You must establish and implement an information security management system (ISMS) in order to be eligible for ISO 27001 certification. The system must be audited internally as well as externally by an independent accredited certification body. Provided the ISMS fulfills all requirements laid down in the standard, the certification body will issue a corresponding certificate.