ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Certification signals to customers, regulators and partners that an organization manages information security systematically rather than ad hoc. The 2022 revision refreshed the control set and is now the version organizations certify against.
Two halves: the clauses and Annex A
The standard has two parts. Clauses 4–10 define the management system itself, understanding context and interested parties, setting scope, leadership, risk assessment and treatment, support, operation, performance evaluation and continual improvement.
Annex A then lists 93 controls grouped into four themes: Organizational (37), People (8), Physical (14) and Technological (34). Controls are selected based on risk, not every control applies to every organization.
The Statement of Applicability
The Statement of Applicability (SoA) is the keystone document. For each Annex A control it records whether the control is applicable, the justification for inclusion or exclusion, and its implementation status.
Auditors live in the SoA. A clear, well-justified SoA, backed by evidence for each applicable control, is the difference between a smooth certification and a painful one.
How it complements regional regimes
ISO 27001 maps cleanly onto frameworks like NCA-ECC and supports privacy obligations under PDPL: access control, cryptography, logging, supplier security and incident management all recur. Organizations that run ISO 27001 alongside their regional obligations capture evidence once and reuse it.
Always confirm the certification scope and current control set with your certification body, as accredited requirements are periodically updated.
Keep reading
ISO 22000 certification in 2026: what a food safety management system has to show, site by site
ISO 22000:2018 certification is won or lost at the plant, not at head office. What the standard requires, how the HACCP plan and prerequisite programmes fit, which food laws apply in Australia, New Zealand, the Pacific, Southeast Asia, the Gulf and South Asia, and how to run one FSMS across many sites without a major nonconformity.
GRC Platform Requirements for Regulated Entities: A Buyer's Checklist
A GRC platform holds your risk register, control weaknesses and incident records, and your regulator may treat its vendor as material. What to require from the product, the contract and the hosting before you sign.
Post-Quantum TLS in 2026: How to Test, Evidence and Govern Hybrid Key Exchange
Most browsers already offer post-quantum key exchange. Whether your connections actually use it depends on servers, load balancers and suppliers you control. How to test it, fix it and prove it to an auditor.