Guide

ISO 27001 requirements, a practical guide

ISO/IEC 27001 is the international standard for information security management systems (ISMS). It asks you to understand your information security risks and treat them with proportionate controls. This guide explains what the standard requires, how Annex A works and what certification involves.

• Covers the 2022 edition and its 93 Annex A controls
• Explains the Statement of Applicability
• Shows how risk drives every control decision

Two parts: the clauses and Annex A

Clauses 4 to 10 set the management system requirements: context and scope, leadership, risk assessment and treatment, support, operation, evaluation and improvement. These are mandatory.

Annex A lists 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). You decide which apply based on your risk assessment, and justify every decision in the Statement of Applicability.

The core requirements

• A defined ISMS scope, including interfaces with suppliers and cloud services
• An information security policy and assigned roles
• A repeatable risk assessment method and a risk treatment plan
• A Statement of Applicability covering all 93 Annex A controls
• Measurable information security objectives
• Competence, awareness and document control
• Internal audit, management review and corrective action

The 2022 edition

The 2013 edition had 114 controls in 14 domains. The 2022 edition reorganised them into 93 controls in four themes and added 11 new ones, including threat intelligence, cloud services security and data leakage prevention. Transition for organisations certified to the 2013 edition has now closed.

Next steps

1. Scope and risk. Fix the scope, then assess risks to the information inside it.
2. Treat and document. Choose controls, write the Statement of Applicability and implement.
3. Operate and certify. Run the ISMS, audit internally, hold management review, then Stage 1 and Stage 2.

Frequently asked questions

Do we have to implement all 93 controls?

No. You must consider all of them and justify each inclusion or exclusion in the Statement of Applicability, based on your risks.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 contains the certifiable requirements. ISO 27002 is guidance on implementing the Annex A controls and is not certified against.

How long does ISO 27001 certification take?

Four to eight months is typical, driven mainly by how much technical remediation your risk treatment plan produces.

Related guides

• ISO 27001 risk assessment, A step by step method for the information security risk assessment and treatment plan.
• ISO 27001 documentation, The mandatory documents and records, and the ones auditors expect in practice.
• ISO 27001 checklist, Clauses 4 to 10 and all 93 Annex A controls, with expected evidence.
• ISO 27001 overview, Who needs the standard and how our packages support it.
• ISO 9001 requirements guide, Every requirement of ISO 9001, what it means in practice and the evidence auditors expect.
• ISO 45001 certification guide, The route to ISO 45001 certification, from gap analysis to Stage 2 and surveillance.

Run your ISMS as a live register

Keep risks, the Statement of Applicability and control evidence together, with independent review and sign-off for every Annex A control.