SecurityGlobal

ISO 27001:2022 (Requirements)

Build an ISMS your team can run every day

Bring information security policies, risk decisions, responsibilities and audit evidence into one connected programme with Netra.

Full title
ISO/IEC 27001:2022 Information security, cybersecurity and privacy protection: Information security management systems: Requirements
Issued by
ISO and IEC, through their joint technical committee on information security
Current edition
Published 25 October 2022. Amendment 1 (climate action changes) published February 2024.
Transition
Certificates to the 2013 edition could not continue after 31 October 2025
Nature
Voluntary international standard. Organisations can be certified by an accredited certification body.
Structure
Management system requirements in Clauses 4 to 10, plus 93 Annex A controls in four themes

Overview

What ISO 27001 is

ISO/IEC 27001 is the international standard for an information security management system, or ISMS. It does not prescribe a fixed list of technologies. Instead, it requires an organisation to understand its context, assess its information security risks, choose controls to treat them, and run a management system that keeps those controls working and improving.

The standard has two parts that work together. Clauses 4 to 10 are the management system requirements: leadership, planning, risk assessment and treatment, support, operation, performance evaluation and improvement. Every one of them is mandatory for certification. Annex A lists 93 reference controls in four themes. The organisation compares its risk treatment with Annex A and records in a Statement of Applicability which controls it applies, why, and why any are excluded. Annex A is covered in depth on the ISO 27001:2022 (Security Controls) page.

The 2022 edition reorganised the controls, from 114 controls in 14 groups to 93 in four themes, and added 11 new controls, such as threat intelligence, cloud services security, data leakage prevention and secure coding. It also follows the harmonised structure that ISO uses across its management system standards. Amendment 1 of 2024 asks organisations to decide whether climate change is a relevant issue for their ISMS and notes that interested parties can have climate-related requirements.

Certification shows customers, partners and regulators that an independent certification body has audited the ISMS. A certificate runs for three years, with surveillance audits in between, so the management system has to keep operating, not just be ready once.

Who it applies to

Any organisation, of any size or sector, can implement ISO 27001 and seek certification. It is most often asked of:

  • Technology, SaaS and IT services providers, where customers ask for it in vendor due diligence
  • Banks, NBFCs, insurers and fintechs, and the vendors that serve them
  • Data centres, cloud and managed security service providers
  • Suppliers to government and public sector bodies
  • Organisations that want one recognised baseline that maps to many other frameworks

ISO 27001 is not generally required by law, but contracts, tenders and sector regulators often expect it. Your organisation decides the scope of the ISMS.

Structure

How the standard is organised

Clauses 0 to 3 introduce the standard. Clauses 4 to 10 contain the requirements an auditor checks. Annex A lists the reference controls.

Clauses 0–3

Introduction, scope, references and terms

How the standard is used, what it covers, and the terms it relies on, which are defined in ISO/IEC 27000. These clauses contain no auditable requirements.

Clause 4

Context of the organisation

4.1 Understanding the organisation and its context
Internal and external issues that affect the ISMS, including, since Amendment 1, whether climate change is a relevant issue.
4.2 Needs and expectations of interested parties
Who has a stake in information security and what they require, which may include climate-related requirements.
4.3 Scope of the ISMS
The boundaries and applicability of the ISMS, documented, taking account of interfaces and dependencies with other organisations.
4.4 Information security management system
Establishing, implementing, maintaining and continually improving the ISMS, including the processes it needs.
Clause 5

Leadership

5.1 Leadership and commitment
Top management shows commitment: aligning the ISMS with strategy, providing resources and supporting others to contribute.
5.2 Policy
A documented information security policy, communicated and available to interested parties as appropriate.
5.3 Roles, responsibilities and authorities
Responsibilities assigned and communicated, including for reporting ISMS performance to top management.
Clause 6

Planning

6.1.1 Actions to address risks and opportunities
Planning so that the ISMS achieves its intended outcomes and prevents undesired effects.
6.1.2 Information security risk assessment
A defined, repeatable process with risk acceptance criteria, identifying risks to confidentiality, integrity and availability, with risk owners, and analysing and evaluating them.
6.1.3 Information security risk treatment
Choosing treatment options and controls, comparing them with Annex A, producing the Statement of Applicability and a risk treatment plan approved by risk owners.
6.2 Information security objectives
Measurable objectives, with plans for what will be done, by whom and by when.
6.3 Planning of changes
New in 2022: changes to the ISMS are carried out in a planned way.
Clause 7

