ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires you to assess information security risks, choose controls to treat them, document your choices in a Statement of Applicability, and keep improving. Certification by an independent body is optional unless a law, contract or scheme demands it.
What is an ISMS?
An ISMS is the set of policies, roles, processes and records through which an organization manages information security risk. The standard does not say which technology to buy. It asks whether you run security as a managed, repeatable system with clear ownership and evidence.
Which edition is current?
The third edition was published in October 2022. It was technically revised, aligned with the harmonized structure used for ISO management system standards and with ISO/IEC 27002:2022. The realigned Annex A has 93 controls: 11 new, 24 resulting from mergers of earlier controls and 58 updated. Accredited certification bodies had to move their certified clients to the 2022 edition by 31 October 2025. These details come from a secondary summary, because ISO's own page and the paid standard text were not accessible when this was written, so confirm them against the standard.
What does the standard require?
The requirements sit in clauses 4 to 10, and none can be excluded if you claim conformity. In plain terms:
- Understand your context and the expectations of interested parties, and define the scope of the ISMS.
- Show leadership commitment, set a policy and assign roles.
- Plan: define a risk assessment process that identifies risks to confidentiality, integrity and availability of information in scope, analyzes consequences and likelihood, and evaluates them against criteria you set. Then choose treatments.
- Support the system with resources, competence, awareness and controlled documents.
- Operate the controls and the risk treatment plan.
- Evaluate performance through monitoring, internal audit and management review.
- Improve through corrective action.
Annex A is a reference list of controls. You compare your chosen treatments with it to check nothing necessary was overlooked, then record the result in the Statement of Applicability: which controls you need, why, whether they are implemented, and why you excluded any Annex A control.
What does certification mean?
An independent certification body audits your ISMS against the standard. Certification applies only within the scope stated on the certificate. Bodies are commonly accredited by a national accreditation body, although accreditation is not compulsory. So when a vendor says it is certified, ask for the certificate, the scope statement, the Statement of Applicability version and the issuing body.
Certification does not guarantee security. It shows a managed system exists within a defined scope.
What does a first pass look like?
Constructed example. A 60-person software company decides to scope its ISMS to the product engineering team and the cloud environment it runs on, leaving out the sales office. In the risk assessment it identifies leaked source code, a compromised build pipeline and loss of customer data as the top three risks. It maps controls to each, finds that offboarding is manual and access reviews are irregular, and writes both onto a treatment plan with owners and dates. The Statement of Applicability records the chosen controls and a justification for the ones left out.
Narrow scope is acceptable if honest. A scope that quietly omits the risky part is not.
How to check or apply this
- Decide why you want it: a customer requirement, a market signal or internal discipline.
- Define a scope you can defend, and list what sits outside it.
- Run and document a risk assessment using criteria you can explain.
- Choose treatments, compare them to Annex A, and write the Statement of Applicability.
- Run the controls for long enough to produce records, such as access reviews, incident logs and training evidence.
- Hold an internal audit and a management review before the external audit.
- Choose an accredited certification body and ask what their audit covers.
Compliance automation can collect evidence for several of these steps, but the decisions and the certificate come from you and your auditor. Safeguard does not certify anyone.
Quick check
Is ISO 27001 a list of security controls?
Not quite. The core is a management system for managing risk. Annex A lists controls you check against, but you pick them based on your own risk assessment.
Does the certificate cover the whole company?
Only the scope written on it. Always read the scope statement.
Sources
Last reviewed: 18 October 2026.
