ISO 27001 is an international standard for building and operating an Information Security Management System (ISMS). Rather than prescribing a single set of security technologies, it provides a structured management system for identifying information security risks, deciding how those risks should be treated, operating appropriate controls, evaluating performance, and continually improving the system.
The current edition is ISO/IEC 27001:2022, formally titled Information security, cybersecurity and privacy protection: Information security management systems: Requirements. It applies to organizations of different sizes and across industries.
That distinction matters because ISO 27001 is sometimes described as if it were simply a cybersecurity framework containing 93 controls.
It isn’t.
The 93 controls in Annex A are important, but they are only one component of ISO 27001. The core of the standard is the management system itself: understanding the organization, defining scope, assessing risk, determining appropriate controls, assigning responsibilities, monitoring performance, conducting internal audits, reviewing the system at the management level, and continually improving it.
In practical terms, ISO 27001 gives an organization a repeatable way to answer four questions:
- What information security risks matter to us?
- What are we going to do about them?
- How do we know those decisions are actually being carried out?
- How do we know our information security management system continues to work?
If you’re responsible for actually building one, our ISO 27001 Implementation Guide walks through the implementation process from scope and risk assessment through controls, audit, certification, and continual improvement.
What Does ISO 27001 Actually Do?
ISO 27001 establishes requirements for an Information Security Management System.
An ISMS is the system an organization uses to manage information security in a deliberate, repeatable way. It brings together governance, risk management, policies, processes, people, controls, monitoring, and improvement rather than treating information security as a collection of unrelated technical activities.
The system is intended to preserve the confidentiality, integrity, and availability of information through a risk management process.
Those three objectives are commonly called the CIA triad:
| Objective | Practical Meaning |
|---|---|
| Confidentiality | Information is accessible only to people or systems authorized to access it. |
| Integrity | Information remains accurate, complete, and protected against unauthorized or unintended modification. |
| Availability | Information and supporting systems are accessible when they are needed. |
ISO 27001 therefore isn’t limited to stopping hackers.
An organization might need to address malicious attacks, employee mistakes, third-party failures, physical threats, system outages, inappropriate access, data loss, or any other scenario capable of affecting information within the scope of its ISMS.
The specific risks will differ from one organization to another. That is one reason risk management is so central to the standard.
ISO 27001 and an ISMS Are Not the Same Thing
The terms ISO 27001 and ISMS are frequently used as though they mean the same thing. They don’t.
ISO 27001 is the standard.
The ISMS is the management system your organization establishes and operates.
Think of ISO 27001 as defining requirements and the ISMS as the organization’s actual implementation of those requirements.
That distinction helps explain why simply collecting ISO 27001 templates or implementing security controls doesn’t create an effective ISMS.
A functioning ISMS has to operate.
For example, an organization can have a beautifully written access control policy stating that privileged access is reviewed quarterly. That document may support the ISMS, but the policy itself doesn’t demonstrate that quarterly access reviews occur.
An operating system would also have responsible owners, an established review process, completed reviews, identified exceptions, retained evidence, corrective actions where necessary, and some way of evaluating whether the process remains effective.
Documentation describes the system. Operation and evidence demonstrate that the system exists.
That is a useful distinction to keep in mind throughout ISO 27001.
How Is ISO 27001 Structured?
The primary management system requirements appear in Clauses 4 through 10.
These requirements create a lifecycle rather than a one-time security project.
| Clause | Area | What It Means in Practice |
|---|---|---|
| 4 | Context of the organization | Understand the organization, relevant issues and interested parties, and define the ISMS scope. |
| 5 | Leadership | Establish leadership commitment, policy, roles, and responsibilities. |
| 6 | Planning | Address risks and opportunities, perform information security risk assessment and treatment, and establish objectives. |
| 7 | Support | Provide resources, competence, awareness, communication, and appropriate documented information. |
| 8 | Operation | Operate the processes needed for the ISMS, including risk assessment and risk treatment activities. |
| 9 | Performance evaluation | Monitor and measure the ISMS, conduct internal audits, and perform management reviews. |
| 10 | Improvement | Address nonconformities, take corrective action, and continually improve the ISMS. |
This structure is one reason an ISO 27001 implementation should not begin with the question:
“Which of the 93 controls do we need?”
