ISO/IEC 27001
The international standard for information security management systems — what the 2022 edition requires, and what changed from 2013
ISO/IEC 27001 is the international standard that specifies requirements for an information security management system (ISMS): a managed way of deciding what information matters, what could go wrong with it, and what you are going to do about it — reviewed and improved over time rather than set once and forgotten.
The current edition is ISO/IEC 27001:2022, the third, which cancels and replaces ISO/IEC 27001:2013. It was realigned with the harmonized structure used across management system standards and with ISO/IEC 27002:2022, and its Annex A was rebuilt from scratch. If your material still describes 14 control domains and 114 controls, it is describing the previous edition.
📌 Quick navigation
What an ISMS actually is
An ISMS is not a document set and not a product. It is the set of decisions, responsibilities and routines through which an organisation keeps information confidential, intact and available, in proportion to the risk it is actually carrying. The standard is deliberately generic: it applies to organisations of any type, size or sector, and it expects the system to be scaled to the organisation rather than copied from a template.
Two consequences follow, and both surprise people the first time. First, the standard does not tell you which controls to implement — it tells you to decide, from risk, and to be able to justify the decision. Second, you cannot pick and choose among the requirements: an organisation claiming conformity has to meet everything in clauses 4 to 10.
How the standard is structured
Clauses 1 to 3 cover scope, references and terms. The requirements you are audited against are clauses 4 to 10, and they follow the same shape as other management system standards:
| Clause | What it covers | Pages |
|---|---|---|
| 4 Context | Who you are, who cares, what is in scope, and the ISMS itself | 4.1 · 4.2 · 4.3 · 4.4 |
| 5 Leadership | What top management has to do, the policy, and who is accountable | 5.1 · 5.2 · 5.3 |
| 6 Planning | Risk assessment, risk treatment, the Statement of Applicability, objectives | 6.1 · 6.2 |
| 7 Support | Resources, competence, awareness, communication, documented information | Clause 7 |
| 8 Operation | Running the processes, and doing the risk work for real | 8.1 · 8.2 · 8.3 |
| 9 Performance evaluation | Monitoring and measurement, internal audit, management review | Clause 9 |
| 10 Improvement | Continual improvement, and dealing with nonconformities | Clause 10 |
The order in which the requirements appear does not imply the order of implementation, and it says nothing about their relative importance. The full clause-by-clause guide is in ISO 27001 requirements.
Annex A: 93 controls in four themes
Annex A is normative: it is a reference list of information security controls, aligned with clauses 5 to 8 of ISO/IEC 27002:2022, and it is used together with the risk treatment requirement in 6.1.3. Its job is to stop you overlooking something — not to hand you a shopping list.
5 — Organizational (37)
From policies, roles and asset inventory through supplier relationships, cloud services, incident management and legal compliance. The largest theme by some distance.
6 — People (8)
Screening, terms of employment, awareness and training, disciplinary process, responsibilities after the job ends, confidentiality agreements, remote working, event reporting.
7 — Physical (14)
Perimeters and entry, monitoring of premises, protection against physical and environmental threats, clear desk, equipment siting, storage media, utilities, cabling, secure disposal.
8 — Technological (34)
Endpoints, privileged access, authentication, malware, vulnerabilities, configuration, deletion, masking, leakage prevention, backup, logging, monitoring, networks, cryptography, secure development.
Controls are categorised as people, physical or technological where they concern those things, and organizational otherwise. ISO/IEC 27002:2022 additionally tags each control with five attributes — control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities, and security domains — so that an organisation can sort and present the same controls in the view that suits its audience.
What changed from the 2013 edition
| Area | 2013 | 2022 |
|---|---|---|
| Annex A structure | 14 control domains | 4 themes |
| Number of controls | 114 | 93 |
| Control attributes | — | Five attributes defined in ISO/IEC 27002:2022 |
| Control layout | Control and guidance | Control, Purpose, Guidance, Other information |
| Alignment | Annex SL of the time | Harmonized structure and ISO/IEC 27002:2022 |
The drop from 114 to 93 is mostly consolidation, not deletion: controls that overlapped were merged. Several controls are genuinely new, and they show where practice has moved since 2013 — threat intelligence (5.7), information security for use of cloud services (5.23), ICT readiness for business continuity (5.30), physical security monitoring (7.4), configuration management (8.9), information deletion (8.10), data masking (8.11), data leakage prevention (8.12), monitoring activities (8.16), web filtering (8.23) and secure coding (8.28).
