ISO 27001

ISO 27001 is the international standard for an information security management system (ISMS): the policies, risk decisions, controls and records that show you protect information on purpose rather than by luck. It is voluntary and certifiable. Customers, tenders and investors ask for it, and an accredited certification body issues the certificate.

What it is and who it applies to

The current edition is ISO/IEC 27001:2022, published jointly by ISO and the International Electrotechnical Commission in October 2022. It replaced the 2013 edition. The transition period for certified organisations ended on 31 October 2025, and certificates to the old edition expired or were withdrawn then.

Amendment 1, published in February 2024, adds one question to the context clauses: you must decide whether climate change is a relevant issue for your ISMS (ISO 27001:2022 4.1), and a note reminds you that interested parties may have climate-related requirements (ISO 27001:2022 4.2). For most software and services businesses the honest answer is a short, recorded judgement, not a programme of work.

No law makes ISO 27001 compulsory for most organisations. It applies when someone you work with asks for it: an enterprise customer’s security review, a public-sector tender, an investor’s due diligence or a partner’s supplier assessment. A certificate answers many of their questions at once.

The pressure tends to arrive through sales. A software company selling to banks, insurers, NHS bodies or large retailers meets ISO 27001 in procurement long before it meets it in a regulation. Some regulations point the same way without naming it: GDPR asks for security appropriate to the risk, and an ISMS is the recognised way to show that.

The standard covers any organisation, of any size, that holds information worth protecting. You choose the scope: one product, one site or the whole company. A tight scope is easier to certify first and can grow later.

This is guidance to help you understand the requirement, not legal advice.

Structure

The requirements sit in clauses 4 to 10, which follow the same layout as every recent ISO management system standard. Annex A lists 93 reference controls in four themes; the Statement of Applicability records which of them you apply and why. The table paraphrases each part; the standard’s own wording is not reproduced.

The 2022 edition regrouped the 2013 edition’s 14 control domains into these four themes, merged many older controls, and added 11 with no earlier equivalent, such as threat intelligence and secure coding.

Annex A is a checklist, not a menu you must finish. You choose controls from your risk treatment, then compare them with Annex A to check you have not missed one you need (ISO 27001:2022 6.1.3 c)). A control from elsewhere, such as a customer contract or another framework, is welcome; an Annex A control you leave out needs a reason.

Certification and enforcement

Certification is voluntary and nobody enforces ISO 27001 itself. What enforces it in practice is the contract that asks for it. Certificates come from certification bodies; in the UK, look for one accredited by UKAS, because an accredited certificate is the one customers and tenders recognise.

Certification runs in two stages. Stage 1 checks that your system is designed and documented, and that you are ready. Stage 2 checks that it runs: the auditor samples records, interviews people and tests controls against your Statement of Applicability. Findings are graded as major or minor nonconformities, and a major one must be closed before the certificate is issued.

A certificate lasts three years. Surveillance audits in the first and second years check a sample of the system, and a recertification audit in the third year looks at the whole of it again.

What a certificate actually says

A certificate names a scope and, usually, the version of the Statement of Applicability it was issued against. Read both before you rely on a supplier’s certificate, and expect your own customers to read yours the same way. A certificate whose scope covers only head-office IT says nothing about the product you are buying. An accredited certificate carries the accreditation body’s mark, and the certification body can confirm it is current.

How long the first certificate takes depends on three things: how much of the system already exists, how wide your scope is, and how long the auditor wants to see it running. Certification bodies expect the internal audit and the management review to have happened before stage 2, so the system needs time to produce records. A small company with a narrow scope and existing security practice moves faster than one writing every policy from nothing.

How the pieces fit

The clauses form a loop. You set the context and scope, assess the risks inside that scope (ISO 27001:2022 6.1.2), and choose controls to treat them. The Statement of Applicability (ISO 27001:2022 6.1.3 d)) is the hinge: it is where the risk work turns into a list of controls with a reason for each. The controls then run, the internal audit checks them (ISO 27001:2022 9.2), management review decides what to change (ISO 27001:2022 9.3), and improvement feeds the next risk assessment.

Auditors follow the same loop. A control in the Statement of Applicability with no risk behind it, or a risk with no treatment, is the gap they look for first.

Two clauses run underneath the loop rather than inside it. Clause 7 supplies the competent people, the awareness and the controlled documents every step depends on. Clause 6.3, new in the 2022 edition, asks you to plan changes to the system itself, so a new product, a new office or a new cloud provider goes back through context and risk before it goes live rather than after the next audit.

In this section

• Context of the organisation: what is in scope, and who has a stake in your information security?
• Leadership and the information security policy: what does top management have to do?
• Risk assessment and treatment: how do you assess risk and decide what to do about it?
• The Statement of Applicability: which controls apply, and how do you justify the ones you exclude?
• Support, competence, awareness and documented information: what people, skills and documents does the system need?
• Annex A organisational controls, people controls, physical controls and technological controls: what does each theme cover, and what does an auditor test?
• Internal audit: how do you check your own system before a certification body does?
• Management review: what must top management review, and how often?
• Improvement, nonconformity and corrective action: what happens when something goes wrong?
• ISO 27002 and how it relates to ISO 27001: where does the detailed guidance for each control live?

How Sted maps it

ISO 27001 is one of the standards, regulations and schemes in Sted’s catalogue.

Sted treats it as applying in three cases. You already hold it, are pursuing it or a customer requires it. A law or scheme you are under, such as GDPR, PCI DSS, DORA, NIS2 or UK FCA or PRA rules, makes a recognised security management system the expected way to comply. Or Sted’s benefit assessment recommends it. It is never treated as a legal requirement in itself. Those rules work from your recorded onboarding answers; the AI model does not decide them.

Sted recommends it with its reasons, and you select it or leave it. Administrators and Policy and Process Owners make that choice. Choosing it and pressing Update and generate framework builds the documents it needs.

For ISO 27001 Sted’s knowledge base carries 42 policies and procedures and 91 record templates tagged to its clauses and Annex A controls, and a Statement of Applicability over the 93 Annex A controls in four themes. They are drafted for your organisation for you to review and approve. Clause 4 is not a document: your scope, interested parties, obligations and risks sit in management-system registers drafted from your answers.

Sted does not certify you, audit you or choose your certification body. It prepares the documents and records an auditor samples, and shows how much of that work is done.

Frequently asked questions