Support

7.1 Resources
The resources needed to run the ISMS.
7.2 Competence
People doing ISMS work are competent, with documented evidence.
7.3 Awareness
People know the policy, their contribution and the implications of not conforming.
7.4 Communication
What is communicated, when, to whom and how.
7.5 Documented information
Creating, updating and controlling the documents and records the ISMS needs.
Clause 8

Operation

8.1 Operational planning and control
Planning, implementing and controlling the processes needed, including externally provided processes, products and services.
8.2 Information security risk assessment
Risk assessments performed at planned intervals or when significant changes occur, with results retained.
8.3 Information security risk treatment
The risk treatment plan implemented, with results retained.
Clause 9

Performance evaluation

9.1 Monitoring, measurement, analysis and evaluation
What is measured, how, when and by whom, and how results are evaluated.
9.2 Internal audit
Internal audits at planned intervals against the organisation’s own requirements and the standard, under an audit programme, with objective and impartial auditors.
9.3 Management review
Top management reviews the ISMS at planned intervals, considering defined inputs, and records decisions on improvement and changes.
Clause 10

Improvement

10.1 Continual improvement
Continually improving the suitability, adequacy and effectiveness of the ISMS.
10.2 Nonconformity and corrective action
Reacting to nonconformities, finding causes, taking corrective action and reviewing its effectiveness, with records kept.
Annex A

93 reference controls in four themes

Annex A is the reference list of controls the organisation compares with its risk treatment. Guidance on each control is in ISO/IEC 27002:2022. See ISO 27001:2022 (Security Controls) for the full detail.

Organisational controls (37)
Policies, roles, asset management, access control rules, supplier relationships, cloud services, incident management, business continuity, legal and regulatory compliance.
People controls (8)
Screening, terms of employment, awareness and training, disciplinary process, responsibilities after termination, confidentiality agreements, remote working and event reporting.
Physical controls (14)
Secure areas, entry controls, physical security monitoring, equipment protection, clear desk and screen, storage media and secure disposal.
Technological controls (34)
Endpoint devices, privileged access, authentication, malware protection, vulnerability management, configuration, backup, logging, monitoring, network security, cryptography, secure development and testing.
New in 2022 (11)
Threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

Implementation roadmap

How to implement it, step by step

A typical route from first decision to certification. The time it takes depends on scope, size and how much is already in place.

  1. 1

    Secure commitment and define the scope

    Agree why the organisation wants an ISMS and who sponsors it. Define the scope under Clause 4.3: which business units, locations, systems and services are in, and how the scope connects to everything outside it.

    OutputsISMS scopeSponsor and roles
  2. 2

    Understand context and interested parties

    Record internal and external issues, including whether climate change is relevant, and the requirements of customers, regulators, partners and staff.

    OutputsContext and interested parties register
  3. 3

    Set the risk method and assess risks

    Define how risks are identified, analysed and evaluated, and the criteria for accepting them. Assess risks to confidentiality, integrity and availability and assign risk owners.

    OutputsRisk methodologyRisk assessment
  4. 4

    Treat risks and write the Statement of Applicability

    Choose treatment options and controls. Compare them with the 93 Annex A controls, and record which apply, why, their implementation status, and the justification for any exclusion.

    OutputsRisk treatment planStatement of Applicability
  5. 5

    Write policy, objectives and documented information

    Approve the information security policy and measurable objectives. Produce the documents and records the ISMS needs, and keep them under control.

    OutputsInformation security policyObjectivesControlled documents
  6. 6

    Implement controls and build competence

    Put the chosen controls into operation. Train people, run awareness, and keep evidence that controls operate, not just that they were designed.

    OutputsImplemented controlsTraining recordsOperating evidence
  7. 7

    Measure, audit internally and review

    Monitor and measure the ISMS. Run an internal audit across the scope and all clauses, then a management review with all the required inputs. Raise and close corrective actions.

    OutputsInternal audit reportManagement review minutesCorrective actions
  8. 8

    Certify and keep it running

    Choose an accredited certification body. After a Stage 1 and Stage 2 audit and the closure of any nonconformities, the certificate is issued for three years, with surveillance audits in between and a recertification audit before expiry.

    OutputsCertificateSurveillance plan

Audit and evidence guide

What auditors look for, and the evidence to keep

Certification is carried out by an independent certification body, ideally one accredited for ISO 27001. The auditor checks that every requirement in Clauses 4 to 10 is met and that the controls in the Statement of Applicability operate.