The earlier questions are broader:
What are we trying to protect? What part of the organization does the ISMS cover? What requirements apply to us? What risks are we managing? Who is accountable? What outcomes are we trying to achieve?
Only then can control decisions be made intelligently.
A Current Requirement Worth Knowing
ISO/IEC 27001:2022 was amended in 2024 as part of changes to ISO management system standards related to climate change.
The amendment affects the organizational context requirements in Clauses 4.1 and 4.2. Organizations are expected to determine whether climate change is a relevant issue when considering their organizational context, and relevant interested parties may have climate-related requirements.
That does not mean every ISMS suddenly needs environmental security controls.
It means climate change must be considered when determining the context relevant to the management system and addressed where it is relevant.
Where Do the 93 Annex A Controls Fit?
This is one of the most misunderstood parts of ISO 27001.
The 2022 edition of Annex A contains 93 reference controls, organized into four themes:
| Theme | Number of Controls |
|---|---|
| Organizational | 37 |
| People | 8 |
| Physical | 14 |
| Technological | 34 |
| Total | 93 |
The controls cover subjects ranging from information security policies and supplier relationships to physical security, identity management, logging, backups, secure development, and incident management.
But here’s the important part:
ISO 27001 does not simply tell an organization to implement all 93 Annex A controls.
The organization’s control selection begins with its own requirements and risk treatment process.
The organization determines the controls necessary to implement its chosen information security risk treatment options. Those necessary controls are then compared with Annex A to verify that necessary controls have not been inadvertently omitted.
Controls can also come from sources outside Annex A or be designed by the organization itself.
That’s a fundamentally different process from treating Annex A as a 93-item compliance checklist.
A better way to think about it is:
Business context and requirements → risks → treatment decisions → necessary controls → comparison with Annex A
rather than:
Annex A → choose controls → find reasons for them afterward
The first approach creates a risk-driven ISMS. The second tends to create a compliance exercise.
What Is the Statement of Applicability?
The Statement of Applicability (SoA) connects an organization’s control decisions to its ISO 27001 implementation.
Among other requirements, the SoA identifies the organization’s necessary controls, provides justification for their inclusion, indicates whether they are implemented, and explains exclusions of Annex A reference controls.
Necessary controls that don’t originate in Annex A still need to be represented appropriately in the SoA.
This makes the SoA much more than a spreadsheet with 93 rows marked “applicable” or “not applicable.”
It should tell a coherent story about the organization’s control environment.
For example, a weak justification might effectively say:
Included because ISO 27001 requires it.
A stronger justification connects the control to an actual reason:
Included to treat unauthorized access risks affecting production systems and to support contractual access control requirements.
The second explanation makes the relationship between risk, requirements, and control decisions visible.
We’ll cover this much more deeply in our dedicated Statement of Applicability guide.
Why Risk Assessment Matters So Much
Risk management is the mechanism that prevents ISO 27001 from becoming a generic security checklist.
Two organizations could both conform to ISO 27001 and have significantly different control environments because they have different technologies, customers, regulatory requirements, business models, information, threats, and risk tolerances.
A useful risk assessment therefore needs to do more than produce a colored heat map.
It should help decision-makers understand credible risk scenarios and make defensible treatment decisions.
Consider the difference between these two risk statements:
Weak:
“Cyberattack: High Risk.”
More useful:
“Compromised privileged credentials could allow unauthorized access to the production environment, resulting in customer data exposure and service disruption.”
The second statement provides much more information for deciding what treatment is appropriate.
Once risks are evaluated, an organization can determine how it intends to address them. Depending on the organization’s methodology and circumstances, treatment may involve modifying risk through controls, avoiding the activity creating the risk, sharing or transferring aspects of the risk, or accepting the risk when appropriate.
The important point is that control implementation should follow risk and requirement decisions, not substitute for them.
Our upcoming ISO 27001 Risk Assessment Guide will walk through that process in detail.
What Does ISO 27001 Certification Mean?
