Minor nonconformities require a corrective action plan submitted within a defined window.
Certification Issued and Surveillance Begins
Once the certification body's review panel approves the auditor's recommendation, your ISO 27001 certificate is issued — valid for three years. Annual surveillance audits (shorter, focused reviews) in years two and three confirm you're maintaining the ISMS. A full recertification audit occurs in year three before the certificate expires. Lapsing the certificate is not just an administrative problem — it can trigger breach-of-contract clauses with clients who specified it as a requirement.
Cost & Timeline Reality
The single biggest source of misinformation about ISO 27001 is cost estimates that bear no relationship to the Ghanaian market. Here is a realistic breakdown for a Ghanaian SME with 20–100 staff, a moderate IT environment, and no existing ISMS.
| Cost Component | Low Estimate | High Estimate | Notes |
|---|---|---|---|
| Gap assessment & consultancy | GHS 8,000 | GHS 35,000 | Depends on scope size and consultant experience; local firms significantly cheaper than international |
| ISMS documentation build | GHS 5,000 | GHS 20,000 | Can be reduced significantly with internal capacity; template frameworks are available but require heavy customisation |
| Staff training & awareness | GHS 2,000 | GHS 8,000 | ISO 27001 lead implementer training for the ISMS owner is strongly recommended; awareness programmes for all staff |
| Technical remediation (tools, controls) | GHS 3,000 | GHS 30,000+ | Highly variable — depends on existing security posture; businesses with weak baselines face higher remediation spend |
| Internal audit | GHS 2,500 | GHS 8,000 | Can be performed by a trained internal auditor or outsourced |
| Certification body fees (Stage 1 & 2) | GHS 15,000 | GHS 40,000 | Varies by certification body, organisation size, and whether auditor travel is required; UKAS-accredited bodies command a premium |
| Annual surveillance audits (per year) | GHS 7,000 | GHS 18,000 | Smaller in scope than the initial audit; required in years 2 and 3 of the certificate |
| Total to first certificate | ~GHS 35,000 | ~GHS 140,000 | Most Ghanaian SMEs land between GHS 50,000–90,000 total; larger scope and weaker starting points drive costs higher |
Timeline: From the start of a gap assessment to receiving your certificate, budget 9–18 months. Businesses with existing security maturity and dedicated internal capacity have achieved it in 6 months. Businesses starting from a low baseline with limited internal bandwidth commonly take 18 months or more. Rushing the process to meet an external deadline almost always results in audit failure — which costs more in re-audit fees and time than a managed timeline would have.
A market has emerged in Ghana and across West Africa for consultants offering ISO 27001 certificates through unaccredited or fraudulent certification bodies, sometimes for a fraction of the legitimate cost and in implausibly short timeframes. Clients, regulators, and contract counterparties can verify certificate legitimacy through the ISO's official certification database and will do so. A certificate from an unaccredited body is worthless and potentially fraudulent. Only work with certification bodies accredited by a recognised national accreditation body — in the UK, UKAS; in Germany, DAkkS; internationally verifiable through the IAF MLA database.
Common Mistakes That Fail Audits
After supporting businesses through ISO 27001 readiness assessments and audit preparation, these are the patterns that derail certifications most consistently:
- Treating it as a documentation project, not a management system: The most common failure mode is producing beautifully written policies that nobody follows. Auditors interview staff, check logs, and test whether your procedures are actually used. A policy that says "access rights are reviewed quarterly" will fail if your HR and IT teams have never done a quarterly review and have no record of one.
- Defining scope too broadly at the start: Including every system, every office, and every business unit in your initial scope makes the project larger, more expensive, and harder to control. A focused initial scope — your core IT systems and the team that manages them — is far more manageable for a first certification. You can expand scope at recertification.
- No evidence of management review: Clause 5 requires top management to be actively involved in the ISMS — not just to have signed a policy once. Auditors will ask to see management review meeting minutes, evidence that the ISMS results have been presented to leadership, and records of decisions made. If the ISMS exists below the radar of senior management, this is a major nonconformity.
- Incomplete Statement of Applicability: The SoA must address all 93 Annex A controls. Excluding a control without documented justification, or listing a control as implemented without evidence that it actually is, are both findings that will either delay certification or result in nonconformity. The SoA must reflect reality, not aspiration.
- No nonconformity records before the audit: ISO 27001 requires you to manage and record nonconformities — security incidents, process failures, near-misses, and deviations from procedure. If you enter a Stage 2 audit with zero recorded nonconformities, the auditor's conclusion is usually not that you have a perfect ISMS, but that you have a system that isn't monitoring itself properly. Some documented and corrected nonconformities are a sign of a healthy, functioning system.
- Changing supplier relationships after scope is defined: Introducing new cloud providers, outsourcing arrangements, or third-party processors after your risk assessment is finalised — without updating the risk register and supplier agreements — is a gap that auditors frequently catch. Information security requirements must flow to all new suppliers within scope from the point of engagement.
GreyFixTech's security team supports Ghanaian businesses through every stage of ISO 27001 readiness — from initial gap assessment and ISMS build to internal audit preparation and certification body liaison. We understand the local regulatory context, the realistic cost envelope, and what Ghanaian auditors actually scrutinise. Book a free readiness consultation →