The certification cycle

  1. Step 1

    Stage 1 audit

    A review of the ISMS design and readiness: scope, policy, risk assessment and treatment, Statement of Applicability, internal audit and management review. Concerns are raised before Stage 2.

  2. Step 2

    Stage 2 audit

    An assessment of whether the ISMS is implemented and effective across the scope, through interviews, observation and sampling of records.

  3. Step 3

    Nonconformities and certification

    Major nonconformities must be corrected, and corrective action plans for minor ones accepted, before the certificate is issued.

  4. Step 4

    Surveillance and recertification

    Surveillance audits in the intervening years check that the ISMS continues to operate. A recertification audit is completed before the three-year certificate expires.

What reviewers look for

  • A clear scope, and how it was decided
  • A risk assessment that follows the documented method and is repeated when things change
  • A Statement of Applicability that matches the risk treatment plan, with justified exclusions
  • Evidence that controls operate over time, not only that policies exist
  • Measurable objectives and how progress is tracked
  • An internal audit programme covering all clauses and the scope, with impartial auditors
  • Management review minutes that cover all the required inputs and record decisions
  • Corrective actions with root-cause analysis and effectiveness checks
  • Competence and awareness records for people in the ISMS

Key timelines

Certificate validity3 years
Surveillance audits by the certification bodyIn the years between
Recertification auditBefore expiry
Internal auditsAt planned intervals
Management reviewsAt planned intervals
Risk assessmentsPlanned intervals and on change
Transition from the 2013 editionEnded 31 Oct 2025

Evidence to keep, by area

Examples to guide your evidence library. Your auditor or regulator decides what is sufficient.

Documented information the standard requires

  • ISMS scope (4.3)
  • Information security policy (5.2)
  • Risk assessment process (6.1.2)
  • Risk treatment process (6.1.3)
  • Statement of Applicability (6.1.3)
  • Objectives (6.2)

Records the standard requires

  • Evidence of competence (7.2)
  • Operational planning and control (8.1)
  • Risk assessment results (8.2)
  • Risk treatment results (8.3)
  • Monitoring and measurement results (9.1)

Audit and review records

  • Internal audit programme and results (9.2)
  • Management review results (9.3)
  • Nonconformities and corrective actions (10.2)

Control operation

  • Access reviews
  • Backup and restore tests
  • Vulnerability and patch records
  • Supplier reviews
  • Incident records
  • Training completion

Areas that often need attention

  • A Statement of Applicability that does not match the risk treatment plan
  • Risk assessments done once and never repeated
  • Internal audits that skip clauses or are not impartial
  • Management reviews that miss required inputs
  • Objectives that cannot be measured
  • Policies with no evidence that the controls behind them operate
  • Scope boundaries and interfaces left unclear

How Netra helps

Where each part of the work lives in Netra

Netra loads ISO 27001:2022 as requirements, tasks and policies. Work done for it also counts towards other frameworks wherever the same control applies.

Clause and control requirements owned and tracked

Task Engine

Requirements arrive as tasks with owners and due dates, and recurring tasks keep operating evidence current between audits.

Status for each clause and each Annex A control

Compliance Centre

Status is derived from completed tasks and evidence, so the position shown to an auditor can be traced to the work.

Policy and documented information

Policy Hub

A policy library generated at onboarding, with a score that moves as the work behind each policy is completed.

Risk assessment and treatment

Risk Manager

A risk register with inherent and residual heatmaps. Risks come down as the treating tasks are completed.

Internal audit and certification audits

Audit Centre

Run internal and certification audits end to end, with findings and corrective actions, using evidence already gathered.

Supplier relationships

Third-Party Risk

Vendor discovery, assessments through a vendor portal and recorded decisions.

Management review inputs

Dashboard & Reports

A live Posture Score and a one-click report for management review and the board.

Netra supports implementation and audit preparation. Certification is assessed and issued by an independent certification body.

Common questions

More questions about Netra

Related frameworks

View all frameworks
Security

ISO 27001:2022 (Security Controls)

Make security controls visible through completed work

Security

NIST CSF 2.0

Connect cyber governance with day-to-day action

Privacy

ISO 27701:2019

Keep your privacy programme traceable through change

See ISO 27001:2022 (Requirements) in Netra

See how Netra connects your framework requirements with tasks, evidence and audit follow-up.