Implementation and certification are related, but they aren’t the same thing.
An organization can implement an ISMS aligned with ISO 27001 without obtaining third-party certification. Some organizations implement the standard primarily for its management practices, while others pursue certification to provide additional assurance to customers and other stakeholders.
When an organization pursues certification, an independent certification body evaluates the ISMS against the requirements of ISO/IEC 27001.
There is also an important terminology point:
ISO itself does not certify organizations or issue ISO 27001 certificates.
Certification is performed by certification bodies. Accreditation can provide independent confirmation of a certification body’s competence.
Certification should also not be interpreted as proof that an organization is immune to security incidents.
It means the organization’s ISMS has been assessed against the requirements of the standard within the defined certification scope.
That scope matters.
If certification covers a particular business unit, service, location, or set of processes, the certificate shouldn’t be interpreted as automatically covering everything the broader organization does.
Do You Have to Become ISO 27001 Certified?
No.
Organizations can use ISO 27001 without pursuing certification.
Whether certification makes sense depends on why the organization is adopting the standard.
Certification may be particularly valuable when customers, procurement teams, contractual requirements, or market expectations call for independent assurance.
Another organization might use ISO 27001 primarily to improve its internal information security management without needing a certificate.
That leads to an important early implementation question:
What business outcome are we trying to achieve?
If the objective is certification because major customers require it, that affects project planning, evidence requirements, audit preparation, and timing.
If the objective is primarily internal improvement, the organization may make different decisions about certification while still using the standard as the basis for its ISMS.
Who Can Use ISO 27001?
ISO 27001 isn’t restricted to technology companies or large enterprises.
Organizations of different sizes and across different sectors can implement an ISMS based on the standard.
The more useful question is usually not:
“Are we the right type of company for ISO 27001?”
It’s:
“Do we have information security risks that would benefit from being managed through a structured management system?”
For organizations that handle customer data, depend heavily on information systems, face contractual security requirements, operate in regulated environments, serve security-conscious customers, or simply need a more disciplined approach to information security, the answer may be yes.
The implementation should still be proportionate.
A 40-person software company shouldn’t create unnecessary bureaucracy merely because a 20,000-person multinational has a large security governance structure.
ISO 27001 defines management system requirements. The organization still has to design an ISMS appropriate to its context.
ISO 27001 vs. ISO 27002: What’s the Difference?
These two standards are closely related but serve different purposes.
ISO/IEC 27001 contains the requirements for an information security management system.
ISO/IEC 27002 provides information security control guidance.
Annex A of ISO 27001 provides the reference control set used in the ISO 27001 risk treatment process. ISO 27002 provides substantially more guidance about information security controls and their implementation.
A simple way to remember the distinction is:
ISO 27001 tells you what your ISMS must accomplish. ISO 27002 helps you think through security controls in more detail.
We’ll explore the differences more fully in our dedicated ISO 27001 vs. ISO 27002 guide.
What Does Implementing ISO 27001 Actually Involve?
A real ISO 27001 implementation touches considerably more than the security team.
At a high level, an organization needs to:
- Understand its context and requirements.
- Establish the scope of the ISMS.
- Secure leadership involvement.
- Define responsibilities.
- Establish risk assessment and risk treatment processes.
- Determine necessary controls.
- Create the Statement of Applicability.
- Document what needs to be documented.
- Operate the management system and its controls.
- Retain appropriate evidence.
- Monitor and evaluate performance.
- Conduct internal audits.
- Complete management reviews.
- Address nonconformities.
- Continually improve the ISMS.
That’s why treating ISO 27001 as a document-generation exercise usually creates problems later.
You can write a policy in an afternoon.
You can’t retroactively create six months of genuine operational behavior simply by writing that the behavior was supposed to happen.
Consider a few examples:
| Documented Expectation | What Operation Might Look Like |
|---|---|
| Access is periodically reviewed | Completed access reviews, decisions, exceptions, and follow-up |
| Suppliers are assessed for security risk | Completed assessments, risk decisions, and remediation tracking |
| Incidents are managed | Incident records, investigation, escalation, and lessons learned |
| Backups are maintained | Backup activity, monitoring, failures, remediation, and recovery testing |
| Security awareness is provided | Training activity, participation records, and follow-up |
| Risks are periodically reviewed | Updated assessments, changed treatment decisions, and approvals |
This is why implementation should focus on building a working management system, not merely completing templates.
