Free consultation
ISO/IEC 27001 implementation
ISO/IEC 27001:2022

ISO/IEC 27001 implementation

We build an information security management system that passes the audit and actually protects your data — from risk assessment to certificate and beyond.

Free consultation
3–6 monthstypical implementation time
93controls in Annex A
3 yearscertificate validity
Why it matters

ISO 27001 — information security

ISO/IEC 27001 is the international standard for information security management. Certification proves to clients, partners and institutions that your company manages information risk systematically — not just that it has antivirus software.

The current version is ISO/IEC 27001:2022. Its Annex A contains 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). Not all of them are mandatory — which ones apply is decided by the risk assessment and documented in the Statement of Applicability (SoA).

Annex A · ISO/IEC 27001:2022

The map of all 93 controls

Every control, organised in the four themes of the standard. Point at a dot on the shield or pick a theme to see what each control protects.

93 controls
  1. 5.1 Policies for information security
  2. 5.2 Information security roles and responsibilities
  3. 5.3 Segregation of duties
  4. 5.4 Management responsibilities
  5. 5.5 Contact with authorities
  6. 5.6 Contact with special interest groups
  7. 5.7 Threat intelligence New
  8. 5.8 Information security in project management
  9. 5.9 Inventory of information and other associated assets
  10. 5.10 Acceptable use of information and other associated assets
  11. 5.11 Return of assets
  12. 5.12 Classification of information
  13. 5.13 Labelling of information
  14. 5.14 Information transfer
  15. 5.15 Access control
  16. 5.16 Identity management
  17. 5.17 Authentication information
  18. 5.18 Access rights
  19. 5.19 Information security in supplier relationships
  20. 5.20 Addressing information security within supplier agreements
  21. 5.21 Managing information security in the ICT supply chain
  22. 5.22 Monitoring, review and change management of supplier services
  23. 5.23 Information security for use of cloud services New
  24. 5.24 Incident management planning and preparation
  25. 5.25 Assessment and decision on information security events
  26. 5.26 Response to information security incidents
  27. 5.27 Learning from information security incidents
  28. 5.28 Collection of evidence
  29. 5.29 Information security during disruption
  30. 5.30 ICT readiness for business continuity New
  31. 5.31 Legal, statutory, regulatory and contractual requirements
  32. 5.32 Intellectual property rights
  33. 5.33 Protection of records
  34. 5.34 Privacy and protection of PII
  35. 5.35 Independent review of information security
  36. 5.36 Compliance with policies, rules and standards
  37. 5.37 Documented operating procedures
  1. 6.1 Screening
  2. 6.2 Terms and conditions of employment
  3. 6.3 Information security awareness, education and training
  4. 6.4 Disciplinary process
  5. 6.5 Responsibilities after termination or change of employment
  6. 6.6 Confidentiality or non-disclosure agreements
  7. 6.7 Remote working
  8. 6.8 Information security event reporting
  1. 7.1 Physical security perimeters
  2. 7.2 Physical entry
  3. 7.3 Securing offices, rooms and facilities
  4. 7.4 Physical security monitoring New
  5. 7.5 Protecting against physical and environmental threats
  6. 7.6 Working in secure areas
  7. 7.7 Clear desk and clear screen
  8. 7.8 Equipment siting and protection
  9. 7.9 Security of assets off-premises
  10. 7.10 Storage media
  11. 7.11 Supporting utilities
  12. 7.12 Cabling security
  13. 7.13 Equipment maintenance
  14. 7.14 Secure disposal or re-use of equipment
  1. 8.1 User endpoint devices
  2. 8.2 Privileged access rights
  3. 8.3 Information access restriction
  4. 8.4 Access to source code
  5. 8.5 Secure authentication
  6. 8.6 Capacity management
  7. 8.7 Protection against malware
  8. 8.8 Management of technical vulnerabilities
  9. 8.9 Configuration management New
  10. 8.10 Information deletion New
  11. 8.11 Data masking New
  12. 8.12 Data leakage prevention New
  13. 8.13 Information backup
  14. 8.14 Redundancy of information processing facilities
  15. 8.15 Logging
  16. 8.16 Monitoring activities New
  17. 8.17 Clock synchronisation
  18. 8.18 Use of privileged utility programs
  19. 8.19 Installation of software on operational systems
  20. 8.20 Networks security
  21. 8.21 Security of network services
  22. 8.22 Segregation of networks
  23. 8.23 Web filtering New
  24. 8.24 Use of cryptography
  25. 8.25 Secure development life cycle
  26. 8.26 Application security requirements
  27. 8.27 Secure system architecture and engineering principles
  28. 8.28 Secure coding New
  29. 8.29 Security testing in development and acceptance
  30. 8.30 Outsourced development
  31. 8.31 Separation of development, test and production environments
  32. 8.32 Change management
  33. 8.33 Test information
  34. 8.34 Protection of information systems during audit testing

11 new controls in the 2022 edition

ISO/IEC 27001:2022

What the implementation includes

01

Gap analysis

Your current state against the standard, with a prioritised plan.

02

Scope and context

System boundaries, interested parties and their requirements.

03

Risk assessment

Asset register, threats, vulnerabilities and a risk treatment plan.

04

Documentation

Information security policy, procedures and SoA — only what is needed.

05

Technical measures

Real implementation of controls: access, MFA, backups, logging, encryption.

06

Audit and certification

Internal audit, management review and support during the certification audit.

Who

Who it is for

  • IT and software companies working with enterprise or international clients
  • Companies that process personal or sensitive data
  • Bidders in public procurement and tenders
  • Organisations in scope of NIS2 — ISO 27001 is the best framework to meet it
  • Suppliers to large companies that require certification across their supply chain
Route to certification

Six stages, one clear route

Select a stage to see what you get and how long it takes. The certificate is issued by an independent accredited body — we guide you to the audit.

START · DAY 1
01
Stage 1 of 6 · 1–2 weeks

Gap analysis

We compare your current state with the requirements of the standard and find what is missing.

01 How much does ISO 27001 implementation cost?

It depends on headcount, scope and your current state. After the free gap analysis you get a fixed quote. The certification body fee is paid separately.

02 Who issues the certificate?

An accredited certification body of your choice. We prepare the system and stay with you during the audit.

03 Do we need our own IT department?

No. We also handle the technical side — that is what sets us apart from documentation-only consultants.

Related services
ISO 9001 — quality management Processes, responsibilities and KPIs that help your team instead of slowing it down. NIS2 and cybersecurity Are you in scope and what do you need to do — clear and step by step. Gap analysis and internal audit Where you stand against the standard and exactly what is missing — with a plan and dates.

Your first consultation is free

Tell us about your company and your goal. You will get a clear plan and a quote within one business day.

Book a consultation