ISO 27001 is the international standard for information security management, published jointly by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC). Formally titled ISO/IEC 27001:2022, it specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS) within the context of an organisation’s overall business risks. It is the only standard in the ISO/IEC 27000 family against which organisations can be independently certified.
Where other frameworks focus on specific technical controls or narrow compliance objectives, ISO 27001 takes a holistic, risk-based approach. It requires organisations to systematically identify information security risks, select appropriate controls to treat those risks, and operate a management system that ensures those controls remain effective over time. This makes it applicable across industries, geographies, and organisation sizes — from a 15-person SaaS startup to a multinational financial institution.
Certification is awarded by accredited certification bodies following a formal audit process. Once certified, an organisation undergoes annual surveillance audits and a full recertification audit every three years. The certification is publicly referenceable, unlike restricted-use reports such as SOC 2, which means organisations can openly state their certified status to customers, partners, and regulators.
Understanding the ISMS
The Information Security Management System is the core concept underpinning ISO 27001. An ISMS is not a piece of software or a single document — it is the complete set of policies, procedures, processes, roles, and controls that an organisation uses to manage information security in a structured and repeatable way.
ISO 27001 requires the ISMS to follow a Plan-Do-Check-Act (PDCA) cycle:
- Plan — Establish the ISMS scope, conduct a risk assessment, define a risk treatment plan, and select controls.
- Do — Implement the risk treatment plan, deploy controls, and train staff.
- Check — Monitor and measure control performance, conduct internal audits, and perform management reviews.
- Act — Address nonconformities, implement corrective actions, and drive continual improvement.
This cyclical approach ensures that information security is not a one-time project but an ongoing operational function. The ISMS must be maintained, measured, and improved continuously — a principle that auditors will test during surveillance and recertification audits.
A well-designed ISMS integrates into existing business processes rather than operating as a standalone compliance exercise. Risk assessment feeds into strategic planning. Incident management connects to operational workflows. Access control policies align with HR onboarding and offboarding. The organisations that extract the most value from ISO 27001 are those that treat the ISMS as a genuine management tool, not a documentation exercise.
The structure of ISO 27001: clauses 4 through 10
ISO 27001:2022 is organised into clauses that define mandatory requirements for the ISMS. Clauses 1 through 3 cover scope, normative references, and terms — the operational requirements begin at clause 4.
Clause 4 — Context of the organisation
You must define the external and internal issues relevant to your organisation’s purpose and information security objectives. This includes identifying interested parties (customers, regulators, employees, suppliers) and their requirements, and determining the scope of your ISMS. Scope definition is a critical decision: it determines which assets, processes, locations, and business units are covered by the ISMS and, consequently, by your certification.
Clause 5 — Leadership
Top management must demonstrate commitment to the ISMS by establishing an information security policy, assigning roles and responsibilities, and ensuring that adequate resources are allocated. This is not a formality — auditors will interview senior leadership to verify that the ISMS has genuine executive sponsorship and that security is treated as a business priority, not solely an IT function.
Clause 6 — Planning
This clause requires you to conduct a formal risk assessment: identify information security risks, analyse their likelihood and impact, evaluate them against your risk criteria, and produce a risk treatment plan. You must also define information security objectives that are measurable and consistent with your security policy. The risk assessment methodology is yours to choose, but it must be documented, repeatable, and produce consistent results.
Clause 7 — Support
The ISMS needs resources, competent personnel, awareness programmes, and documented information. Clause 7 requires you to ensure that staff involved in the ISMS are competent through education, training, or experience. It also mandates that documented information (policies, procedures, records) is created, maintained, and controlled — including version control and access restrictions.
Clause 8 — Operation
Clause 8 is where planning becomes execution. You must implement the risk treatment plan, operate the controls you have selected, and manage operational processes. This includes conducting risk assessments at planned intervals or when significant changes occur, and ensuring that outsourced processes are controlled.
Clause 9 — Performance evaluation
You must monitor, measure, analyse, and evaluate the ISMS. This clause requires internal audits at planned intervals and management reviews that assess the ISMS’s continuing suitability, adequacy, and effectiveness. Internal audit results and management review outputs are key inputs to the continual improvement process — and key evidence that auditors will request.
Clause 10 — Improvement
When nonconformities are identified — through internal audits, management reviews, incidents, or other means — you must take corrective action to address the root cause and prevent recurrence. The ISMS must demonstrate continual improvement over time, not merely maintenance of the status quo.
Annex A: the control framework
Annex A of ISO 27001:2022 contains 93 controls organised into four themes. These controls are drawn from ISO/IEC 27002:2022, which provides detailed implementation guidance for each one. Annex A is not a checklist to be implemented wholesale — you select controls based on your risk assessment and document any exclusions in your Statement of Applicability (SoA).
