ISO/IEC 27001:2022 in brief
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The 2022 edition reorganised Annex A into 93 controls in four themes, and added controls such as threat intelligence, cloud services security, data masking, data leakage prevention and web filtering. Organisations certified to the 2013 version had until 31 October 2025 to transition.
Organisational
Policies, roles, supplier security, incident management, continuity.
People
Screening, awareness, remote working, disciplinary process.
Physical
Secure areas, equipment, clear desk, media handling.
Technological
Access, cryptography, logging, secure development, DLP.
The certification journey
- Define scope and context
- Risk assessment and treatment plan
- Statement of Applicability (SoA)
- Implement controls and collect evidence
- Run the ISMS for a few months and measure
- Internal audit and management review
- Stage 1 (documentation) and Stage 2 (implementation) audits by a certification body
- Annual surveillance audits; recertification every three years
Documents you'll need
- ISMS scope and information security policy
- Risk assessment methodology, register and treatment plan
- Statement of Applicability
- Information security objectives
- Evidence of competence and awareness
- Operational procedures and records
- Internal audit programme and reports
- Management review minutes, nonconformities and corrective actions
How long does it take?
For a mid-sized organisation with some existing controls, six to nine months from kickoff to certification is typical. The biggest variable is how quickly technical controls such as logging, access reviews and vulnerability management can be put in place and evidenced.