The integration of information technology as a fundamental part of the operational core of organizations has increased their exposure to information security risks and, consequently, has introduced the need for adequate security measures. The implementation of an Information Security Management System is covered by several international standards belonging to the ISO/IEC 27000 family, some of which can be used for certification purposes. This process requires that an accredited certification body reviews the entire documentation and verifies the related controls' implementation by carrying out the audit. Since it is a complex activity with a remarkable subjectivity margin, a guidance such as ISO/IEC 27008 (Guidelines for the assessment of information security controls) is essential.