ISO/IEC 27001 certification is independent confirmation that an organization’s information security management system (ISMS) conforms to the requirements of ISO/IEC 27001. The current edition is ISO/IEC 27001:2022. An organization defines what its ISMS covers, manages information-security risks within that scope, and is audited by an external certification body. Certification can help demonstrate disciplined security governance to customers and other stakeholders, but it is not a guarantee against breaches or proof of automatic compliance with every law.
What ISO/IEC 27001 certification means
ISO/IEC 27001:2022 is titled Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it specifies requirements for establishing, operating, maintaining and continually improving an ISMS.
As an Amazon Associate I earn from qualifying purchases.
An ISMS is the organization-wide system for identifying and treating information-security risks. It brings together governance, people, processes and technology to protect the confidentiality, integrity and availability of information. Its purpose is not to install a prescribed set of products; the standard is technology-neutral and applies across industries and organization sizes.
Certification applies to the ISMS within a defined scope. It does not certify a product, prove that every company system was examined, or promise that no security incident will occur. The audit evaluates conformity with the standard using evidence and sampling; organizations still have to manage changing risks and vulnerabilities.
#1 Best Overall
Who issues the certificate?
ISO and IEC publish the standard; they generally do not audit individual companies or issue their certificates. Certification is performed by an independent certification body, also called a conformity assessment body. An accreditation body assesses the competence of certification bodies under its accreditation system.
| Party | Role |
|---|---|
| ISO/IEC | Publishes ISO/IEC 27001 and related standards. |
| Accreditation body | Assesses whether a certification body is competent to conduct the relevant audits. |
| Certification body | Audits the organization and makes the certification decision. |
| Organization | Operates the ISMS within the certificate’s stated scope. |
| Consultant or compliance platform | May help implement processes or organize evidence, but does not replace an independent certification audit. |
An accredited certification body can provide additional confidence in the competence and impartiality of the audit. ISO notes that accredited conformity assessment can add assurance; customers may specifically require accredited certification. Before choosing a provider, check that its accreditation covers ISO/IEC 27001:2022 and is recognized in the markets where customers will rely on the certificate. A certificate from a non-accredited provider may not carry the same procurement or contractual weight.
Is certification mandatory?
For most businesses, ISO/IEC 27001 certification is not a general legal requirement. It can nevertheless become commercially necessary when a contract, customer, procurement process, sector rule or internal governance decision calls for it. Enterprise buyers may use certification as evidence in supplier-risk reviews, while organizations entering new markets may find it helps establish a recognizable security-management baseline.
Recommended Free Tools
Certification does not automatically satisfy GDPR, HIPAA, PCI DSS, NIS2 or other legal and industry obligations. It can support a compliance program by strengthening governance and producing useful evidence, but each organization must determine which laws and contractual requirements apply to it. For example, EASA information-security rules explain that ISO/IEC 27001 practices may align with aviation Part-IS objectives, but certification is not a substitute for Part-IS requirements.
What an ISMS includes
An ISMS is an operating management system, not just a folder of policies. Its design depends on the organization’s scope, obligations and risk assessment. Typical components include:
- Leadership commitment, assigned responsibilities and information-security objectives.
- A defined scope, asset and information inventories, and a repeatable risk-assessment method.
- A risk register, risk-treatment decisions and a Statement of Applicability.
- Policies and processes for areas such as access, incidents, suppliers, changes, continuity and employee awareness.
- Operational records showing that selected controls are working.
- Monitoring, internal audits, management reviews, corrective actions and continual improvement.
Outsourcing does not remove the need to manage risk. Cloud services, contractors and other suppliers can be within or relevant to the ISMS risk picture even when the organization does not operate their systems directly.
