ISO/IEC 27001 is an international standard that describes how an organization should properly protect its information. Put simply: it is a set of requirements that lets a company prove it isn’t guarding data on gut feeling, but through a thought-out, verifiable system. In the standard, that system is called an Information Security Management System (ISMS). The whole idea rests on a risk-based approach: first you work out what could go wrong and how, then you protect what actually matters. ISO 27001 certification is not required by law, but it is a widely recognized way of showing that a company takes security seriously.

Why would anyone need ISO 27001?

Imagine someone trusts you with their data — a customer, a partner, a patient. How do they know you won’t lose it, leak it, or let it fall into the wrong hands? They can take your word for it, or they can ask for proof. ISO 27001 is exactly that proof: an independent auditor checks whether the company has clear rules for protecting information and whether it actually follows them.

It is a bit like the difference between saying “my house is tidy, honestly” and showing that everything has its place, the doors lock, and the spare keys are accounted for. The standard doesn’t check a single antivirus or password — it checks whether the whole thing holds together.

What exactly does ISO 27001 protect?

An important detail that many people get wrong: ISO 27001 is about information security, not just computers. What’s protected is the information itself — whether it sits in an IT system, is printed on paper, or is spoken aloud over the phone. So a signed contract locked in a cabinet and a database in the cloud follow the same logic.

In practice it comes down to looking after three things (known as the CIA triad):

Confidentiality — only the right people can see the data.
Integrity — the data is genuine and nobody has quietly altered it.
Availability — the data is there when it’s needed.

The standard is also technology-neutral — it doesn’t tell you to buy a particular product or piece of hardware. The company assesses its own risks and chooses controls that fit them. The current version is ISO/IEC 27001:2022.

What is an ISMS — the “system” at the heart of all this?

An ISMS is not a single program or a one-off project that you “finish and forget.” It is a way of working: a set of rules, processes, roles and concrete controls through which a company manages information security on an ongoing basis. In that sense it resembles other ISO systems, such as ISO 9001 for quality.

At the heart of an ISMS is risk assessment. The company asks itself: what valuable things do we have, what could threaten them, where are the weak spots? Then it decides what to do about each risk — reduce it with a control, knowingly accept it, transfer it (for example to an insurer), or avoid it altogether. The whole thing is regularly checked and improved, so the system stays alive and keeps up with change.

How is the standard built?

ISO 27001 has two parts worth telling apart.

The first is clauses 4–10 — the mandatory “skeleton” of the management system. In short, they say the company must: understand its context and define what the system covers (clause 4), have committed leadership (5), plan how it deals with risks (6), provide resources and skills (7), run the processes in practice (8), measure and audit how well it works (9), and keep improving (10).

The second part is Annex A — a kind of catalogue of possible controls. A company doesn’t have to implement all of them; it picks the ones that match its risks. Annex A works like a checklist that makes it easier to be sure nothing important was forgotten.

What’s in Annex A (the 2022 version)?

In the 2022 edition, Annex A contains 93 controls grouped into 4 categories:

Organizational (37) — rules and procedures, e.g. security policies, managing equipment and data, working with suppliers, responding to incidents.
People (8) — because people are part of security too: screening when hiring, training, remote-working rules.
Physical (14) — doors, locks, restricted-access areas, protecting equipment and storage media.
Technological (34) — the part you’d associate with IT: access management, encryption, protection against malware, backups, monitoring of events.

The 2022 version also added eleven new controls that respond to newer realities — among them cloud security, readiness for crisis situations, better monitoring, and data masking.

How does the 2022 version differ from 2013?

The standard has a history. It grew out of the British standard BS 7799 from the 1990s. The first edition of ISO 27001 came out in 2005, the next in 2013, and the latest in 2022.

The biggest change between the 2022 and 2013 editions concerns Annex A:

2013 — 114 controls across 14 domains.
2022 — 93 controls across 4 categories.

The smaller number doesn’t mean half the requirements were dropped. Many controls were simply merged, some were refreshed, and eleven were added. Companies certified under the old edition had to move to the 2022 version within a set transition period.

ISO 27001 vs ISO 27002 and the whole 27000 family

This is a common source of confusion, so let’s break it down. ISO 27001 says WHAT must be met — and it is the standard you get certified against. ISO 27002 says HOW to do it — it’s a practical guide to implementing the individual controls from Annex A. ISO 27002 is not certifiable; it’s a supporting document.