The four themes are:
| Theme | Controls | Coverage |
|---|---|---|
| Organisational | 37 controls | Policies, roles, asset management, access control, supplier relationships, incident management, business continuity, compliance |
| People | 8 controls | Screening, employment terms, awareness, training, disciplinary processes, responsibilities after termination |
| Physical | 14 controls | Physical security perimeters, entry controls, equipment protection, secure disposal, clear desk/screen policies |
| Technological | 34 controls | Endpoint devices, privileged access, authentication, malware protection, vulnerability management, logging, encryption, secure development, data masking |
The 2022 revision significantly restructured Annex A from the previous 2013 version, which contained 114 controls across 14 domains. The current structure is more streamlined, and the revision introduced 11 new controls addressing areas such as threat intelligence, cloud services security, data masking, and monitoring activities.
The Statement of Applicability is one of the most important documents in your ISMS. It lists every Annex A control, states whether each is applicable, provides justification for any exclusions, and describes how applicable controls are implemented. Auditors will examine the SoA closely — it is effectively the bridge between your risk assessment and your control implementation.
Certification vs compliance
There is an important distinction between being ISO 27001 compliant and being ISO 27001 certified.
Compliance means your organisation has implemented an ISMS that aligns with ISO 27001 requirements, but this claim has not been independently verified. Any organisation can declare itself compliant, and some do — but without third-party validation, the claim carries limited weight.
Certification means an accredited certification body has audited your ISMS and confirmed that it conforms to the standard’s requirements. The certification body must itself be accredited by a national accreditation body (such as UKAS in the United Kingdom or ANAB in the United States). Certification is valid for three years, subject to annual surveillance audits.
The certification audit occurs in two stages:
- Stage 1 (documentation review) — The auditor reviews your ISMS documentation, including the scope, risk assessment, Statement of Applicability, policies, and procedures. The purpose is to verify that the ISMS is designed correctly and that the organisation is ready for the Stage 2 audit. This stage may be conducted remotely.
- Stage 2 (implementation audit) — The auditor visits your organisation (physically or remotely) to verify that the ISMS is effectively implemented and operating. They will interview staff, examine evidence of control operation, review records, and test whether the ISMS is functioning as documented. This stage typically takes two to five days depending on the scope and size of the organisation.
Audit findings are categorised as major nonconformities, minor nonconformities, or opportunities for improvement. Major nonconformities must be resolved before certification can be granted. Minor nonconformities must be addressed within a defined timeframe, typically before the first surveillance audit.
Who needs ISO 27001?
ISO 27001 is relevant to any organisation that manages information security risks, but certain situations create particularly strong drivers for certification.
Organisations selling into European, Middle Eastern, or Asia-Pacific markets will find that ISO 27001 is the expected security credential. While SOC 2 dominates in North America, ISO 27001 is the standard that international buyers, partners, and regulators recognise.
Government suppliers and contractors in many countries are required to hold ISO 27001 certification. In the United Kingdom, for example, Cyber Essentials and ISO 27001 are frequently cited in government procurement frameworks.
Regulated industries — financial services, healthcare, defence, critical infrastructure — often use ISO 27001 as a baseline for demonstrating compliance with sector-specific regulations. Regulators may not mandate ISO 27001 directly, but they recognise it as evidence of a mature security posture.
Organisations pursuing multiple compliance frameworks benefit from ISO 27001’s broad control coverage. The ISMS provides a foundation onto which SOC 2, HIPAA, GDPR, PCI DSS, and other requirements can be mapped, reducing duplicate effort across frameworks.
Companies handling sensitive client data — whether intellectual property, financial records, personal data, or health information — use certification to demonstrate to clients that their data is managed within a structured, audited security framework.
ISO 27001 vs SOC 2
The comparison between ISO 27001 and SOC 2 is one of the most frequent questions organisations face when planning their compliance roadmap. While both address information security, they differ in structure, output, and market expectations.
| Aspect | ISO 27001 | SOC 2 |
|---|---|---|
| Governing body | ISO/IEC | AICPA |
| Output | Certification (publicly referenceable) | Audit report (restricted use, shared under NDA) |
| Scope | Organisation-wide ISMS | Specific systems and services |
| Approach | Risk-based management system | Criteria-based attestation |
| Auditor | Accredited certification body | Licensed CPA firm |
| Validity | 3 years (with annual surveillance) | Typically 12 months (annual re-audit expected) |
| Geographic recognition | Global, strongest outside North America | Primarily North America, growing internationally |
In practice, many organisations pursue both. The control overlap is substantial — an organisation with a mature ISO 27001 ISMS will find that 40 to 60 percent of SOC 2 Trust Service Criteria are already satisfied. Starting with ISO 27001 gives you a comprehensive management system that makes subsequent SOC 2 audits more efficient. Starting with SOC 2 gives you a faster path to satisfying North American buyer requirements, with a clear upgrade path to ISO 27001.