For an organisation already certified to the 2013 edition, the practical work is a mapping exercise: re-express the Statement of Applicability against the new numbering, check the new controls against your risk assessment, and decide what each one means for you — including deciding, with a reason, that one does not apply.
The wider 27000 family
| Standard | What it is for |
|---|---|
| ISO/IEC 27000 | Overview and vocabulary. The definitions used by 27001 come from here. |
| ISO/IEC 27001 | The requirements. This is the standard you certify against. |
| ISO/IEC 27002 | Guidance on the controls: what each one is for and how to approach it. You do not certify against it. |
| ISO/IEC 27005 | Guidance on information security risk management — the how behind clauses 6.1.2 and 8.2. |
| ISO/IEC 27701 | Extension for privacy information management, for organisations handling personal data. |
A common confusion is worth clearing up: 27001 is certifiable, 27002 is not. 27002 explains the controls; 27001 requires you to decide which you need and to say why.
Certification and training
Certification is granted to the organisation, by an accredited certification body, after an audit in two stages — a review of the ISMS documentation and readiness, then an audit of the system in operation — followed by surveillance over the certificate’s life. Individuals do not get certified to 27001; they get certified in their role within it.
| Level | Who it is for | Prepare / practise |
|---|---|---|
| Foundation | Anyone who needs the vocabulary and the shape of the standard. | Course · Mock exam |
| Practitioner | Those implementing and running the ISMS. | Course |
| Auditor | Those auditing an ISMS, internally or on behalf of others. | Course · Mock exam |
| Lead Auditor | Those leading audit teams and taking audit decisions. | Course · Mock exam |
Frequently asked questions
Is ISO 27001 mandatory?
Not in itself. It is a voluntary standard. What makes it feel mandatory is that customers, tenders and regulators increasingly ask for it as evidence that information is managed properly — so the obligation usually arrives through a contract rather than a law.
Do we have to implement all 93 Annex A controls?
No. You determine the controls you need from your risk treatment, then compare that set against Annex A to check you have not missed anything. Controls that are not necessary are excluded — with the justification recorded in the Statement of Applicability. Annex A is explicitly not exhaustive either: controls can come from any source.
How long does certification take?
It depends on where you start: an organisation with existing governance, an asset picture and working processes moves far faster than one starting from nothing. The honest answer is that the risk assessment and the evidence trail set the pace, not the paperwork.
Can we certify only part of the organisation?
Yes — scope is a decision under clause 4.3, and it must consider the internal and external issues, the requirements of interested parties, and the interfaces and dependencies with activities performed by others. A scope drawn to exclude the difficult part tends to be visible to an auditor.
Does certification mean we will not be breached?
No, and any claim otherwise should be treated with suspicion. It means you have a managed system for identifying and treating information security risk, and that an independent body has checked it works. That reduces the likelihood and limits the damage; it does not remove the possibility.
We are certified to the 2013 edition — what now?
You move to the 2022 edition within the transition arrangements set by your certification body and the accreditation rules. Practically: remap the Statement of Applicability to the new numbering, assess the new controls, and update the documented information that refers to the old structure.
Deciding whether to certify, or moving from the 2013 edition to 2022? Tell us where you are and we will tell you what the work actually involves — including when certification is not yet the right next step. Contact us.
Read next
- ISO 27001 requirements — the clause-by-clause guide to clauses 4 to 10.
- Clause 4.3 — determining the scope — the decision that shapes everything else.
- Clause 6.1 — actions to address risks and opportunities — risk assessment, treatment and the Statement of Applicability.
This page explains the requirement in our own words, for study and orientation. It is not a substitute for the standard: the authoritative text is ISO/IEC 27001:2022, available from ISO and from national standards bodies.
