Term

ISO 27001

International standard for information security management systems (ISMS).

ISO/IEC 27001 is the globally recognised standard for establishing, implementing, maintaining, and continually improving an Information Security Management System. Organizations that earn certification go through an audit by an accredited body and implement Annex A controls.

ISO 27001, explained

ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The current edition is ISO/IEC 27001:2022. It is a management system standard, which means it tells you how to run information security as a repeatable process, not which firewall to buy. That distinction explains most of what confuses people when they first read it.

The two halves of the standard

The document is split into a main body of requirements and an annex of reference controls. Both matter for certification, but they are treated very differently. Every requirement in the main body is mandatory. Annex A controls are applied only where your risk assessment shows they are needed, and each decision is recorded in the Statement of Applicability.

Part, What it covers, Can you exclude it? comparison
Part	What it covers	Can you exclude it?
Clauses 4 to 10	Context and scope, leadership, planning (including risk assessment and treatment), support, operation, performance evaluation, improvement	No. All are required for certification
Annex A	93 reference controls in four themes: organizational, people, physical, technological	Yes, with a documented justification

Clauses 1 to 3 are introductory (scope, normative references, terms) and carry no auditable requirements. The core of the system you build, the ISMS, is defined by clauses 4 to 10.

How certification works

Stage 1 audit. A certification body reviews your documentation, scope, and readiness, and flags anything that would block the next stage.
Stage 2 audit. The auditor tests whether the ISMS actually operates as documented, through interviews, sampling, and evidence review.
Certificate issued. Certificates are normally valid for three years, provided nonconformities raised in Stage 2 are closed.
Surveillance audits. Usually annual in years two and three, covering a subset of the system each time.
Recertification. A fuller audit before the certificate expires starts the next three-year cycle.

Choose a certification body accredited by a recognized national accreditation body. A certificate from an unaccredited issuer may not be accepted by the customers who asked for it in the first place.

ISO 27001 versus ISO 27002

ISO/IEC 27002 is the companion guidance document. It takes each Annex A control and explains its purpose and how it might be implemented. You certify against 27001, never against 27002. Think of 27001 as the list of what an auditor will check and 27002 as the handbook that helps you decide how to meet it.

Common misreadings

It is a technical checklist. It is not. Many findings in first audits concern management review, internal audit, or risk treatment records rather than technology.
All 93 controls must be implemented. Only the controls your risk assessment requires, as justified in the Statement of Applicability.
Certification covers the whole company. It covers the scope you define. A narrow scope is legitimate, but customers will read the scope statement on your certificate.
The 2013 edition is still fine. The transition period for 2013-based certificates has ended, so current certification is against the 2022 edition.

FAQ

Frequently asked questions

Is ISO 27001 a law?

No. ISO 27001 is a voluntary international standard. Organizations adopt it because customers, partners, or tenders require evidence of a managed security program. Some contracts and procurement rules make certification a condition of doing business, but that obligation comes from the contract, not from the standard itself.

Can an individual be ISO 27001 certified?

Organizations are certified against ISO 27001. Individuals can hold personal qualifications such as lead implementer or lead auditor credentials, which show they understand the standard. Those personal certificates say nothing about whether a particular company's ISMS conforms to it.

How long does ISO 27001 certification last?

A certificate is typically valid for three years. During that time the certification body runs surveillance audits, usually once a year, to confirm the ISMS is still operating. A recertification audit before expiry renews the certificate for another cycle.

Does ISO 27001 apply only to IT?

No. The standard covers information in any form, including paper records, people processes, suppliers, and physical premises. Annex A has whole themes for people and physical controls. The scope you define decides which parts of the organization are included, and it can extend well beyond the IT department.

Keep exploring