After reading, you can understand what the standard requires, how certification runs, and where to begin.
Definition
To claim conformity, a company must meet clauses 4 to 10: context, leadership, planning, support, operation, performance evaluation and improvement.
Annex A of the 2022 edition lists 93 controls in four themes: organizational, people, physical and technological. The risk assessment decides which ones you need, and any exclusion needs a justification.
Why it matters
Larger buyers ask for it constantly, because an accredited certificate spares them part of their supplier checks.
Its other benefit shows up internally. Scattered security efforts become one system, driven by risk and reviewed by management.
How it works
Define the scope and secure management's commitment. Assess the risks, choose the controls and record them in the Statement of Applicability.
Put the controls into operation and let them run long enough to produce records. An internal audit and a management review then show what needs correcting.
For certification, an accredited body audits the documents and then the practice. A certificate generally runs for three years, with surveillance audits in between.
A worked case
A 40-person SaaS company scopes its system to its product and support. It excludes the Annex A controls on physical media it does not hold, and writes down why.
After a first internal audit and management review, the certification audit raises two minor nonconformities. The company closes each one with a corrective action plan.
Good practices
- Choose a scope that matches what customers actually buy from you.
- Assess risks before writing policies, so that the documents answer real needs.
- Reuse the records your teams already produce as evidence.
- Hold the management review for real, and leave with decisions.
- Include the suppliers and cloud services the scope relies on.
Common mistakes
- Writing dozens of policies in the first month. They rarely match how people work, and they are soon out of date.
- Filling in Annex A like a checklist, which skips the reasoning the standard is built on.
- Choosing a scope so narrow that the certificate reassures nobody.
- Letting the system lapse between surveillance audits, then scrambling each year.
Questions
- Is ISO 27001 mandatory?
- No law generally imposes it, but contracts and tenders often do.
- How long does ISO 27001 certification take?
- It depends on scope and starting point. Small companies often need several months, because the auditor expects an operating record.
- What is the difference between ISO 27001 and ISO 27002?
- ISO/IEC 27001 contains the requirements that are audited. ISO/IEC 27002 gives guidance on implementing the controls.
- What are the mandatory ISO 27001 documents?
- Among others: the scope, the security policy, the risk assessment and treatment process and results, the Statement of Applicability, and audit and review results.
- Does ISO 27001 ensure GDPR compliance?
- No. It helps with security obligations, while the GDPR also covers lawfulness, people's rights and more.