ISO/IEC 27001
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS, and is the standard organizations certify against to prove they manage information security systematically.
What it covers
The current edition, ISO/IEC 27001:2022, has two parts. Clauses 4–10 define the management system requirements — organizational context, leadership, planning, support, operation, performance evaluation, and improvement. Annex A lists 93 reference controls grouped into four themes: organizational, people, physical, and technological.
Which controls you implement is not fixed. Clause 6.1.2 requires a risk assessment, and Clause 6.1.3 requires a Statement of Applicability that records which Annex A controls you selected and why. ISO/IEC 27002 provides the implementation guidance for each control.
Why it matters to your business
Certification is issued by accredited bodies after a two-stage audit and is increasingly a procurement requirement — especially when selling to enterprises, financial institutions, or the public sector. It also provides a structured backbone for meeting overlapping obligations: ISO 27001 maps closely onto GDPR security measures, NIS2 requirements, and the ICT risk-management framework DORA imposes on financial entities.
Because the standard shares the Annex SL management-system structure with ISO 9001 and ISO/IEC 42001, organizations running several management systems can integrate them into a single IMS rather than maintaining parallel policies, audits, and reviews.
Frequently Asked Questions
Is ISO 27001 certification mandatory?
No — it is a voluntary standard. But enterprise procurement teams, financial institutions, and public-sector buyers increasingly require it, and it is strong supporting evidence for GDPR, NIS2, and DORA compliance.
How long does ISO 27001 certification take?
Organizations with an existing management system typically need 6–12 months. Starting from scratch, expect 12–18 months depending on scope, documentation maturity, and remediation work found by the gap analysis.
What is the difference between a gap analysis and a certification audit?
A gap analysis is a self- or consultant-led assessment against the standard that produces a remediation roadmap. A certification audit is the formal two-stage assessment by an accredited certification body that issues the certificate.
Related Standards
- •ISO/IEC 27001:2022 — Information security management systems — Requirements
- •ISO/IEC 27002:2022 — Information security controls
- •ISO/IEC 27005 — Information security risk management guidance
Free Tools & Resources
Further Reading
Products & Services
Need help with this?
We consult and build across all of these domains — tell us what you are working on.