Your Guide to ISO/IEC 27001:2022

What is ISO 27001?

ISO/IEC 27001 is the international standard for information security management.

It sets out a risk-based framework any organisation can use to build, run, monitor, review, and maintain an ISMS (information security management system). It also supports ongoing improvement.

Organisations can achieve accredited certification to ISO 27001 to show that their ISMS matches accepted best practice.

According to the latest ISO Survey, there are now almost 100,000 valid ISO 27001 certificates around the world.

What ISO 27001 covers

ISO 27001 sets the ISO 27001 requirements for an ISMS, from scope to ongoing improvement. These include:

• Understanding your organisation, its context, and the needs and hopes of interested parties.
• Setting the scope of the ISMS.
• Gaining leadership support from top management.
• Setting an information security policy.
• Defining roles, responsibilities, and authorities.
• Managing information security risk.
• Setting security goals and planning how to reach them.
• Training staff and building awareness.
• Day-to-day planning and control.
• Monitoring and reviewing the ISMS.
• Internal audit.
• Management review.
• Ongoing improvement.

What is an ISMS?

An ISMS is a system-based way to protect the CIA (secrecy, integrity, and availability) of company information assets.

An ISO 27001 ISMS uses organisational, people, physical, and technical controls chosen through regular risk assessments.

What are the Annex A controls?

Annex A of ISO 27001 lists 93 information security controls that support the build and upkeep of an ISMS.

These controls are explained in ISO 27002, the companion standard, along with guidance on how to use them.

The controls are grouped into four themes:

• 5 Organisational (37 controls)
• 6 People (8 controls)
• 7 Physical (14 controls)
• 8 Technical (34 controls)

You do not have to use all 93 controls. Instead, do a risk assessment to decide which controls you need, and explain why you leave out the others.

Read our blog post ISO 27001:2022 Annex A Controls Explained to learn more about control choice and use.

Why ISO 27001 matters for businesses

Cyber attacks keep growing in scale and harm, and new threats appear all the time. It is vital for organisations to put in place the controls they need to protect themselves and their information.

ISO 27001 helps organisations find and fix security gaps that could affect the secrecy, integrity, and availability of their information assets.

That also supports compliance with business, legal, contract, and regulatory needs, such as the GDPR (General Data Protection Regulation) and NIS (Network and Information Systems) Regulations.

• Protect your data, wherever it is: Protect all forms of information, whether digital, hard copy, or in the cloud.
• Increase your attack resilience: Increase your company’s resilience to cyber attacks.
• Reduce information security costs: Put in place only the controls you need, so you get the most from your budget.
• Respond to changing threats: Keep adapting to changes in the wider world and inside the organisation.
• Improve company culture: An ISMS brings together people, process, and technology, so staff understand risk and use security in day-to-day work.
• Meet contractual obligations: ISO 27001 certification shows your commitment to data security and gives you a useful edge when bidding for new business.

Who needs ISO 27001?

Any organisation that takes information security seriously needs a clear, system-based way to spot risks, protect information, and respond as those risks change. ISO 27001 provides that framework.

Its vendor-neutral approach makes it a fit for all organisations, whatever their size, complexity, sector, or location. In particular, it helps:

• Organisations that store, process, or manage sensitive data, such as firms in financial, healthcare, legal, professional services, and public sectors.
• Software-as-a-service organisations, tech firms, and other supply-chain-driven organisations.
• Organisations under contract or regulatory pressure to show strong information security practices.
• Organisations seeking a competitive edge when bidding for contracts or partnerships where security proof matters.
• Organisations that want to build security into day-to-day processes, systems, and decisions so information security is managed in a steady way.

How do you implement ISO 27001?

Implementing an ISO 27001-compliant ISMS involves:

• Scoping the project.
• Securing management support and enough resources.
• Identifying interested parties and legal and contract needs.
• Running a risk assessment.
• Selecting and putting in place the required controls.
• Building internal skills to manage the project.
• Writing the right documents.
• Training staff in awareness.
• Measuring, monitoring, reviewing, and auditing your ISMS on an ongoing basis.
• Taking the needed corrective and preventive actions.

You can find our ISO 27001 implementation checklist and our nine-step approach to building an ISMS in our bestselling guide, Nine Steps to Success — An ISO 27001:2022 implementation overview.

What is ISO 27001 certification?

Certification to ISO 27001 gives independent audit assurance that your ISMS meets the Standard’s requirements.

To achieve certification, you must show that your ISMS:

• Meets the requirements of ISO 27001.
• Follows all relevant legal, regulatory, and contract security duties.
• Follows its own documented policies and procedures.

The certification audit

The certification audit has two stages:

• Stage 1: A review of your documents to check that your ISMS has been designed properly.
• Stage 2: An implementation audit to confirm that your ISMS is working in line with your documented processes.

Certification is valid for three years, with annual surveillance audits to make sure you are keeping your ISMS up to date. After three years, a renewal audit is required to keep certification.

The certification audit

The certification audit involves two stages:

• Stage 1: A review of your documentation to ensure your ISMS has been designed appropriately.
• Stage 2: An implementation audit to confirm that your ISMS is operating in line with your documented processes.

Certification is valid for three years, with regular surveillance audits to ensure you’re maintaining your ISMS.

ISO 27001 vs other security frameworks

Why choose GRC Solutions?

• We are the global authority on ISO 27001, and we led the world’s first certification project, when the standard was known as BS 7799.
• Since then, we’ve supported more than 20,000 ISO 27001 projects and trained more than 7,000 professionals on ISO 27001 builds and audits.
• We offer everything you need to build an ISMS — you do not need to go anywhere else.
• We’ve honed our method over more than 20 years and are so confident in it that we guarantee certification — provided you follow our advice.
• You benefit from real-world practitioner expertise, not just academic knowledge.
• We have a proven, practical way to assess compliance with international standards, whatever your organisation’s size or type.
• Our pricing and proposals are completely clear, so you will not get surprises.
• Our FastTrack™ service helps organisations prepare for certification in three to six months.