ISO 27001.
Build an information security management system, manage risks and choose suitable evidence for customers and contractual partners.
- ISO/IEC 27001:2022 + Amd 1:2024
- By Jonathan Bezdek
- As of: 10/22/2026
- Reading time: 7 min.
Short answer.
ISO 27001 is the international standard for information security management systems, or ISMS. It describes how organisations organise, operate and improve information security based on risk. ISO/IEC 27001:2022 applies across sizes and sectors. An independent certification body can confirm management system conformity within a defined scope; ISO itself does not issue certificates.
ISO 27001 and the ISMS.
ISO 27001 describes requirements for managing information security. An ISMS connects management decisions with the handling of information, people, processes and technology. It protects confidentiality, integrity and availability: who may see information, how does it remain reliable, and when must it be usable? ISO/IEC 27001:2022's public description centres on a risk-based approach.
The published base edition is ISO/IEC 27001:2022, supplemented by Amd 1:2024. The amendment adds consideration of climate-related issues in the management system's context. According to the joint ISO/IAF communiqué of February 2024, this involves assessing their relevance to the particular management system. It does not imply an identical programme of measures for every organisation.
The ISMS is the organisation's ongoing work; certification is one possible form of external evidence of that work. Introducing a tool, completing a questionnaire or holding a training certificate replaces neither operation of the management system nor its independent assessment.
Who ISO 27001 is suitable for.
According to ISO's public description, ISO 27001 suits organisations of different sizes and sectors. The information and dependencies within the chosen scope are decisive. A small service provider may therefore need different responsibilities and processes from a company with several sites, while the fundamental task of security management remains the same.
Customer requirements often determine the certification scope needed. Establish whether a contractual partner wants a specific service, site or legal entity to be assessed. A deliberately defined scope must account for relevant interfaces. Outsourcing an activity does not remove it from security considerations simply because a supplier performs it.
ISO 27001 requirements.
ISO 27001 requirements combine ISMS governance with the operation of appropriate security controls. The following six work areas summarise sections 4 to 10 of ISO/IEC 27001:2022 in our own words for orientation.
Define context and scope.
The organisation defines which activities and information its ISMS covers. This includes relevant interested-party requirements and dependencies on other areas. In practice, a description that business owners and external readers can both understand is recommended: a service name alone does not explain its supporting systems and interfaces.
Establish leadership and responsibility.
Management gives security work direction, authority and resources. Owners must be able to make decisions appropriate to their tasks. A central coordinator can maintain oversight; this does not automatically transfer every HR, procurement, IT or development task to that person.
Assess and treat risks.
Risk assessment and risk treatment determine which problems are addressed first. Evaluation criteria, responsible people and traceable decisions connect analysis with concrete work. The Statement of Applicability, or SoA, records control selection and its justification. Annex A serves as a reference for security controls.
Organise resources and documentation.
Competence, communication and maintained documented information support operations. Define in practical terms who approves a requirement, who applies it and where the current version is found. A large document collection is of little use if its statements differ from actual work or owners do not know their tasks.
Operate controls in daily work.
Security controls must actually work within the chosen scope. Organisational, personnel, physical and technical arrangements interact. As a practical aid, owners can record for each selected control which process it protects and which records demonstrate operation. The Annex A blog article explores control selection and operation in more detail.
Evaluate and improve.
Internal audits, management reviews and handling of nonconformities keep the ISMS moving. The organisation checks whether its working practices meet requirements and support intended outcomes. In everyday work, it helps to define at the time of a correction how its effect will later be recognised.
The path to ISO 27001 certification.
Agree objectives and scope.
As a practical starting point, establish what evidence is needed for which activity, and describe the scope including its relevant dependencies.
Define responsibilities and capacity.
Name the management members with decision-making authority, the coordinator and process owners, and reserve time for introduction and ongoing maintenance.
Address risks and controls.
Apply a traceable assessment process, decide on treatment and document control selection in the Statement of Applicability.
Connect operations and evidence.
Implement the selected controls and retain suitable records from actual operations, rather than merely filling in document templates.
Evaluate and correct internally.
Use internal audit and management review to address outstanding decisions, nonconformities and resource needs before external examination.
Plan external examination and ongoing operation.
Agree the scope and audit programme with a suitable certification body and continue operating the ISMS with the necessary reviews after the certification decision.
What an ISO 27001 certificate says.
An ISO 27001 certificate confirms the assessed conformity of the management system within the stated scope. Therefore check the scope, standard edition, issuing body, validity date and current status together. The certificate does not guarantee that every part of the company was covered or that no future security incident can occur.
External certification bodies perform certification; ISO itself does not issue certificates. ISO/IEC 27006-1:2024 supplements requirements for such bodies conducting ISMS certification. Accreditation concerns their competence and is distinct from the certificate of the assessed organisation. ISO's public certification page explains how certification and accreditation status can be checked.
Planning does not end with initial issue. Ask your certification body to explain the audit programme, conditions for maintaining certification and renewal process. Budget decisions should consider these recurring services alongside internal operation, rather than only the initial quotation.
Read more on the blog.
- What is an ISMS?Connect security work with organisational decisions.
- Preparing for ISO 27001 certificationPlan preparation, effort and examinations in detail.
- ISO 27001 Annex AEmbed selected controls in operations.
- Internal ISO 27001 auditOrganise audit criteria, evidence and corrections.
- ISO 27001 checklistSort work areas and available starting aids.
Understanding other frameworks.
ISO 27002 complements ISO 27001 with guidance on implementing information security controls. IT-Grundschutz describes a BSI methodology for security work and a separate certification route. NIS2 creates independent statutory duties for entities in scope; an ISO 27001 certificate does not replace examining those duties. TISAX uses its own assessment and exchange process for the automotive supply chain.
In Secani.
Secani provides its own editorial assessment catalogue for ISO/IEC 27001:2022 with Amendment 1:2024. Controls, evidence and tasks can be managed together in the workspace. The catalogue contains original implementation guidance and does not replace the licensed standard text; professional assessment and certification decisions remain separate tasks.
Start with a specific scope.
Choose a service for which traceable security evidence is needed. Record the information, teams and suppliers involved and who may make risk decisions. This foundation enables discussion of implementation scope and expectations of a certificate.
Then request an audit quotation based on the same scope. Separate internal effort, necessary improvements and external examination costs. This makes quotations more comparable without promising a certification date or outcome.
Sources.
- ENX: TISAX Participant Handbook
- ISO/IEC 27001:2022 – public standard page
- ISO/IEC 27001:2022/Amd 1:2024
- ISO/IAF communiqué on climate-related additions, February 2024
- ISO – certification and accreditation
- ISO/IEC 27006-1:2024 – requirements for certification bodies
- ISO/IEC 27002:2022 – supplementary implementation guidance
Frequently asked questions.
No, there is no general ISO 27001 certification obligation for every company. Whether specific evidence is required depends on applicable legal, contractual or sector-specific requirements.
A reliable fixed price cannot be given without knowing the scope and starting position. Budget separately for internal effort, necessary improvements, external audit costs and ongoing maintenance.
Selection depends on risks and relevant requirements. The Statement of Applicability documents necessary controls, their implementation status and justified exclusions of reference controls.
Yes. Implementing an ISMS and having it certified by an external body are different decisions; ISO describes certification as an optional form of evidence.
No. External certification bodies issue certificates; ISO develops and publishes standards.
Clarify the scope.
Discuss how you can manage requirements, controls and evidence in Secani.
This page explains ISO 27001 in our own words and does not replace the licensed standard text or professional examination. Original publications and the applicable certification procedure take precedence.