Free consultation
ISO/IEC 27001 — Information security management system
Security and resilience

ISO/IEC 27001:2022 Information security management system

The international standard that proves to clients, partners and regulators that you manage information risk systematically — from policies to servers.

Free consultation Readiness test
controls in Annex A
93
control themes
4
mandatory clauses (4–10)
7
certificate validity
3 yrs
01 · Overview

What is ISO 27001

ISO/IEC 27001 sets the requirements for an information security management system (ISMS). It protects the three core properties of information — confidentiality, integrity and availability — through risk management, not a list of products.

The standard is published jointly by ISO and IEC. The current version dates from 2022; the transition period from the 2013 version ended on 31 October 2025.

Certification is performed by an accredited certification body and is valid for 3 years, with surveillance audits every year.

02 · Structure

The structure of the standard

Clauses 4–10 are mandatory and follow the common structure of ISO management system standards — which is why 27001 integrates easily with ISO 9001.

PDCA · Plan

Clause 4 — Context of the organisation

Internal and external issues, interested parties and their requirements, scope of the system.

PDCA · Plan

Clause 5 — Leadership

Management commitment, information security policy, roles and responsibilities.

PDCA · Plan

Clause 6 — Planning

Risk assessment and treatment, Statement of Applicability, security objectives, planning of changes.

PDCA · Do

Clause 7 — Support

Resources, competence, awareness, communication and documented information.

PDCA · Do

Clause 8 — Operation

Operational planning and control, performing risk assessment and treatment.

PDCA · Check

Clause 9 — Performance evaluation

Monitoring and measurement, internal audit and management review.

PDCA · Act

Clause 10 — Improvement

Nonconformity, corrective action and continual improvement.

03 · Annex A

Annex A: 93 controls in 4 themes

Which controls you apply is decided by the risk assessment and recorded in the Statement of Applicability (SoA). The 2022 edition introduced 11 new controls.

A.5 37

Organisational

Policies, roles, suppliers, incidents, cloud services.

40% of all controls
A.6 8

People

Screening, training, remote working.

9% of all controls
A.7 14

Physical

Physical entry, equipment, media, disposal.

15% of all controls
A.8 34

Technological

Access, backup, logging, cryptography, secure development.

37% of all controls
2022 11 new controls in the 2022 edition 5.7 · 5.23 · 5.30 · 7.4 · 8.9 · 8.10 · 8.11 · 8.12 · 8.16 · 8.23 · 8.28
Annex A · ISO/IEC 27001:2022

The map of all 93 controls

Every control, organised in the four themes of the standard. Point at a dot on the shield or pick a theme to see what each control protects.

93 controls
  1. 5.1 Policies for information security
  2. 5.2 Information security roles and responsibilities
  3. 5.3 Segregation of duties
  4. 5.4 Management responsibilities
  5. 5.5 Contact with authorities
  6. 5.6 Contact with special interest groups
  7. 5.7 Threat intelligence New
  8. 5.8 Information security in project management
  9. 5.9 Inventory of information and other associated assets
  10. 5.10 Acceptable use of information and other associated assets
  11. 5.11 Return of assets
  12. 5.12 Classification of information
  13. 5.13 Labelling of information
  14. 5.14 Information transfer
  15. 5.15 Access control
  16. 5.16 Identity management
  17. 5.17 Authentication information
  18. 5.18 Access rights
  19. 5.19 Information security in supplier relationships
  20. 5.20 Addressing information security within supplier agreements
  21. 5.21 Managing information security in the ICT supply chain
  22. 5.22 Monitoring, review and change management of supplier services
  23. 5.23 Information security for use of cloud services New
  24. 5.24 Incident management planning and preparation
  25. 5.25 Assessment and decision on information security events
  26. 5.26 Response to information security incidents
  27. 5.27 Learning from information security incidents
  28. 5.28 Collection of evidence
  29. 5.29 Information security during disruption
  30. 5.30 ICT readiness for business continuity New
  31. 5.31 Legal, statutory, regulatory and contractual requirements
  32. 5.32 Intellectual property rights
  33. 5.33 Protection of records
  34. 5.34 Privacy and protection of PII
  35. 5.35 Independent review of information security
  36. 5.36 Compliance with policies, rules and standards
  37. 5.37 Documented operating procedures
  1. 6.1 Screening
  2. 6.2 Terms and conditions of employment
  3. 6.3 Information security awareness, education and training
  4. 6.4 Disciplinary process
  5. 6.5 Responsibilities after termination or change of employment
  6. 6.6 Confidentiality or non-disclosure agreements
  7. 6.7 Remote working
  8. 6.8 Information security event reporting
  1. 7.1 Physical security perimeters
  2. 7.2 Physical entry
  3. 7.3 Securing offices, rooms and facilities
  4. 7.4 Physical security monitoring New
  5. 7.5 Protecting against physical and environmental threats
  6. 7.6 Working in secure areas
  7. 7.7 Clear desk and clear screen
  8. 7.8 Equipment siting and protection
  9. 7.9 Security of assets off-premises
  10. 7.10 Storage media
  11. 7.11 Supporting utilities
  12. 7.12 Cabling security
  13. 7.13 Equipment maintenance
  14. 7.14 Secure disposal or re-use of equipment
  1. 8.1 User endpoint devices
  2. 8.2 Privileged access rights
  3. 8.3 Information access restriction
  4. 8.4 Access to source code
  5. 8.5 Secure authentication
  6. 8.6 Capacity management
  7. 8.7 Protection against malware
  8. 8.8 Management of technical vulnerabilities
  9. 8.9 Configuration management New
  10. 8.10 Information deletion New
  11. 8.11 Data masking New
  12. 8.12 Data leakage prevention New
  13. 8.13 Information backup
  14. 8.14 Redundancy of information processing facilities
  15. 8.15 Logging
  16. 8.16 Monitoring activities New
  17. 8.17 Clock synchronisation
  18. 8.18 Use of privileged utility programs
  19. 8.19 Installation of software on operational systems
  20. 8.20 Networks security
  21. 8.21 Security of network services
  22. 8.22 Segregation of networks
  23. 8.23 Web filtering New
  24. 8.24 Use of cryptography
  25. 8.25 Secure development life cycle
  26. 8.26 Application security requirements
  27. 8.27 Secure system architecture and engineering principles
  28. 8.28 Secure coding New
  29. 8.29 Security testing in development and acceptance
  30. 8.30 Outsourced development
  31. 8.31 Separation of development, test and production environments
  32. 8.32 Change management
  33. 8.33 Test information
  34. 8.34 Protection of information systems during audit testing

