Information security
ISO/IEC 27001:2022 — Information security management systems
The international standard for information security management systems (ISMS): certifiable and recognised everywhere.
At a glance
- Type
- International standard, certifiable
- Publisher
- ISO / IEC
- Edition
- 2022 (+ Amendment 1:2024)
- Certification
- Accredited certification body, 3-year cycle
123 requirements tracked · 209 shared controls
What is ISO 27001?
ISO/IEC 27001 sets out the requirements of an information security management system (ISMS): an organisation that identifies its risks, selects proportionate controls, implements them, measures them and keeps improving. The current edition dates from 2022, supplemented by Amendment 1:2024 on climate change.
The standard has two parts: clauses 4 to 10, which describe the management system (context, leadership, planning, support, operation, performance evaluation, improvement), and Annex A, which lists 93 security controls in four themes: organisational, people, physical and technological. Each control is included or excluded, with a justification, in the Statement of Applicability (SoA).
Key requirements
- 1
ISMS context and scope
Identify internal and external issues, interested parties and their expectations, then define a clear scope (sites, activities, systems).
- 2
Leadership commitment
Top management sets the security policy, assigns roles and responsibilities and provides the resources needed.
- 3
Risk assessment and treatment
A documented method to identify, analyse and evaluate risks, then a treatment plan approved by the risk owners.
- 4
Statement of Applicability
For each of the 93 Annex A controls: included or not, justification and implementation status.
- 5
Competence, awareness and documented information
Train and raise the awareness of staff, control documents and records (versions, approval, distribution).
- 6
Internal audit and management review
Regularly check that the ISMS works, then review it with top management to decide on improvements.
- 7
Nonconformities and continual improvement
Handle deviations, analyse their causes and follow up the effectiveness of corrective actions.
Summary written by OK-GRC. The texts of ISO standards are protected by copyright and are not reproduced.
How OK-GRC helps
- The 93 Annex A controls and the clause 4–10 requirements, linked to 209 OK-GRC common controls with guidance and evidence examples
- A Statement of Applicability generated, justified (with AI assistance) and exportable to PDF or XLSX
- Risk register (likelihood × impact), treatment plan and signed acceptance of residual risks
- Ready-to-use policy templates (security, access control, backup, suppliers…) with an approval workflow
- Internal audit programme, findings, corrective actions and an automatically prepared management review
- Dedicated read-only access for your certification auditor, with no billed seat
Related frameworks
The controls you put in place for ISO 27001 also count for:
- NIS2ISO 27001 controls cover at least partly 27 to 28 of the 29 NIS2 requirements tracked.
- GDPRSecurity of processing (Art. 32) and breach handling are already in place.
- ISO 9001Same management system structure: audits, management review, corrective actions.
- HDSHDS v2 certification relies on an ISO 27001 ISMS covering the hosting activities.
- SOC 2Security criteria CC1 to CC9 largely overlap with Annex A.
Frequently asked questions about ISO 27001
How long does ISO 27001 certification take?
For a small or mid-sized company starting from scratch, usually 6 to 12 months: scoping and risk assessment, implementing controls, a few months of operation to produce evidence, internal audit and management review, then the two-stage certification audit. OK-GRC mostly shortens the documentation work and evidence tracking.
Do we have to implement all 93 Annex A controls?
No. Each control is included or excluded based on your risk assessment and obligations, with a justification in the Statement of Applicability. In practice, most organisations include the large majority of them.
Does OK-GRC certify us?
No. Only an accredited certification body can certify your ISMS. OK-GRC helps you build it, run it and present your evidence to the auditor.
Informational content up to date as of October 2026; it does not constitute legal advice. Always check the official texts in force.
Ready to simplify your compliance?
Create your workspace in minutes. The assistant suggests the frameworks and priorities that fit your company.
14-day trial with every Pro feature · Nothing charged before the trial ends · No commitment