ISO 27001 Certification in Morocco: A Guide for Companies and Pros

ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS). It does not prescribe a list of tools to install: it requires a method for identifying risks to information, choosing suitable controls, applying them, measuring them and continually improving them.

The phrase "ISO 27001 certification" covers two different things, and they are often confused in Moroccan tenders and job ads alike:

A company cannot declare itself certified. Certification is issued by an independent certification body, ideally accredited by a recognized accreditation body (an IAF member, for instance), which ensures the certificate will be recognized by foreign clients. Before choosing a certifier, check its accreditation and scope.

The initial audit has two stages: a documentation and readiness review (stage 1), then an on-site audit of actual implementation (stage 2). The certificate is valid for three years, with annual surveillance audits followed by a recertification audit. The certificate states a precise scope: a site, an activity, a service. A company can therefore start with its most exposed scope, such as its offshore delivery centre or its hosting.

For professionals, the most widespread individual certifications are offered by bodies such as PECB. They do not certify a company; they attest that a person can implement or audit an ISMS.

The two profiles complement each other but are not hired for the same work. A company starting its project first needs a Lead Implementer; a consultant targeting audit engagements, or an internal auditor, should go for Lead Auditor.

The 2022 edition replaced the 2013 one. Clauses 4 to 10, which describe the management system, were slightly adjusted (notably on planning changes and monitoring processes). The most visible change is in Annex A, now aligned with ISO/IEC 27002:2022: the 114 controls spread across 14 domains were consolidated into 93 controls organized in 4 themes.

Eleven controls are new, including threat intelligence, information security for cloud services, ICT readiness for business continuity, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. An amendment published in 2024 also added climate change considerations to the analysis of context. The transition period from the 2013 edition is over: valid certificates now refer to the 2022 edition.

Project length depends on the size of the organization, its existing maturity and the chosen scope. The steps, however, stay the same, and order matters: skipping the context analysis or risk assessment weakens everything that follows.

The usual pitfalls are well known: a scope that is too broad from day one, a risk assessment copied from a generic template, documentation written for the auditor but ignored by staff, or management losing interest after kickoff. A successful ISMS is a living system: risks are reassessed when the business changes, incidents feed corrective actions and metrics are genuinely reviewed by a committee. The key steps:

In Morocco, the decision to get certified is rarely purely internal. It usually responds to pressure from the market or the regulatory environment.

The drivers that come up most often:

Certifying an ISMS without anyone in-house able to run it often means depending entirely on an outside consultant. Training one or two staff members as Lead Implementers keeps the project under your control, lets you deal with the certification body as an equal and keeps the system alive after the audit. For a CISO running the broader programme, CISM or CISSP complement this skill set well.

GATech offers the PECB ISO/IEC 27001 Lead Implementer course in Morocco over 5 days (35 hours), based on the 2022 edition, PECB exam included, from 17,900 MAD, in class in Casablanca or Rabat, or online. PECB annual certification maintenance fees are not included.