What ISO/IEC 27001:2022 requires
The requirements are principally organized in Clauses 4–10. They work as a continuing management cycle rather than a one-time sequence: context and risks change, controls are monitored, and management decisions and improvements feed into the next cycle.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →| Clause | What the organization must address |
|---|---|
| 4 — Context | Understand relevant internal and external issues, interested parties and their requirements; define the ISMS scope and processes. |
| 5 — Leadership | Demonstrate leadership commitment, establish an information-security policy and assign responsibilities and authorities. |
| 6 — Planning | Assess and treat information-security risks, set objectives, plan relevant changes and document treatment decisions. |
| 7 — Support | Provide resources; address competence, awareness and communication; control documented information. |
| 8 — Operation | Plan and control operational processes, conduct risk assessments at defined intervals and when significant changes occur, and implement the treatment plan. |
| 9 — Performance evaluation | Monitor and evaluate the ISMS, conduct internal audits and carry out management reviews. |
| 10 — Improvement | Address nonconformities, take corrective action and continually improve the ISMS. |
The requirements specify what the ISMS must achieve, not a universal set of tools or identical procedures for every company. Documentation and controls should fit the organization’s real operations and risks.
What are the 93 Annex A controls?
ISO/IEC 27001:2022 includes 93 Annex A reference controls, grouped into organizational, people, physical and technological themes. The 2022 revision reorganized the control set: UKAS describes 11 new controls, 24 merged controls and 58 updated controls compared with the prior structure.
Annex A is not a checklist that every organization must implement identically. The organization assesses risks, chooses treatment options, selects controls suited to those decisions and applicable obligations, then compares its selected controls against Annex A. It documents applicability and rationale in the Statement of Applicability (SoA). An exclusion should be defensible in light of the risks and requirements, not chosen simply because a control is inconvenient.
Examples of controls in the 2022 set include threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, data leakage prevention, data masking, data deletion, monitoring activities, web filtering and secure coding. Which are relevant depends on the organization and its risk treatment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
ISO/IEC 27002 is guidance for information-security controls, not a separate certification standard. ISO/IEC 27005 provides risk-management guidance, while ISO/IEC 27701 addresses privacy information management where relevant. The auditable ISMS requirements for this certification are in ISO/IEC 27001.
Rank #3
Why the Statement of Applicability matters
The SoA connects risk decisions to the controls the organization operates. It records which Annex A controls are applicable, which are excluded and why, and the status or method of implementation. It should be consistent with the risk assessment, treatment plan and actual evidence.
A practical SoA entry might identify a control, explain whether it applies, give the rationale, describe how it is implemented and point to relevant records or procedures. For instance, a cloud-dependent service might record how it assesses cloud-provider security and retain supplier reviews as evidence. That is an illustration, not a prescribed universal entry.
Common weaknesses include generic template wording, exclusions that do not match the risk assessment, and claims that controls are implemented when records do not support that claim. The SoA is an audit trail, not a box-ticking form. See Clause 6.1.3 risk-treatment guidance for further context.
How to get certified
A credible program starts with a business decision and ends with an ISMS that continues to operate. The following sequence keeps scope and risk decisions ahead of template-writing.
- Establish the business case. Identify customer, procurement, regulatory or strategic drivers; set ownership, a target scope, budget and target timing. Note existing frameworks or certifications that can inform the work.
- Define the ISMS scope. Specify the entities, services or products, locations, information, cloud environments, personnel, suppliers and supporting functions covered. Explain important interfaces with excluded parts of the business. A narrow scope can reduce complexity, but it must not mislead customers about what the certificate covers.
- Select a certification body early. Confirm accreditation for the 2022 standard, market recognition, relevant sector experience, availability, audit approach, fees and ongoing audit arrangements. Ask how scope and evidence readiness are assessed and how findings are handled.
- Assess the gaps. Compare current practice with Clauses 4–10, relevant Annex A controls, customer commitments and applicable legal requirements. Distinguish missing processes from practices that exist but are undocumented, inconsistently operated or unsupported by evidence.
- Assess and treat risks. Establish criteria for likelihood, impact and risk acceptance; identify owners; select treatment options; record residual-risk approval; and define review triggers. Revisit assessments after significant changes to technology, suppliers, products, law or organization.
- Document the system proportionately. Prepare the scope, policy, risk methodology and register, treatment plan, SoA, objectives and necessary supporting processes. Documentation should be controlled, current and usable rather than a large library disconnected from work.
- Operate controls and retain evidence. Collect records such as access reviews, onboarding and offboarding, training, vulnerability reports, incident records, backup tests, supplier assessments, change records, risk approvals and security metrics. Evidence of recurring operation is stronger than documents assembled just before an audit.
