Compliance Guide - ISO/IEC 27001¶

Overview¶

ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, processes, roles and controls an organisation uses to manage information security risk, and to keep improving how it does so. Organisations can be certified against it by an accredited certification body, and the certificate is recognised worldwide. It is the most common security certification requested outside the US, and often accepted alongside or instead of SOC 2 by international customers.

The current version is ISO/IEC 27001:2022 (with a 2024 amendment adding climate-change considerations to the context clauses). Certificates to the old 2013 version had to transition by 31 October 2025, so any valid certificate today should reference 2022.

The key idea that separates ISO 27001 from a control checklist: it certifies the management system, not a fixed set of controls. You identify your own risks, choose controls to treat them, and prove that the system for doing this runs, is measured and improves. Two certified organisations can have quite different controls.

ISO 27001 certification at a glance¶

flowchart LR
  scope[Define ISMS scope<br/>and context]
  risk[Risk assessment<br/>and treatment plan]
  soa[Statement of<br/>Applicability<br/>Annex A controls]
  operate[Operate the ISMS<br/>internal audit<br/>management review]
  s1[Stage 1 audit<br/>documentation review]
  s2[Stage 2 audit<br/>controls in operation]
  cert[Certificate<br/>valid 3 years]
  surv[Annual surveillance<br/>audits, then recertification]

  scope --> risk --> soa --> operate --> s1 --> s2 --> cert --> surv
  surv -. continual improvement .-> risk

The certification journey: build and run the ISMS first, then pass a two-stage audit, then keep it running through annual surveillance audits.

Structure of the standard¶

ISO 27001 has two parts that do different jobs.

Clauses 4-10: the management system (mandatory)¶

Every clause is mandatory. You cannot exclude any of them.

These clauses follow the "Annex SL" harmonised structure shared with ISO 9001 (quality) and ISO 42001 (AI management systems), so organisations can run integrated management systems.

Annex A: the reference control set¶

Annex A lists 93 controls in four themes (the 2013 version had 114 controls in 14 domains):

The 2022 revision added 11 new controls that reflect modern practice:

• 5.7 Threat intelligence
• 5.23 Information security for use of cloud services
• 5.30 ICT readiness for business continuity
• 7.4 Physical security monitoring
• 8.9 Configuration management
• 8.10 Information deletion
• 8.11 Data masking
• 8.12 Data leakage prevention
• 8.16 Monitoring activities
• 8.23 Web filtering
• 8.28 Secure coding

ISO/IEC 27002:2022 gives implementation guidance for each Annex A control. It is not certifiable on its own; it is the "how" companion to 27001's "what".

The Statement of Applicability (SoA)¶

The SoA is the central document of an ISO 27001 audit. For every one of the 93 Annex A controls it records:

• whether the control is applicable;
• why it is included (which risk, legal or contractual requirement drives it) or why it is excluded;
• whether it is implemented.

Exclusions are allowed but must be justified. A cloud-only company with no offices might justify excluding some physical controls, while noting that the cloud provider's data centres are covered by the provider's own certification (the shared responsibility model again).

Risk assessment: the heart of the ISMS¶

Clause 6 requires a defined, repeatable method that produces "consistent, valid and comparable results". A typical approach:

1. Identify risks: for assets, processes or scenarios in scope, what could affect confidentiality, integrity or availability?
2. Analyse each risk's likelihood and impact on a defined scale.
3. Evaluate against risk acceptance criteria set by management.
4. Treat each risk above the threshold: modify (apply controls), avoid, share (insurance, outsourcing) or retain (accept).
5. Assign risk owners who approve the treatment plan and accept residual risk.

Auditors check that the method is documented, that it was actually followed, that controls in the SoA trace back to risks, and that risk owners signed off. Threat modeling at the system level feeds this process well.

Cloud Provider ISO 27001 Support¶

All three major clouds are certified to ISO 27001, along with the cloud-specific extensions ISO/IEC 27017 (security controls for cloud services) and ISO/IEC 27018 (protection of personal data in public clouds). Their certificates cover the infrastructure; your ISMS must still cover how you configure and use it.

AWS¶

Azure¶

Google Cloud¶

Related standards in the 27000 family¶

ISO 27001 vs SOC 2¶

Many companies do both. The controls overlap heavily, so a single control set mapped to both frameworks (one piece of evidence, two audits) saves real effort.

Audit Preparation Checklist¶

Mandatory documented information¶

• ISMS scope (clause 4.3)
• Information security policy (5.2)
• Risk assessment process and results (6.1.2, 8.2)
• Risk treatment process, plan and results (6.1.3, 8.3)
• Statement of Applicability (6.1.3 d)
• Information security objectives (6.2)
• Evidence of competence (7.2)
• Operational planning and control records (8.1)
• Monitoring and measurement results (9.1)
• Internal audit programme and results (9.2)
• Management review results (9.3)
• Nonconformities and corrective actions (10.2)

Evidence Collection¶

Common audit findings¶

• Risk assessment done once for certification and never updated.
• SoA says a control is implemented, but there is no evidence it operates.
• Internal audit not independent (people auditing their own work) or not completed.
• Management review held without the required inputs (audit results, objectives, risk status).
• Access reviews missed or not acted on.
• Supplier list incomplete; no security assessment of key SaaS vendors.

Certification Exam Relevance¶

ISO 27001 knowledge is relevant for: - ISACA CISA and CISM - audit and governance - ISC2 CISSP and CCSP - security governance and cloud compliance - CCSK v5 - cloud compliance and audit - Microsoft SC-100 - regulatory compliance in security strategy

There are also ISO 27001 Lead Implementer and Lead Auditor courses offered by several training bodies, aimed at people who run or audit an ISMS.

Documentation Links¶

📖 ISO/IEC 27001:2022 - the standard itself (paid) and ISO's summary

📖 AWS: ISO 27001 compliance - AWS's certification scope and FAQs

📖 Azure: ISO/IEC 27001 offering - Microsoft's certification scope and audit reports

📖 Google Cloud: ISO/IEC 27001 - Google Cloud's certification and services in scope