For the complete sequence, see our ISO 27001 Implementation Guide: A Practical Roadmap for Building Your ISMS.
What Are the Benefits of ISO 27001?
Potential benefits of ISO 27001 include a more structured approach to information security, better visibility into security risks, clearer accountability, more consistent security processes, improved resilience, and a way to demonstrate a formal approach to information security management.
From a management perspective, one of ISO 27001’s most useful characteristics is structure.
Instead of security decisions living independently across IT, security, HR, procurement, legal, and individual business teams, an ISMS gives the organization a common mechanism for connecting:
Requirements → risks → decisions → controls → owners → evidence → evaluation → improvement
That doesn’t guarantee good security.
A management system can still be poorly designed, mechanically operated, or treated as a compliance exercise.
But when implemented well, ISO 27001 creates a framework for repeatedly asking the right questions, assigning responsibility, making decisions visible, and evaluating whether those decisions are producing the intended results.
What ISO 27001 Does Not Guarantee
ISO 27001 is useful, but it’s important not to assign the standard powers it doesn’t have.
Certification does not mean:
- The organization can never suffer a data breach.
- Every possible security control has been implemented.
- Every system and location is necessarily inside the certification scope.
- All 93 Annex A controls have been implemented.
- The organization automatically complies with every privacy, cybersecurity, or industry regulation.
- Security risk has been eliminated.
ISO 27001 is a management system standard for managing information security risk.
That’s valuable precisely because information security risk cannot simply be “completed.”
Systems change. Suppliers change. People change. Threats change. Business objectives change. New vulnerabilities emerge. Controls fail.
A mature ISMS has to recognize those changes and respond to them.
ISO 27001 Frequently Asked Questions
Is ISO 27001 the same as ISO/IEC 27001?
Yes, in ordinary usage. “ISO 27001” is the common shorthand, while ISO/IEC 27001 is the formal designation because the standard is jointly published by the International Organization for Standardization and the International Electrotechnical Commission.
What is the current version of ISO 27001?
The current edition is ISO/IEC 27001:2022, published in October 2022. A 2024 amendment introduced climate-related changes affecting the management system context requirements.
How many controls are in ISO 27001:2022?
Annex A contains 93 reference controls grouped into organizational, people, physical, and technological themes.
Do I have to implement all 93 Annex A controls?
No. Organizations determine the controls necessary for their risk treatment and other relevant requirements and compare those controls against Annex A to ensure necessary controls haven’t been omitted. Annex A is a reference set, not a requirement to blindly implement every control.
What is an ISMS?
An Information Security Management System is the management system an organization uses to establish, operate, evaluate, and continually improve how it manages information security risk.
We’ll cover this separately in What Is an ISMS? How an Information Security Management System Actually Works.
Is ISO 27001 certification mandatory?
No. Organizations can implement ISO 27001 without seeking third-party certification.
Does ISO issue ISO 27001 certificates?
No. ISO develops standards but does not perform certification or issue certificates. Certification is performed by certification bodies.
Is ISO 27001 only about cybersecurity?
No. ISO 27001 addresses information security more broadly. Information can exist in digital, physical, and other forms, and an ISMS considers organizational, people, physical, and technological aspects of information security.
Where to Go From Here
Understanding what ISO 27001 is is relatively straightforward.
Building an ISMS that actually works is where the real work begins.
The most useful mental model is not:
ISO 27001 = 93 controls
It is:
ISO 27001 = a management system for making, operating, evaluating, and improving information security decisions based on organizational context and risk.
Once that distinction is clear, the rest of the standard makes considerably more sense.
If your next question is “How do we actually implement this?”, continue with our ISO 27001 Implementation Guide: A Practical Roadmap for Building Your ISMS. It walks through the implementation sequence from establishing the ISMS and defining scope through risk assessment, controls, the Statement of Applicability, internal audit, management review, and certification preparation.
