A simplified answer is that you need to establish policies for information security, identify your information assets, perform a risk assessment on those assets, establish a management structure to implement the defined policies and controls and then establish a continual improvement process to ensure that those policies and their implementation are under constant review and enhancement.  All of that needs to be documented in a way which can be shown to fulfill the requirements of the ISO/IEC 27001 ‘Statement of Applicability’.