What is ISO/IEC 27001?
ISO/IEC 27001:2022 is an international standard that specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). It takes a risk-based approach and uses the Plan-Do-Check-Act cycle for continual improvement (ISO/IEC 27001:2022, clauses 4–10).
ISO/IEC 27001 is a copyrighted standard. Obtain your own licensed copy from ISO or your national standards body; this article summarises the structure, not the standard text.
Who the standard applies to
ISO/IEC 27001 is written to be applicable to organisations of any size and type. Certification is voluntary unless a contract or regulation requires it. The standard's requirements are set out in clauses 4–10; Annex A provides a reference set of information security controls.
ISO/IEC 27001:2022 requirements
The standard is structured in ten clauses. Clauses 4–10 contain the requirements:
| Clause | Subject | Key elements |
|---|---|---|
| 4 | Context of the organisation | Interested parties, ISMS scope |
| 5 | Leadership | Leadership commitment, information security policy, roles |
| 6 | Planning | Risk assessment and treatment, objectives |
| 7 | Support | Resources, competence, awareness, communication, documented information |
| 8 | Operation | Operational planning and control, risk assessment and treatment |
| 9 | Performance evaluation | Monitoring, internal audit, management review |
| 10 | Improvement | Nonconformity, corrective action, continual improvement |
Annex A controls
ISO/IEC 27001:2022 Annex A lists 93 information security controls in four themes:
- Organisational controls (37): policies, human resource security, supplier relationships and related controls.
- People controls (8): terms of employment, disciplinary process, awareness and related controls.
- Physical controls (14): physical security perimeters, equipment and related controls.
- Technological controls (34): access control, cryptography, systems and network security and related controls.
Preparing an ISMS
The steps below follow the clause structure. They are preparation guidance, not a certification decision.
1. Define the context and scope (clause 4)
Identify interested parties and their requirements, and define the boundaries of the ISMS: processes, locations and information assets.
2. Obtain leadership commitment (clause 5)
Secure executive sponsorship, issue the information security policy and assign roles and responsibilities.
3. Conduct the risk assessment (clause 6.1.2)
Identify assets, threats and vulnerabilities; assess likelihood and impact; and document the risk assessment methodology and criteria.
4. Prepare the risk treatment plan and Statement of Applicability (clause 6.1.3)
Select treatment options (modify, retain, avoid, share), choose controls from Annex A or define custom controls, and document the Statement of Applicability with justifications and implementation status.
5. Implement controls and documented information (clause 7.5)
Implement the selected controls and maintain the documented information the standard requires, including the information security policy, risk assessment and treatment records, and the Statement of Applicability.
6. Build competence and awareness (clauses 7.2–7.3)
Provide role-specific training and make personnel aware of the information security policy and their contribution to the ISMS.
7. Monitor and measure (clause 9.1)
Define what to monitor and measure, the methods and the reporting cadence, and keep the evidence.
8. Run internal audits (clause 9.2)
Audit the ISMS at planned intervals, report findings and track corrective actions.
9. Hold management reviews (clause 9.3)
Review ISMS performance, risks and improvement opportunities at planned intervals, and record the decisions.
10. Improve (clause 10)
Address nonconformities, take corrective action and continually improve the ISMS.
Certification
Certification is issued by an accredited certification body after an audit against the standard. The certification body sets the audit and surveillance requirements for its scheme; confirm the current requirements with the body you engage. This article does not state certification timelines or fees.
How Compliance Enablers helps with ISO/IEC 27001
ISO 27001 runs as one of Compliance Enablers' 30 standards, as a guided programme — scoping, assessment, scoring, evidence and readiness. The platform includes 60 dashboard modules in 11 groups, all included in every plan. Controls, evidence and findings map across standards through curated crosswalk mappings. ISO/IEC 27001 is a licensed standard: it opens only after the customer confirms in-app that they hold their own licence, and the platform records that confirmation. The platform works alongside your own licensed copy of the standard; we never sell or redistribute standard text. We help you prepare; the certification decision belongs to the independent certification body.