ISO/IEC 27001 — Information Security Management Systems

#Why It Matters

#How It Works

#The two halves of the standard

ISO/IEC 27001:2022
├── Clauses 4–10  ── the management system: REQUIRED, every clause, no exclusions
│     4 Context      who cares about us, what is in scope
│     5 Leadership   top management owns it, signs the policy
│     6 Planning     risk assessment, risk treatment, objectives
│     7 Support      people, competence, awareness, documents
│     8 Operation    actually run the risk process and the controls
│     9 Evaluation   monitoring, internal audit, management review
│    10 Improvement  nonconformities, corrective action
│
└── Annex A  ── a menu of 93 controls you compare your choices against
      5 Organizational (37)   policy, roles, suppliers, cloud, incidents, BC
      6 People (8)            screening, awareness, remote working
      7 Physical (14)         perimeters, equipment, clear desk
      8 Technological (34)    access, crypto, logging, secure coding, backup

Clauses 4–10 use the Harmonized Structure shared by all ISO management-system standards (ISO 9001 for quality, ISO 22301 for business continuity). That is why an organisation can run one combined management system and pass one combined audit.

Annex A is not a checklist you must implement in full. You may exclude a control, but you have to justify the exclusion. A fully remote company with no office can exclude most physical-entry controls, provided it explains why and covers home working instead (6.7 remote working).

Memory hook

clauses are the engine, Annex A is the parts catalogue. Every clause is mandatory, because without them nothing runs. You only fit the parts your risks call for, and you write down why you skipped the others.

#The core loop: risk → controls → Statement of Applicability

This is the part interviewers probe most, because it is where the ISMS makes actual decisions.

In practiceAn abridged Statement of Applicability (SoA) for a SaaS company. The justification column is what makes it defensible:

Control                              Applicable  Status       Justification / evidence
5.23 Information security for         Yes        Implemented  All prod in AWS; R-014 provider compromise.
     use of cloud services                                    Evidence: cloud provider register, SCP baseline
7.4  Physical security monitoring     No         Excluded     No company-owned premises; prod hosted by
                                                              cloud provider (covered by 5.23 + provider ISO cert)
8.16 Monitoring activities            Yes        Partial      SIEM covers prod; corp laptops onboard Q1   ← gap
                                                              Treatment plan TP-07, owner: SecOps lead
8.28 Secure coding                    Yes        Implemented  R-021 injection. SAST gate in CI, PR review rule

An auditor will pick the "Partial" line, ask for treatment plan TP-07 and check whether Q1 actually happened.

#What changed in 2022

The 2013 edition had 114 controls in 14 domains. The 2022 edition merged them into 93 controls in 4 themes and added 11 new controls, all of them things modern attacks forced into scope:

Amendment 1 (2024) added one requirement to clauses 4.1 and 4.2: decide whether climate change is a relevant issue for your ISMS and whether stakeholders have climate-related requirements. Usually it shows up as a business-continuity risk, for example data-centre flooding or heat.

#The family of standards

You certify against 27001 only. You cannot be "27002 certified", and if a vendor claims that, it is a red flag.

#Mandatory documented information

Auditors expect these documents and records. If one is missing, that alone is a nonconformity:

• Scope of the ISMS (4.3) and the information security policy (5.2)
• Risk assessment process and results (6.1.2, 8.2), risk treatment process and results (6.1.3, 8.3)
• Statement of Applicability (6.1.3 d) and information security objectives (6.2)
• Evidence of competence (7.2) and of operational planning and control (8.1)
• Monitoring and measurement results (9.1)
• Internal audit programme and results (9.2) and management review results (9.3)
• Nonconformities and corrective actions (10.2)

Most Annex A controls also need evidence, for example access review records, but the standard does not list it as mandatory documentation.

#The certification audit cycle

 Year 0                                    Year 1         Year 2         Year 3
 ┌──────────┐   ┌──────────┐   ┌───────┐   ┌──────────┐   ┌──────────┐   ┌───────────────┐
 │ Stage 1  │──►│ Stage 2  │──►│ Cert  │──►│Surveill. │──►│Surveill. │──►│Recertification│
 │ docs &   │   │ controls │   │issued │   │ audit 1  │   │ audit 2  │   │ full audit,   │
 │ readiness│   │ operating│   │3 years│   │ (sample) │   │ (sample) │   │ new 3 years   │
 └──────────┘   └──────────┘   └───────┘   └──────────┘   └──────────┘   └───────────────┘
      ▲               │
      └─ major NC? ───┘  close it (with evidence) before the certificate is issued

The auditing firm (the certification body) should be accredited by a national accreditation body that belongs to the IAF (International Accreditation Forum), for example UKAS in the UK, DAkkS in Germany, ANAB in the US or PCA in Poland. You can check a certificate in the IAF CertSearch database.

In practiceWhat a stage 2 evidence request looks like. Each line traces back to an SoA entry:

Audit sample request — Stage 2, Day 1
REQ-01  5.18 Access rights      Last quarterly access review for prod AWS + GitHub org;
                                show 3 leavers from the HR list and the date their access was removed
REQ-02  8.8  Technical vulns    Vulnerability SLA policy; 5 criticals from the scanner and fix dates
REQ-03  5.24 Incident mgmt      Two closed incidents with timeline, lessons learned, actions
REQ-04  8.15 Logging            Retention setting on prod log bucket; proof logs are tamper-protected
REQ-05  9.2  Internal audit     Audit programme, last report, status of its findings

🎯

On the job. REQ-01 is where most engineering teams fail. Leavers are removed from the identity provider but keep a personal access token in GitHub or an IAM user in an old AWS account. Automate the joiner-mover-leaver flow and keep the review export, because the evidence has to exist before the auditor asks for it.

#Security Angle

#Certified does not mean secure

A certificate shows that a management system exists for the stated scope and that it operated on the days the auditor sampled. It does not show that every system is hardened. The common gaps are:

📰

Real incident — Change Healthcare (2024). In February 2024 attackers used stolen credentials to log in to a Citrix remote-access portal that had no multi-factor authentication. They moved inside for days, then deployed ransomware that stopped US prescription and claims processing for weeks. UnitedHealth's CEO confirmed the missing MFA in testimony to the US Congress. Lesson: "secure authentication" (8.5) has to be verified on every entry point, including systems inherited through an acquisition. An SoA line that says "Implemented" proves nothing if no one has checked it.

📰

Real incident — MOVEit Transfer (2023, CVE-2023-34362). The Cl0p group mass-exploited a SQL injection flaw in Progress MOVEit Transfer, a file-transfer product. Data was stolen from thousands of organisations, many of which only used the product through a payroll or benefits supplier. Lesson: supplier controls (5.19–5.22) and cloud-service controls (5.23) must cover fourth parties. Knowing which of your suppliers run which internet-facing products is a risk-assessment input, not paperwork.

#How defenders use the ISMS

🎯

On the job. When reviewing a vendor, ask for the certificate and the SoA (or an extract). The certificate tells you a body audited something. The scope and the SoA tell you whether your data's path is inside the boundary and which controls were excluded. Then confirm the certification body is accredited.

#ISO 27001 vs Other Frameworks

A short comparison with SOC 2 is also in compliance frameworks.