Both belong to the wider ISO/IEC 27000 family, which also includes, among others: ISO 27000 (overview and vocabulary), ISO 27005 (risk management), and ISO 27701 (a privacy extension).

What does certification look like?

The certificate is issued by an independent certification body — ideally an accredited one, meaning it has itself been vetted by a higher authority. The audit usually has two stages:

Stage 1 — the auditor reads the documentation and checks whether the system is well designed: the scope, policies, risk assessment, Statement of Applicability. They flag what to fix before the next step.
Stage 2 — the auditor checks whether it all works in practice, not just on paper: whether controls are implemented and whether people actually follow them.

After a successful audit the company gets a certificate that is usually valid for 3 years. During that time there are annual surveillance audits (checking that nothing has drifted), and before it expires a recertification — a full audit for a new cycle — is needed.

The scope of certification matters: a company can certify its entire operation or just part of it (for example a single department or service). The scope is written on the certificate, and it tells you what the compliance really covers. So it’s worth looking at when someone waves a certificate around.

The Statement of Applicability (SoA) and the documents

The Statement of Applicability (SoA) is one of the key documents. In short, it’s a list of the Annex A controls with a note for each: which the company applied, which it didn’t, and why. The SoA links the risk assessment to concrete decisions, and it’s the first thing an auditor looks at.

Beyond it, the standard requires, among others: the system’s scope, the security policy, a description and results of the risk assessment together with a treatment plan, security objectives, and records proving competence, internal audits and management reviews.

Continual improvement — the PDCA cycle

ISO 27001 assumes that security can’t be “achieved once and for all.” It captures this in the simple PDCA (Plan–Do–Check–Act) cycle: plan, implement, check, improve — round and round. That way the system keeps up with new threats and changes in the company, instead of going stale a year after launch.

Who reaches for ISO 27001, and what do they get out of it?

Any company, of any size and in any industry, that handles important information can implement the standard. It’s most common in sectors such as IT and cloud services, finance, healthcare, and telecommunications, as well as among providers that process their clients’ data. Sometimes a customer or a tender simply requires it.

What it brings day to day:

order and clear rules instead of acting case by case,
a clear sense of who is responsible for what,
an easier way to prove to customers and partners that data is in good hands,
ready-made procedures for an incident or outage,
a solid foundation for other requirements (e.g. personal-data protection).

ISO 27001 and other standards and regulations

ISO 27001 vs SOC 2

Both deal with security, but the outcome differs. ISO 27001 ends with a certificate and is a standard recognized worldwide. SOC 2 ends with a detailed auditor’s report and is popular mainly in the US. To simplify: one gives you a document confirming “we have a system,” the other a thorough description of how specific controls actually work.

ISO 27001 vs GDPR

GDPR is a law on the protection of personal data — compliance with it is mandatory. ISO 27001 is a voluntary standard about information security in general. They are not the same: an ISO 27001 certificate does not automatically mean GDPR compliance. But it helps a great deal, because many controls (risk assessment, incident response, access control) overlap with what GDPR expects.

ISO 27001 vs ISO 27701

ISO/IEC 27701 is an extension of ISO 27001 covering privacy — it creates a Privacy Information Management System (PIMS). It doesn’t work on its own: to be certified against it, you first need ISO 27001 in place. It’s especially useful for companies that want to put personal-data protection in order, for example in the context of GDPR.

ISO 27001 and NIS2

The NIS2 Directive is an EU law that raises cybersecurity requirements for many companies deemed essential or important. Unlike ISO 27001, its obligations are legally binding. An ISO 27001 certificate alone doesn’t mean NIS2 compliance, but an implemented system overlaps strongly with it — especially around risk management, incident reporting, business continuity and supplier security. That’s why, for many companies, ISO 27001 is a practical starting point for meeting NIS2’s requirements.

Learn more

NIST Cybersecurity Framework — It is a cybersecurity framework often used to support ISO 27001 control alignment.
Inventory — An inventory of assets helps meet ISO 27001 requirements for asset management.
SaaS Security Posture Management (SSPM) — SSPM helps monitor SaaS risks that may be relevant to ISO 27001 compliance.
PCI-DSS — PCI-DSS and ISO 27001 both address security controls, but for different scopes.
Asset Discovery — Asset discovery supports ISO 27001 by identifying systems that must be protected.

ISO 27001