ISO/IEC 27001 is a standard for running an information security management system (ISMS): a managed process for finding information security risks and treating them. This glossary explains the terms you will meet, in the order a first-time team usually meets them.
This is an explanation of the framework. Certification is done by an independent certification body, not by any software vendor.
The basics
ISO/IEC 27001. The standard that sets requirements for establishing, implementing, maintaining and continually improving an ISMS, including risk assessment and treatment. It was first published in 2005 and revised in 2013 and 2022. The 2022 edition was amended in February 2024 to add climate-related requirements.
ISO/IEC 27002. Companion guidance on the controls listed in Annex A. 27001 says what to do; 27002 gives implementation advice. You do not certify against 27002.
ISMS. Your system of policies, processes, roles and records for managing information security risk. It is a management system, not a product you install.
Clauses 4 to 10. The mandatory requirements of the standard: context, leadership, planning, support, operation, performance evaluation and improvement.
The risk terms
Scope. The boundary of what the ISMS covers: which products, sites, teams and systems. Certification applies only within the stated scope, so scope choices matter commercially.
Risk assessment. Your documented method for identifying risks and judging their likelihood and impact.
Risk treatment. The decision on each risk: reduce it with controls, accept it, avoid it, or transfer it. A risk treatment plan records the decisions and owners.
Control. A measure that changes a risk, such as access control, backup, or a supplier review.
The control terms
Annex A. The reference list of controls. The 2022 edition lists 93, grouped into four themes. They are reference controls: you choose which apply based on your risk assessment.
Statement of Applicability (SoA). The document listing the controls you consider necessary, whether each is implemented, and the reason for excluding any Annex A control. Auditors read it closely, and it ties your risk work to your controls.
The people terms
Management commitment. Leadership has to set the policy, assign roles and review results. A security team cannot supply this on its own.
Internal audit. A check you run on your own ISMS before the external audit, by someone independent of the area audited.
Management review. A scheduled meeting where leadership looks at ISMS performance and decides on changes. Keep minutes.
Nonconformity. A requirement that is not met. Auditors record them, and you fix the cause and show evidence.
Corrective action. What you do to remove the cause of a nonconformity, not only the symptom.
The audit terms
Certification body. The independent organization that audits you and issues the certificate. Certification is optional unless law, contract or another scheme requires it, and accreditation of certification bodies is common though not compulsory.
Stage 1 audit. A readiness review of your documentation and plans.
Stage 2 audit. The detailed audit of whether your ISMS conforms and works in practice. The certification body, not the audit team itself, makes the certification decision.
Surveillance audit. A smaller audit between certifications. The first usually occurs within 12 months of certification and then annually.
Recertification. A full renewal audit, normally on a three-year cycle.
Transition. When the standard is revised, accredited certification bodies move certified clients to the new edition. For the 2022 edition, that deadline was 31 October 2025.
What do first-time teams get wrong?
Three things. They write policies nobody follows, so the Stage 2 audit finds the gap between paper and practice. They set scope too wide, then cannot evidence it. And they treat the SoA as a form to fill instead of a record of reasoning.
What to do
- Decide scope first, in one paragraph.
- Choose a risk method and run your first assessment.
- Draft the SoA from your risk results, with reasons for exclusions.
- Assign an owner to each control and keep evidence as you go.
- Run an internal audit and a management review before booking Stage 1.
- Choose an accredited certification body and ask for their timeline.
- Plan the surveillance cycle from day one.
Quick check
Is Annex A a checklist I must complete?
No. You select controls based on your risk assessment and document the choices, including exclusions, in the Statement of Applicability.
How long does an ISO 27001 certificate last?
Recertification is normally on a three-year cycle, with surveillance audits in between, the first within 12 months.
Sources
- Wikipedia: ISO/IEC 27001. The ISO pages were not accessible to us; confirm details against the standard itself.
Last reviewed: 18 October 2026.
