To get certified, you only need to develop information security management, verify that it is working and have it audited by a third-party body.