Category: ISO 27001
ISO/IEC 27001 is the international standard for information security management. It sets out how to build, run and continually improve an Information Security Management System (ISMS), and it is the only information security standard an organisation can be formally certified against by an accredited body.
Certification matters commercially because it is verifiable. A customer, a regulator or a procurement team can check your certificate and see the scope it covers. That is why ISO 27001 appears in enterprise tender requirements across Europe, the UK, the GCC and increasingly the US, and why it is often the first thing asked of a supplier handling sensitive data.
The 2022 edition restructured Annex A into 93 controls across four themes — organisational, people, physical and technological — and Amendment 1:2024 added climate-change considerations. The transition period for the 2013 edition closed on 31 October 2025, so any new implementation should be built against the 2022 text from the start.
Most of the work of certification is documentary. You need a defined scope, an information security policy, a risk assessment method and its results, a Statement of Applicability justifying every control you have included or excluded, and evidence that the management system actually runs — internal audits, management reviews, corrective actions. Auditors spend most of their time reading, not inspecting.
The guides below cover the full path: what the standard requires, how to run a gap analysis and a risk assessment, which documents are mandatory, what Stage 1 and Stage 2 audits examine, how long certification takes and what it costs, and how ISO 27001 compares with SOC 2, NIS2 and the NIST Cybersecurity Framework.