11 new controls in the 2022 edition

04 · Benefits

What you gain

Trust and new clients

Enterprise and international clients increasingly ask for it in the first enquiry.

A basis for NIS2

Covers a large part of the directive’s cybersecurity risk-management measures.

Fewer incidents

Risks are identified and treated before they turn into losses.

Order in access

Clear who can access what, who is responsible and what happens in an incident.

An edge in tenders

Certification is a criterion in many public and private tenders.

Support for GDPR

Technical and organisational controls also evidence personal data protection.

05 · Process

The route to certification

Six stages, clear timelines and a deliverable at every stage.

See the service
  1. 01

    Gap analysis

    Where you stand and what to do first.

    1–2 wks
  2. 02

    Scope and risk

    Asset register, risk assessment and treatment plan.

    2–3 wks
  3. 03

    Documentation and SoA

    Policies, procedures and Statement of Applicability.

    3–4 wks
  4. 04

    Implementation and training

    Technical controls, records and staff training.

    4–8 wks
  5. 05

    Internal audit

    Verification, management review, corrective actions.

    1–2 wks
  6. 06

    Certification audit

    Stage 1 and Stage 2 by an accredited body.

    Stage 1 + 2
06 · Timeline & cost

Timeline and cost — what drives them

There is no “standard price” for ISO 27001. These are the factors that set it — plus an indicative timeline estimator.

01

Employees and sites

Set the workload and the certification body’s audit days (per ISO/IEC 27006).

02

Scope

The whole company or a specific service, product or office.

03

Current maturity

Which policies, processes and technical controls already exist.

04

IT environment

Cloud, own servers, development, number of critical systems.

05

Suppliers

How many critical suppliers and cloud services must be assessed.

06

Certification fee

Paid separately to the certification body.

Indicative timeline
Current security maturity
Sites
4–5 months to certification audit readiness

Indicative only. An exact plan and quote follow the free gap analysis.

Free consultation
01 Are all 93 controls mandatory?

No. Clauses 4–10 are mandatory. Annex A controls are selected based on the risk assessment, and the selection and justification are documented in the Statement of Applicability (SoA).

02 What is the difference between ISO 27001 and ISO 27002?

ISO 27001 contains the requirements and is certifiable. ISO 27002 is guidance on how to implement each control — it is not certifiable.

03 Can the certificate cover only part of the company?

Yes. You define the scope — for example a specific service, product or office. It must be clearly described and defensible to the auditor.

04 What happens at the surveillance audit?

Once a year the certification body checks selected parts of the system and whether it keeps working and improving. In the third year there is a recertification.

05 Does ISO 27001 meet NIS2?

It covers a large part of the Article 21 measures, but NIS2 also has its own requirements — incident reporting deadlines and management accountability. We cover both.

06 How long does it take?

For a company of up to 50 people, usually 3 to 6 months to certification audit readiness. Use the estimator for guidance.

Further reading
ISO 27001 — information securityRisk assessment, Statement of Applicability and implementation of the Annex A controls. ISO 27001:2022 — the 93 Annex A controls explained simply Blog ISO 9001:2026Quality management system

Your first consultation is free

Tell us about your company and your goal. You will get a clear plan and a quote within one business day.

Book a consultation