ISO 27001, formally ISO/IEC 27001, is the international standard that specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). Among security standards in cybersecurity, it is the most widely recognized basis for independent third-party certification of how an organization governs information risk.
The standard does not prescribe a fixed set of technologies. Instead, it requires a risk-based management process: the organization defines its scope, identifies risks to confidentiality, integrity and availability, selects controls to treat them and proves through audits and reviews that the system works. The current edition is ISO/IEC 27001:2022, published jointly by ISO and IEC, with a 2024 amendment that adds climate change considerations to the context clauses.
How the ISO 27001 management system works
ISO 27001 works as a Plan-Do-Check-Act cycle written into mandatory clauses. Clauses 4 to 10 contain the requirements an auditor checks, while clauses 0 to 3 only introduce the document, its references and its terms.
The structure follows the harmonized structure shared by ISO management system standards such as ISO 9001 and ISO 14001. This lets organizations run an integrated management system in which policy, internal audit and management review serve several standards at once.
| Clause | Subject | Key output |
|---|---|---|
| 4 Context | Internal and external issues, interested parties, ISMS scope | Documented ISMS scope |
| 5 Leadership | Top management commitment, policy, roles | Information security policy |
| 6 Planning | Risk assessment, risk treatment, objectives | Risk treatment plan and Statement of Applicability |
| 7 Support | Resources, competence, awareness, documentation | Competence records and controlled documents |
| 8 Operation | Running the risk processes and controls | Risk assessment results |
| 9 Performance evaluation | Monitoring, internal audit, management review | Audit program and review minutes |
| 10 Improvement | Nonconformity, corrective action, continual improvement | Corrective action records |
The center of the system is clause 6.1. The organization must define risk acceptance criteria, assess risks consistently and select a risk treatment option for each one: modify, avoid, share or retain the risk. Guidance for this process is given in ISO/IEC 27005, although ISO 27001 does not mandate any specific risk method.
Annex A controls and the Statement of Applicability
Annex A of ISO 27001:2022 lists 93 reference controls grouped into four themes. The organization compares the controls it selected through risk treatment with this list, so that no necessary control is overlooked.
| Theme | Number of controls | Typical examples |
|---|---|---|
| Organizational (A.5) | 37 | Policies, supplier security, incident management, threat intelligence |
| People (A.6) | 8 | Screening, awareness training, remote working |
| Physical (A.7) | 14 | Secure areas, equipment siting, physical security monitoring |
| Technological (A.8) | 34 | Access control, cryptography, logging, secure coding |
The four themes add up to 37 + 8 + 14 + 34 = 93 controls. The 2013 edition had 114 controls in 14 domains; the 2022 update merged many of them and introduced 11 new controls, including data masking, data leakage prevention, configuration management, web filtering and information security for the use of cloud services.
The Statement of Applicability (SoA) is the document that ties Annex A to the risk process. For every one of the 93 controls it records whether the control is included or excluded, the justification for that decision and its implementation status. Auditors treat the SoA as the map of the entire control environment, and an exclusion without a credible justification is a frequent audit finding.
Detailed implementation guidance for each control sits in the companion standard ISO/IEC 27002. That document is guidance only: an organization cannot be certified against ISO 27002, only against ISO 27001.
How ISO 27001 compares with SOC 2 and NIST CSF
ISO 27001 differs from neighboring frameworks mainly in what is assessed and what the result proves. It certifies a management system, while SOC 2 reports on controls and NIST CSF serves as a voluntary outcome framework.
| Aspect | ISO 27001 | SOC 2 | NIST CSF 2.0 |
|---|---|---|---|
| Nature | Certifiable requirements standard | Attestation report under AICPA criteria | Voluntary framework |
| Result | Certificate valid for three years | Type 1 or Type 2 auditor report | Self-assessed profile and tiers |
| Assessor | Accredited certification body | Licensed CPA firm | No formal assessor |
| Geographic reach | Global | Mainly North America | Mainly United States, used globally |
| Control set | 93 Annex A controls, risk-selected | Trust services criteria | Six functions, including Govern |
| Public output | Certificate with scope statement | Restricted-use report under NDA | None by default |
In practice the frameworks overlap heavily, and mature organizations maintain one control set mapped to several frameworks. A company selling to European enterprises usually needs ISO 27001 certification, while one selling to North American software buyers is more often asked for a SOC 2 Type 2 report.
The certification process and audit cycle
ISO 27001 certification is granted by a certification body that is itself accredited, under ISO/IEC 27006, by a national accreditation body. A certificate issued by an unaccredited body carries little weight with customers and regulators.
| Stage | Timing | Purpose |
|---|---|---|
| Stage 1 audit | Before certification | Documentation review and readiness check |
| Stage 2 audit | Weeks to a few months after Stage 1 | Evidence that controls operate effectively |
| Surveillance audit 1 | Within 12 months of certification | Sample of clauses and controls |
| Surveillance audit 2 | Within 24 months | Further sample, follow-up on findings |
| Recertification audit | Before the three-year expiry | Full reassessment and new certificate |
Auditors classify findings as major nonconformities, which block certification until corrected, minor nonconformities, which require a corrective action plan, and observations. A first certification for a mid-sized organization typically takes 6 to 12 months of preparation, depending on scope and existing maturity.
Organizations certified to the 2013 edition had to transition to the 2022 edition by 31 October 2025. Certificates that were not transitioned by that date ceased to be valid.
Common mistakes and limitations
The most important limitation is that an ISO 27001 certificate proves a functioning management system within the stated scope, not the absence of vulnerabilities. A certified organization can still suffer a serious breach if its risk assessment was shallow.
- Scope too narrow: certifying one data center while customer data is processed elsewhere misleads buyers who never read the scope statement.
- Documentation without operation: policies exist, but logs, access reviews and training records do not show the controls running.
- Copied risk register: a generic template instead of risks derived from the real assets, threats and vulnerabilities.
- Weak management review: top management signs minutes without making decisions on resources or risk acceptance.
- Treating Annex A as a checklist: implementing all 93 controls uniformly instead of in proportion to the assessed risk.
Explained without jargon
ISO 27001 is a rulebook for running information security as an organized, repeatable process. It does not tell a company which firewall to buy. It tells the company to list what could go wrong with its information, decide how to deal with each risk and keep checking that those decisions still work.
An independent auditor then visits and checks the evidence. If everything holds up, the company receives a certificate valid for three years, with yearly check-ups. The certificate shows customers that security is managed deliberately, not left to chance.
A typical use case
A software company with 120 employees sells a payroll platform to banks and insurers in Europe. Every large prospect sends a long security questionnaire, and two deals stall because the company cannot show an independent security certification.
The company defines its ISMS scope as the development, hosting and support of the payroll platform. It runs a risk assessment, documents a Statement of Applicability that includes 88 of the 93 Annex A controls and excludes five physical controls that its cloud provider covers, and spends eight months producing evidence such as access reviews, supplier assessments and incident drills.
After a Stage 1 and a Stage 2 audit with two minor nonconformities, the certification body issues the certificate. Sales cycles shorten because the certificate replaces most questionnaire answers, and the annual surveillance audits keep the security program from drifting.