- Conduct an internal audit. Cover the defined ISMS and applicable requirements, use competent auditors with suitable independence, and test whether documented processes match actual practice. Record findings objectively.
- Hold a management review. Senior leaders should review performance, audit results, changes in context, risks, corrective actions, objectives, resources and improvement opportunities, and retain the decisions and follow-up actions.
- Complete the external certification audit. Certification bodies commonly use a two-stage initial audit; confirm the selected body’s specific program and readiness expectations.
- Resolve findings and maintain the ISMS. Address root causes, implement corrective actions and provide evidence as required by the certification body. Continue monitoring, auditing, reviewing and improving the system after certification.
What happens during the certification audit?
Stage 1: readiness and system design
Stage 1 typically reviews whether the ISMS is designed and ready for the implementation audit. The auditor may examine scope, policies, risk methodology and assessment, the SoA, objectives, internal-audit planning and management-review readiness. The exact program varies by certification body and organization.
Stage 2: implementation and effectiveness
Stage 2 evaluates whether the ISMS is operating in practice. Auditors may interview staff, sample records, observe work, inspect systems and test whether processes and selected controls operate as described. They do not examine every transaction or system in every audit; sampling and the agreed scope matter.
Findings and corrective action
A nonconformity is a failure to meet a requirement. Certification bodies classify findings under their applicable rules; major and minor nonconformities have different implications for the certification decision and follow-up. The organization should determine root cause, correct the issue, prevent recurrence and submit evidence or a corrective-action plan as required by the body.
After certification
Certification is maintained through ongoing surveillance and eventual recertification, subject to the certification body’s rules and the certificate’s conditions. Confirm the calendar, audit scope and costs directly with the body rather than assuming every certificate has identical terms. BSI describes a certification process involving audit and ongoing improvement in its ISO/IEC 27001 certification information.
How long does certification take?
There is no dependable universal timeline. Readiness depends on the scope, existing security maturity, number of locations and services, supplier and cloud complexity, available staff, remediation needs, and how much evidence exists from controls already operating. A small organization with mature practices may need less implementation work than a multinational with fragmented processes, but neither should treat policy completion as proof of readiness.
Build the schedule around milestones—scope, risk assessment, control operation, evidence, internal audit, management review and external audit availability—rather than a generic promise of certification in a fixed number of months. The certification body can explain its audit planning and prerequisites for the specific scope.
How much does certification cost?
There is no universal certification price. BSI states that cost varies with the size and complexity of the ISMS. The external audit fee is only one part of the total cost; internal time and remediation can be substantial.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Scope and complexity: employee and user count, legal entities, sites, countries, products, infrastructure and regulated information.
- Current maturity: missing processes, control gaps, technical remediation and the amount of evidence already available.
- People and support: internal engineering, security, legal, HR and management time; optional consulting; and training.
- Technical assurance: penetration testing or other assessments needed to understand and treat risks.
- Tools and audit logistics: compliance software if used, certification-body audit days, travel and international coordination.
- Ongoing operation: surveillance, recertification, staff time and continued control maintenance.
Request comparable quotes that state the proposed scope, accreditation, audit assumptions, included stages, follow-up terms and ongoing fees. Avoid treating a low fixed-price offer or an automation subscription as a substitute for an appropriate independent audit and functioning controls.
Best Value
Who can be certified, and what can the scope cover?
Organizations of many sizes and sectors can seek certification, including SaaS and cloud providers, professional services firms, manufacturers, universities, nonprofits and government suppliers. A smaller headcount does not remove the need to show that processes work; it may, however, make a narrow and well-defined scope practical.
Depending on the business, the scope might cover an entire legal entity or organization, a service line, regional operation, site, data center, or a product and its supporting cloud environment. Read the scope statement on the certificate: a certificate does not automatically cover every affiliate, location, service or system.
Scope boundaries should reflect real dependencies. Excluding a department or system that materially supports an included service can leave gaps that customers or auditors question. Explain interfaces, responsibilities and relevant suppliers clearly.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsIs ISO/IEC 27001 worth it for your business?
