ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS). Certification signals to customers, regulators and partners that an organization manages information security systematically rather than ad hoc. The 2022 revision refreshed the control set and is now the version organizations certify against.
Two halves: the clauses and Annex A
The standard has two parts. Clauses 4–10 define the management system itself, understanding context and interested parties, setting scope, leadership, risk assessment and treatment, support, operation, performance evaluation and continual improvement.
Annex A then lists 93 controls grouped into four themes: Organizational (37), People (8), Physical (14) and Technological (34). Controls are selected based on risk, not every control applies to every organization.
The Statement of Applicability
The Statement of Applicability (SoA) is the keystone document. For each Annex A control it records whether the control is applicable, the justification for inclusion or exclusion, and its implementation status.
Auditors live in the SoA. A clear, well-justified SoA, backed by evidence for each applicable control, is the difference between a smooth certification and a painful one.
How it complements regional regimes
ISO 27001 maps cleanly onto frameworks like NCA-ECC and supports privacy obligations under PDPL: access control, cryptography, logging, supplier security and incident management all recur. Organizations that run ISO 27001 alongside their regional obligations capture evidence once and reuse it.
Always confirm the certification scope and current control set with your certification body, as accredited requirements are periodically updated.
Keep reading
Meet GRCLens at the G[P]RC Summit Africa 2026 in Johannesburg
We are growing: in the same week as Kuala Lumpur, GRCLens and Security Solution Consultants are exhibiting at the G[P]RC Summit Africa in Johannesburg on 10 and 11 November 2026.
Meet GRCLens at the PCI SSC 2026 Asia-Pacific Community Meeting in Kuala Lumpur
GRCLens and Security Solution Consultants are exhibiting at the PCI SSC 2026 Asia-Pacific Community Meeting Vendor Showcase in Kuala Lumpur on 11 and 12 November 2026.
From incident to crisis: how ISO/IEC 27035, ISO 22320 and ISO 22361 work together
Incident handling, incident command and crisis leadership are usually run by three teams with three plans. Read together, ISO/IEC 27035, ISO 22320 and ISO 22361 describe one escalation, and the hand-offs between them are where most crises go wrong.