CyphrQ
Menu

ISO/IEC 27001 Explained: What It Requires and How Audits Work

ISO/IEC 27001 explained: what the ISMS standard requires, how certification and surveillance audits work, and what changed in 2022.

By CyphrQ.ai

Written with AI assistance and human editorial review. Every figure linked to its source.

11 min read

ISO/IEC 27001 is the international standard for running information security as a management discipline. It asks an organisation to build an information security management system (ISMS): defined scope, risk assessment, chosen controls, internal checks and continual improvement. An accredited certification body can then audit it and issue a certificate. The current edition is ISO/IEC 27001:2022.

This article is part of the ISO standards subtopic.

What is ISO/IEC 27001 and who publishes it?

ISO (the International Organization for Standardization) and the IEC (the International Electrotechnical Commission) publish it jointly. ISO's committee page for ISO/IEC 27001 describes it as the standard for information security management systems. It sets out requirements an ISMS must meet, for organisations of any size or sector. The official catalogue page is iso.org/standard/27001.

A management system is not software. It is the set of policies, roles, risk checks and routines an organisation uses to manage something consistently. Here the "something" is information: customer data, source code, contracts, employee records, and the systems that hold them.

ISO's committee page says the current version is Edition 3, published in October 2022. It lists the 2013 edition and its two corrigenda as withdrawn. It also lists an amendment, ISO/IEC 27001:2022/Amd 1:2024, titled "Climate action changes". Those details come from ISO's committee page. Check the iso.org catalogue entry for the full status line.

The standard text is paid content and copyrighted, so I describe it in my own words and do not reproduce clauses.

What does ISO/IEC 27001 cover?

It covers how you manage information security risk, not which firewall you buy. In plain terms, an ISMS answers six questions an auditor will ask:

  1. What is in scope? Which business units, systems, sites and information the ISMS covers, and who depends on it.
  2. Who is accountable? Top management commits to information security, sets a policy and assigns roles.
  3. What could go wrong? You identify information security risks, rate them against criteria you define, and decide how to treat each one.
  4. Which controls do you apply, and why? You select controls to treat the risks, record which apply and justify any you leave out.
  5. Do the controls run, and can you prove it? Operation, monitoring and records.
  6. How do you check and improve? Internal audit, management review and corrective action when something fails.

The standard follows the common layout ISO uses across its management system standards, which is why anyone who has run ISO 9001 will recognise the skeleton. It also contains a list of reference security controls in an annex, with implementation guidance in a companion standard. How that companion works is covered in the ISO/IEC 27002 controls explainer.

Who uses ISO/IEC 27001, and can you be certified?

Yes, you can be certified, and it is voluntary. ISO's committee page says some organisations implement the standard for its best practices while others seek certification to reassure customers. It adds that a certificate from an accredited conformity assessment body gives more confidence, because accreditation is independent confirmation of the certification body's competence.

Typical reasons to pursue it:

Situation Why it comes up
Suppliers selling to enterprise or public-sector buyers Tenders and security questionnaires often ask for a certificate.
Cloud, SaaS and managed-service providers Customers want evidence of how you protect their data.
Organisations that want a structured programme The standard gives a repeatable way to manage risk, even without a certificate.
Organisations already running another ISO management system Document control, internal audit and management review can be shared.

ISO also asks that the standard be cited in full, as "certified to ISO/IEC 27001:2022" rather than "ISO 27001". It is a useful habit when you read a supplier's claim: the edition is part of the claim.

A certificate says that a defined scope of an ISMS was audited against the standard. It does not say the organisation is unbreachable, and it does not by itself show compliance with a law. If you want a comparison with SOC 2, the SOC 2 vs ISO 27001 post covers it, so I won't repeat it here.

How does ISO/IEC 27001 relate to other standards?

