ISO/IEC 27001

Why it matters

ISO 27001 is the certificate customers ask for. A procurement questionnaire that says "ISO 27001 certified? Y/N" is deciding whether to trust your security programme on the strength of an independent audit, and for many B2B deals the answer gates the contract.

For the security team it is something more useful than a badge: a forcing function. The standard does not tell you which controls to run — it tells you to assess risk, choose controls that treat those risks, write down why you excluded the rest, and then produce evidence that the chosen controls actually operate. Regulations that do prescribe controls — DORA, NIS2 — are far easier to meet on top of an ISMS that already exists.

How it is structured

The standard has two halves. Clauses 4–10 are the management system: context and scope (4), leadership (5), planning and risk assessment (6), support (7), operation (8), performance evaluation (9) and improvement (10). These are mandatory and cannot be excluded — an auditor checks that the cycle runs, not just that documents exist.

Annex A is the control catalogue. The 2022 revision reorganised it into 93 controls in four themes: Organizational (37), People (8), Physical (14) and Technological (34) — down from 114 controls in 14 domains in the 2013 edition, with eleven genuinely new ones (threat intelligence, cloud services, ICT readiness for business continuity, data masking, data leakage prevention, monitoring activities, web filtering, secure coding, configuration management, information deletion, physical security monitoring). ISO/IEC 27002 is the companion document that explains how to implement each control.

The bridge between the two halves is the Statement of Applicability (SoA): one row per Annex A control stating whether it applies, why (a risk, a legal obligation, a contract) and whether it is implemented. Every control you exclude needs a justification. It is the first document an auditor reads and the one most organisations get wrong by treating it as a checklist instead of the output of the risk assessment.

Certification is a three-year cycle: a stage 1 (documentation) and stage 2 (operation) audit, then annual surveillance audits, then recertification. Organisations certified against 2013 had until 31 October 2025 to transition to 2022.

Common misreadings

• "Certified" has a scope. A certificate may cover one data centre or one product line. Ask for the scope statement, not just the certificate number.
• Annex A is not a to-do list. Applying all 93 controls without a risk assessment is a common stage-1 finding: the auditor cannot see why you chose them.
• 27001 ≠ 27002. You certify against 27001; 27002 is guidance and is not certifiable.

Related terms

• DORA — DORA is the EU regulation, applicable since 17 January 2025, that makes financial entities and their critical ICT providers prove they can withstand, respond to and recover from ICT disruptions and cyberattacks.
• NIS2 — NIS2 is the EU directive that widens cybersecurity obligations from a few critical operators to most medium and large organisations in eighteen sectors, with mandatory security measures, incident reporting and personal liability for management.
• GDPR — The GDPR is the EU regulation, in force since 25 May 2018, that governs any processing of personal data — including the IP addresses, usernames and e-mail addresses in your logs — and requires security "appropriate to the risk" plus breach notification within 72 hours.
• PCI DSS — PCI DSS is the contractual security standard, set by the card brands through the PCI Security Standards Council, that anyone storing, processing or transmitting payment-card data must meet — currently version 4.0.1.