Certification is most useful when independent assurance has a clear purpose and leadership is ready to maintain the system. Consider the following decision checks before committing resources.
- Buyer demand: Are important customers or tenders asking for accredited certification, or would another form of assurance meet their needs?
- Strategic value: Will certification support entry into target markets, reduce repeated security reviews or improve governance and risk ownership?
- Fit with obligations: Which contractual, regulatory and sector requirements apply, and what evidence do they actually require?
- Readiness: Can leadership assign owners, approve risk decisions and fund ongoing operation rather than treating the project as a one-off?
- Scope stability: Are products, legal entities and operating models stable enough that the proposed scope will remain meaningful through audit and maintenance?
- Alternatives: Do target buyers place more weight on SOC 2, FedRAMP, PCI DSS or another program, and could requirements overlap?
Certification may be premature if the organization has no clear business need, cannot define a credible scope, lacks leadership support or expects a certificate to substitute for security work.
ISO/IEC 27001 compared with other frameworks
These programs address different needs. A control mapping may reduce duplicated effort, but one framework does not automatically satisfy the requirements of another.
| Framework | What it is useful for | How it differs from ISO/IEC 27001 |
|---|---|---|
| ISO/IEC 27001 | A certifiable information-security management system built around risk management and continual improvement. | Certification evaluates the ISMS within a defined scope; it is not a report covering every control transaction. |
| SOC 2 | A US-origin attestation report using Trust Services Criteria, often requested from technology and SaaS providers. | It is an attestation report rather than certification to an ISMS standard; some organizations pursue both. |
| NIST Cybersecurity Framework | Flexible guidance for organizing cybersecurity risk management. | It can guide a program but is not a substitute for ISO/IEC 27001 certification. |
| CIS Controls | A prioritized set of practical safeguards for security improvement. | It can inform technical and operational work but does not itself provide ISMS certification. |
| PCI DSS | Security requirements for environments handling payment-card data. | Its payment-data focus does not replace a general information-security management system. |
| ISO/IEC 27701 | Privacy information management guidance and requirements for organizations addressing privacy governance. | It can complement an ISMS, but does not replace applicable privacy law. |
Common mistakes to avoid
- Implementing Annex A as a blind checklist. Start with scope and risks; document why controls are applicable and how they address treatment decisions.
- Using scope to hide dependencies. A boundary that excludes important supporting operations can make the certificate misleading or leave interfaces unmanaged.
- Writing policies nobody follows. Auditors look for operating evidence, not just approved documents.
- Writing templates before assessing risk. Generic policies can miss the organization’s material risks and obligations.
- Ignoring suppliers and cloud services. Third-party operations still create risks the organization must assess and manage.
- Treating internal audit as a formality. A meaningful audit tests practice and reveals issues before the external assessment.
- Assuming zero findings is the objective. A functioning ISMS identifies shortcomings and corrects them; cosmetic perfection is not the measure of effective risk management.
- Buying templates or software and calling the program complete. Tools can organize work, but the business still owns scope, risk decisions, control design and operation.
- Confusing certification with a security guarantee. Certification is evidence of conformity within a scope and audit approach, not proof of immunity to incidents or vulnerabilities.
Readiness checklist
- The business purpose and ISMS scope are approved and understandable.
- Roles, responsibilities and risk-acceptance authority are assigned.
- The risk method, risk assessment and treatment decisions are documented and current.
- The SoA matches the risks, obligations, selected controls and implementation evidence.
- Policies and processes reflect actual work and have responsible owners.
- Controls have operated long enough to produce credible records.
- Internal audit and management review are complete, with actions tracked.
- The selected certification body’s accreditation, scope, audit plan and ongoing terms are confirmed.
- Corrective actions have owners, root-cause analysis and closure evidence.
What happened to ISO/IEC 27001:2013?
The operative edition for certification is ISO/IEC 27001:2022. The transition deadline for existing 2013 certificates was October 31, 2025; UKAS transition arrangements state that 2013 certificates were required to expire or be withdrawn by that date. BSI’s transition timeline records the move to the 2022 edition. Businesses seeking certification or maintaining a certificate should work to the 2022 edition and confirm applicable arrangements with their certification body.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