  • ISO/IEC 27002: the guidance catalogue for security controls. 27001 requires a management system; 27002 helps you choose and implement controls. See the 27002 explainer.
  • ISO/IEC 42001: the equivalent standard for managing AI. It is a sibling that uses the same management-system skeleton, so organisations with an ISMS can reuse much of the machinery. ISO/IEC 42001 explained covers who needs it.
  • ISO/IEC 27006-1: a standard for the bodies that audit and certify an ISMS. ISO's summary of it, as shown in search listings, says it supplements ISO/IEC 17021-1 and can serve as a criteria document for accreditation. Its ISO/IEC 27006-1 catalogue page was not read in full for this post.

What changed in the 2022 revision, and is the transition over?

The 2022 edition replaced the 2013 edition. ISO's committee page confirms the 2013 edition is withdrawn. The transition rules for certificates came from the International Accreditation Forum (IAF), the body that coordinates accreditation worldwide.

IAF's archived page lists ISO/IEC 27001:2022 with a transition deadline of 31 October 2025, citing its mandatory document IAF MD 26. That date has passed. In practice: a certificate that still cites ISO/IEC 27001:2013 should not be accepted as current today. The same page says IAF ceased operations on 1 January 2026, so it is an archive and may be out of date. The intermediate audit cutoffs were not checked, so they are left out; your certification body can state exactly how it handled them.

Certification body and accreditation commentary describes the revision's main change as the control set in the annex, aligned with ISO/IEC 27002:2022. No primary source giving control counts was read for this post, so none are given. The 2024 amendment is a separate change about climate action; only its one-line title on ISO's page was checked.

How does ISO/IEC 27001 certification and surveillance auditing work?

The general pattern, which your certification body will tailor:

  1. Scope and build. Define scope, run a risk assessment, select controls, write the Statement of Applicability, and operate the system.
  2. Run it long enough to have evidence. Before the audit you need an internal audit and a management review on record, and controls that have produced records.
  3. Choose an accredited certification body. Verify its accreditation for ISO/IEC 27001 on the accreditation body's own register.
  4. Initial certification audit. Typically in two stages: a review of your documentation and readiness, then an on-site or remote assessment of whether the system is implemented and effective.
  5. Fix nonconformities. If the auditor finds gaps, you show corrective action before a certificate is issued.
  6. Surveillance audits. Between certificate issue and expiry, the body returns periodically to sample the system.
  7. Recertification. A fuller audit before the certificate cycle ends.

The exact cycle length is not given on the ISO pages cited here, so confirm the audit stages, surveillance frequency and certificate period in your contract with the certification body. If you are comparing quotes, ask how audit days are calculated and who will audit you.

Going deeper: for security and IT teams

Scope statement first. The scope on the certificate is what a customer reads. Write it as systems, locations, business units and exclusions, and keep it consistent with the ISMS documentation. A narrow scope is legitimate; a scope that quietly omits the production environment customers care about is how certificates get criticised. If you outsource part of the service, record the interfaces and the controls you rely on at the supplier.

Risk assessment and treatment. Define your risk method in writing: criteria for likelihood and impact, acceptance levels, who owns each risk. Then treat risks and record the decision (reduce, accept, avoid, share). Auditors test whether the method is applied consistently, not whether you picked a famous framework. Keep a risk treatment plan with owners and dates, because a risk accepted by nobody with authority is a typical finding.

Statement of Applicability (SoA). List every control in the annex, whether it applies, whether it is implemented, and the reason for any exclusion. The SoA must trace to your risk assessment: each included control should map to a risk, and each exclusion should have reasoning an auditor can follow. Build it from the standard's own text and the 27002 guidance, not a vendor spreadsheet. If you are mapping to another framework, a single control register with one column per external reference is easier to defend than parallel documents.

Evidence an auditor asks for.

