ISO/IEC 27001:2022 Information Security Management System
ISO 27001 is the international benchmark for information security, and the certificate enterprise buyers ask for by name. The 2022 revision restructured Annex A into 93 controls across four themes, with 11 entirely new controls.
4.9/5 average client rating · 500+ engagements delivered
What ISO 27001 requires
ISO 27001 certifies a management system, not a set of tools. You define a scope, run a documented risk assessment, decide which of the 93 Annex A controls apply and why, implement them, then prove through internal audit and management review that the system operates and improves.
The Statement of Applicability is the document auditors examine most closely: every control included or excluded, with justification, and the implementation status of each. It is also the artefact your customers will ask to see.
- Clauses 4–10: context, leadership, planning, support, operation, performance evaluation and improvement
- Documented information security risk assessment and risk treatment methodology
- Statement of Applicability covering all 93 Annex A controls with justification
- New 2022 controls: threat intelligence, cloud services security, ICT readiness for continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding
- Internal audit programme, management review and continual improvement records
Key facts
| Standard | ISO/IEC 27001:2022 with Annex A aligned to ISO/IEC 27002:2022 |
|---|---|
| Controls | 93 controls across Organisational, People, Physical and Technological themes |
| Certificate validity | 3 years with annual surveillance audits |
| Typical timeline | 8–14 weeks for a single-entity scope |
| Extensions | ISO 27017 (cloud), ISO 27018 (PII in cloud), ISO 27701 (privacy) |
What implementation covers
We build the ISMS around your real architecture and delivery process, so controls are operated by the teams that already own those systems.
Scope & context
ISMS boundary definition covering services, sites, cloud tenants and interfaces, with interested party requirements.
Risk assessment
Asset and threat-based methodology, risk register, acceptance criteria and a treatment plan tied to Annex A controls.
Statement of Applicability
All 93 controls assessed, justified and status-tracked — the document auditors and customers read first.
Technical controls
Access management, cryptography, logging and monitoring, vulnerability management, secure development and cloud configuration.
Organisational controls
Policies, supplier security, incident management, HR security, asset management and privacy-adjacent controls.
Assurance cycle
Internal auditor training, full internal audit, management review, corrective actions and certification body audits.
Who certifies to ISO 27001
It has become the default trust signal for anyone holding customer data, and a contractual requirement in a growing share of enterprise agreements.
- SaaS, fintech and technology companies selling into enterprise or regulated sectors
- IT services, BPO, KPO and offshore development centres
- Data centres, cloud providers and managed security service providers
- Banks, NBFCs, insurers and their technology vendors
- Healthcare, e-commerce and any organisation processing large volumes of personal data
Deals stop stalling
A recognised certificate replaces bespoke security questionnaires in most enterprise procurement processes.
One control set, many frameworks
Roughly 70% overlap with SOC 2, plus direct mapping to DPDP, GDPR and RBI expectations.
Measurably fewer incidents
Access reviews, patch discipline and logging built during implementation reduce real-world exposure.
Risk visible to the board
A maintained risk register turns security from an opinion into a tracked business metric.
How the engagement runs
Gap assessment
Current state assessed against clauses 4–10 and all 93 Annex A controls, with a costed remediation roadmap.
Risk & SoA
Risk assessment workshops, risk treatment plan and Statement of Applicability agreed with control owners.
Implementation
Policies, technical control deployment, supplier assessments, awareness training and evidence collection design.
Internal audit
Full internal audit against every clause and applicable control, plus management review and corrective actions.
Certification
Certification body selection, Stage 1 and Stage 2 support, non-conformity closure and surveillance planning.
What you receive
- ISMS scope, context analysis and interested party requirements
- Risk assessment methodology, risk register and risk treatment plan
- Statement of Applicability covering all 93 Annex A controls
- Information security policy suite and supporting procedures
- Asset inventory, access control model and supplier security assessments
- Internal audit programme, reports, management review and CAPA log
- Stage 1 and Stage 2 audit support through to certificate issue
ISO 27001 — frequently asked questions
Annex A was restructured from 114 controls in 14 domains to 93 controls in four themes, with 11 new controls covering threat intelligence, cloud security, ICT continuity readiness, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Clauses 4–10 changed only marginally.
Eight to fourteen weeks for most single-entity scopes. The gating factor is evidence: certification bodies want to see controls operating with records, typically over four to eight weeks, plus a completed internal audit and management review before Stage 2.
ISO 27001 if your buyers are European, Indian, Middle Eastern or APAC; SOC 2 if they are predominantly North American. If both markets matter, run one combined readiness project — the shared evidence makes the second framework roughly 30–40% cheaper than doing it standalone.
No. You must consider all 93 and justify exclusions in the Statement of Applicability. Exclusions must follow from your risk assessment and scope — excluding secure development when you build software will not survive an auditor.
Yes, and most of our clients are. Physical controls apply to your cloud provider (handled through supplier assurance and their certifications) and to employee home working, which is covered by remote working, endpoint and asset controls. Audits are routinely conducted remotely.
An accredited certificate is issued by a body overseen by a national accreditation authority such as NABCB or UKAS. Non-accredited certificates are cheaper and frequently rejected by enterprise customers. We only work with accredited bodies and explain the distinction before you choose.
Still not sure what applies to you?
Ask an assessor directly — we answer scoping questions before anyone talks about a fee.
Get a realistic timeline and a fixed fee
A 30-minute call is usually enough to scope ISO 27001 accurately. You will leave with a timeline, an evidence checklist and a number — whether or not you engage us.