Cost overview
ISO 27001 certification costs vary based on organisation size, complexity, scope, and whether you engage consultants or use automation. The following ranges are indicative for a mid-market organisation (50 to 500 employees).
| Cost component | Typical range |
|---|---|
| Certification body fees (Stage 1 + Stage 2) | GBP 5,000 to GBP 30,000 |
| Annual surveillance audit fees | GBP 3,000 to GBP 15,000 |
| Consultancy or implementation support | GBP 10,000 to GBP 60,000 |
| Compliance automation platform | GBP 10,000 to GBP 40,000 per year |
| Internal resource time | Varies — typically 0.5 to 2 FTEs for 6 to 12 months |
| Technology and tooling investments | Varies by gap analysis findings |
The largest hidden cost is internal resource time. Building the ISMS, conducting the risk assessment, writing policies, implementing controls, and preparing evidence requires sustained effort from security, IT, engineering, and leadership teams. Organisations that underestimate this investment frequently see timelines extend and staff burnout.
Compliance automation significantly reduces the operational burden by automating evidence collection, control monitoring, and cross-framework mapping. Organisations using automation typically report 50 to 70 percent reductions in preparation time and a materially lower resource load on engineering teams during audit cycles.
Certification timeline
A realistic timeline for first-time ISO 27001 certification follows these phases:
| Phase | Duration | Key activities |
|---|---|---|
| Scoping and gap analysis | 2 to 4 weeks | Define ISMS scope, assess current state, identify gaps |
| ISMS design and documentation | 6 to 12 weeks | Risk assessment, risk treatment plan, policies, procedures, Statement of Applicability |
| Control implementation | 8 to 16 weeks | Deploy controls, configure tooling, train staff, begin operating the ISMS |
| Internal audit and management review | 2 to 4 weeks | Conduct internal audit, perform management review, address findings |
| Stage 1 audit | 1 to 2 days | Certification body reviews documentation and readiness |
| Remediation (if needed) | 2 to 6 weeks | Address any findings from Stage 1 |
| Stage 2 audit | 2 to 5 days | Certification body audits implementation and operation |
| Certification decision | 2 to 6 weeks | Certification body reviews audit results and issues certificate |
End-to-end, most organisations should plan for 6 to 14 months from project initiation to certification. Organisations with strong existing controls, experienced staff, and automation in place can compress this to 4 to 6 months. Those starting from a minimal security baseline should plan for 12 months or more.
Benefits beyond the certificate
The commercial benefits of ISO 27001 certification are well understood — faster sales cycles, access to regulated markets, competitive differentiation, and reduced security questionnaire burden. But the operational benefits are equally significant.
Structured risk management. The risk assessment and treatment process required by ISO 27001 forces organisations to identify, evaluate, and prioritise information security risks systematically. This replaces ad hoc security decisions with a repeatable methodology that aligns security investment with actual business risk.
Operational resilience. Controls addressing business continuity, incident management, and supplier relationships strengthen the organisation’s ability to withstand and recover from disruptions. These capabilities have value far beyond the certification itself.
Reduced incident likelihood and impact. Organisations with a functioning ISMS detect and respond to security incidents faster. The risk assessment process also surfaces vulnerabilities that might otherwise go unaddressed until they are exploited.
Cross-framework efficiency. The ISMS provides a control foundation that maps to multiple frameworks. Organisations that start with ISO 27001 consistently report that subsequent compliance efforts — SOC 2, HIPAA, GDPR, Cyber Essentials — require significantly less incremental work.
Cultural shift. ISO 27001 embeds security awareness into the organisation’s culture. When staff understand their roles within the ISMS, when risk discussions happen at the leadership level, and when security is measured and reviewed regularly, the organisation’s overall security posture improves in ways that no single technical control can achieve.
Next steps
If your organisation is considering ISO 27001 certification, begin with a scoping exercise and gap analysis. Define which business units, systems, and data assets will fall within the ISMS boundary, then assess your current controls against the standard’s requirements. This will give you a clear picture of the work required and allow you to build a realistic project plan.
From there, the path typically follows this sequence:
- Define the ISMS scope based on business objectives, stakeholder requirements, and risk profile.
- Conduct a risk assessment to identify and evaluate information security risks.
- Develop the risk treatment plan and Statement of Applicability — select controls, justify exclusions.
- Implement controls and document the ISMS — policies, procedures, records, and operational processes.
- Operate the ISMS for a sufficient period to demonstrate effectiveness (auditors expect to see evidence of operation, not just documentation).
- Conduct an internal audit and management review to validate readiness.
- Engage a certification body and complete the Stage 1 and Stage 2 audits.
- Maintain and improve — surveillance audits annually, recertification every three years.