  • Signed information security policy, and the scope statement.
  • Documented risk method, the risk register and the risk treatment plan.
  • The current SoA with version history.
  • Records that controls operate: access reviews, change tickets, backup restore tests, vulnerability scan results, incident tickets with post-incident reviews, supplier assessments, training records.
  • Internal audit reports and the audit programme, so the auditor can see you check yourself.
  • Management review minutes showing inputs and decisions, not just attendance.
  • Corrective action log with root causes and closure evidence.

Common nonconformities, described generally. Internal audit that is not independent of the thing audited. Management review that happened but recorded no decisions. A SoA that does not match the risk register. Controls documented but not operating, such as a quarterly access review nobody has done. Supplier reviews that stop at collecting a certificate without reading its scope. Corrective actions closed without addressing root cause.

In practice: a written target that did not operate. The UK Information Commissioner's Office fined Capita £14 million on 15 October 2025: £8m for Capita plc and £6m for Capita Pension Solutions Limited. The ICO says data on 6.6 million people was stolen in a March 2023 attack. Capita "took 58 hours to respond appropriately, against a target response time of one hour." Its weak administrative account controls "were flagged as a vulnerability on at least three separate occasions but were not remedied." Penetration test results were "siloed within business units". The ICO's release does not mention ISO/IEC 27001. Read through an ISMS lens, though, each finding has a familiar shape: a control whose target existed on paper, a risk raised repeatedly with no closed treatment, and findings that never reached a corrective action log.

Test the system before the auditor does. Pick five controls from the SoA at random and ask the owner to produce the last three records of it running. Anything that takes a day to find is a finding waiting to happen. Sample your incident log and check that each entry has an owner, a classification and a closure.

Mapping to related requirements. The management system covers the process; specific laws still need their own work. For example, the NIS2 Directive sets legal duties on in-scope entities that an ISMS may support as evidence but does not replace. Ask your legal adviser which duties map to which ISMS records.

Verify a supplier's certificate. Ask for the certificate, the scope statement, the edition cited (it must be 27001:2022 now), the certification body, and the SoA summary. Check the certification body's accreditation on the accreditation body's register, and the certificate's validity dates, because certificates lapse or are suspended. Check that the scope covers the service you buy.

In practice: a certified supplier still fined over a breach. On 27 July 2022, LastPass announced that it had achieved "ISO/IEC 27001: 2013 certification for its information security management system". The announcement names no certification body and gives no detailed scope. On 11 December 2025, the ICO fined LastPass UK Ltd £1.2 million over a breach affecting up to 1.6 million of its UK users. The ICO found the company "failed to implement sufficiently robust technical and security measures". The intrusion began on an employee's corporate laptop and moved to another employee's personal laptop, where malware captured a master password. The ICO's release does not discuss the certificate. The case still shows why a certificate opens a supplier review rather than closing it. Ask what the scope covered, which edition it cites, and how the ISMS treats staff devices and home working.

Ask your own team: Is our scope the one customers think it is? Which SoA exclusions would we struggle to defend? When did management last make a decision in a review, not just receive a report?

Learn more

What should you do next about ISO/IEC 27001?

  • Ask your customers or tender documents whether a certificate is actually required, and which edition.
  • Write the scope in one paragraph: systems, sites, teams, exclusions.
  • Define your risk method and start a risk register with named owners.
  • Hold an internal audit and a management review before you book the certification audit.
  • When a supplier says it is certified, ask for the scope, the edition and the certification body.

Key takeaways

  • ISO/IEC 27001 is the standard for an information security management system, and the current edition is ISO/IEC 27001:2022, Edition 3, published in October 2022.
  • Certification is optional, issued by a certification body, and strongest when that body is accredited.
  • The certificate covers a defined scope, so read the scope and the edition.
  • The transition deadline for the 2013 edition was 31 October 2025, so a 2013 certificate is out of date.
  • An initial audit is followed by surveillance audits and recertification; confirm the cycle with your body.
  • A certificate shows a management system was audited. It does not show you cannot be breached: LastPass announced ISO/IEC 27001 certification in 2022 and was fined £1.2 million by the ICO in 2025.

Sources