ISO/IEC 27001:2022 Guide: ISMS Requirements, Annex A Controls and Certification

Who it applies to

ISO/IEC 27001 is voluntary and works for any organization, whatever its size or sector. ISO notes that IT has the largest share of certificates, and that certified organizations range from agriculture and manufacturing to social services (ISO). Organizations usually pursue it because of:

• enterprise customers and procurement questionnaires, especially outside the US, where ISO certification is often preferred to SOC 2
• regulators and sector schemes that accept or reference an ISMS
• the need for one governance backbone for privacy (ISO/IEC 27701), AI (ISO/IEC 42001) and continuity (ISO 22301), which share the same management-system clause structure

You can also implement the standard without getting certified. ISO says some organizations "choose to implement the standard in order to benefit from the best practice it contains" (ISO).

Key requirements

Clauses 4–10 (mandatory)

The clause-level changes in the 2022 edition come from ANAB's 2013-vs-2022 comparison.

Annex A (reference controls)

ISO/IEC 27001:2022 describes Annex A as "a list of possible information security controls" that you compare your risk treatment against, so you don't overlook anything. The 93 controls are grouped as follows:

• Organizational (A.5): policies, roles, threat intelligence, asset inventory, access control, supplier security, cloud services, incident management, ICT readiness for business continuity, legal and privacy requirements.
• People (A.6): screening, terms of employment, awareness training, disciplinary process, remote working, event reporting.
• Physical (A.7): perimeters, entry, physical security monitoring, equipment, storage media, secure disposal.
• Technological (A.8): endpoints, privileged access, authentication, malware, vulnerability and configuration management, backup, logging and monitoring, network security, web filtering, cryptography, secure development and coding, and change management.

The 2022 edition added 11 new controls: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding (ANAB). Implementation guidance for each control is in ISO/IEC 27002:2022.

The SoA. For each Annex A control, the SoA records whether it's necessary, why it was included, whether it's implemented, and why any control was excluded (clause 6.1.3(d)).

Certification process and timeline

1. Define the scope and build the ISMS: risk method, risk assessment, treatment plan, SoA, policies and controls.
2. Run the ISMS. Operate the controls, complete one full internal audit and a management review before you're audited.
3. Stage 1 audit. The certification body reviews documentation and readiness.
4. Stage 2 audit. The certification body checks implementation and effectiveness, then makes the certification decision.
5. Surveillance audits every year, then recertification in year three. Certificates run on a three-year cycle and cover only the scope printed on them.

Use a certification body accredited by an IAF-member accreditation body, and refer to your certificate by its full reference. ISO advises saying "certified to ISO/IEC 27001:2022", not just "ISO 27001" (ISO).

The 2013 edition is gone. IAF MD 26 gave organizations 36 months to transition. Certification bodies had to use the 2022 edition for all initial and recertification audits from 30 April 2024, and every 2013 certificate expired or was withdrawn on 31 October 2025. If you missed the deadline, you need a new initial certification (Infosec Standards).

Penalties

There's no statutory penalty, because the standard is voluntary. The real risks are:

• major nonconformities at audit, which hold up certification or lead to suspension
• losing the certificate if surveillance audits aren't held
• breaching customer contracts that require a valid certificate

If you rely on a supplier's certificate, check the edition and scope, and look it up in IAF CertSearch.

Mapping to related frameworks

• ISO/IEC 27002:2022 gives implementation guidance for the same 93 controls.
• SOC 2: both cover risk assessment, access and change management, incident response and suppliers. Many organizations operate one control set for both.
• NIST CSF 2.0: NIST publishes informative references (mappings) between CSF outcomes and other standards.
• NIS2 and DORA: an ISMS gives you a structure for the risk-management measures these laws require. Certification alone doesn't prove legal compliance.
• ISO/IEC 27701, ISO/IEC 42001, ISO 22301: these share the harmonized clause structure, so you can run them as an integrated management system.

Readiness checklist

1. Agree the ISMS scope, covering locations, products, teams and interfaces, and get leadership approval.
2. Document the context (clause 4), including interested parties and climate-related issues.
3. Choose a repeatable risk assessment method and set risk acceptance criteria.
4. Assess risks, choose treatments and build the SoA against all 93 Annex A controls.
5. Write the policies and procedures your treatments need, keeping them lean.
6. Implement the controls and collect evidence: access reviews, backups, logging, supplier reviews.
7. Set measurable objectives and metrics (clause 6.2 and 9.1).
8. Train staff and record their awareness.
9. Complete an internal audit of the whole scope and a management review.
10. Fix any nonconformities, then book Stage 1 with an accredited certification body.

Common pitfalls

• Copying Annex A as a checklist instead of picking controls from your risk assessment.
• An SoA that doesn't match reality, where controls marked "implemented" have no evidence behind them.
• No real management review, or internal audits done by people auditing their own work.
• Scope creep or a scope that's too narrow. Customers read the scope statement.
• Still using 2013 Annex A numbering (A.5–A.18) in risk registers after the transition.
• Forgetting Amendment 1:2024, which requires climate change to be considered in clauses 4.1 and 4.2.

How AssureCore helps

AssureCore gives you a Controls Register, a Risk Register, Policy Management with AI-assisted writing and gap analysis, and Evidence Management with expiry alerts, all in one workspace. Cross-framework Mapping lets the ISMS evidence you collect also support SOC 2, NIST CSF and the other frameworks AssureCore supports. Certification itself still comes from your accredited certification body.

Frequently asked questions

Official references

• ISO – ISO/IEC 27001:2022 Information security management systems
• ANAB (ANSI) – ISO/IEC 27001:2013 & 2022 comparison
• IAF MD 26 – Transition requirements for ISO/IEC 27001:2022
• Infosec Standards – ISO/IEC 27001:2013 certificates expired 31 Oct 2025

Related frameworks

• SOC 2 guide
• NIST CSF guide
• Essential Eight guide
• CSA STAR guide