ISO 27001 compliance, without the spreadsheet maze
Know what the standard asks, see where you stand, and keep your evidence in one place so audit day is calm.
Official sources
ISO 27001 is published by ISO and the IEC. The standard itself is a paid document, so use these official places to find and download it.
Official website
The ISO page for ISO/IEC 27001:2022 shows the edition, its status and a preview of the contents.
Visit iso.org/standard/27001 ↗Get the document
Buy the official PDF from the ISO store, or from your national standards body, which sells the same standard in your country. ISO/IEC 27000 is free from ISO’s publicly available standards list.
Open the official page ↗Works alongside
ISO/IEC 27002 explains how to implement the Annex A controls. NIST CSF, SOC 2 and ISO 31000 map closely to it.
Browse all frameworks →What ISO 27001 is
ISO 27001 is the international standard for an information security management system. It asks you to decide what needs protecting, assess the risks, put controls in place, and keep checking that they work.
It is voluntary. Many customers and partners ask for the certificate before they will sign a contract, which is why most businesses pursue it.
How ISO 27001 got to where it is today
The milestones that changed what organisations have to do.
BS 7799
The British Standards Institution publishes BS 7799, the first widely used code of practice for information security management.
ISO/IEC 17799
The code of practice is adopted internationally as ISO/IEC 17799. A separate British standard, BS 7799-2, covers certification.
ISO/IEC 27001:2005
The certifiable requirements become an international standard in the new 27000 family. The code of practice is later renumbered ISO/IEC 27002.
ISO/IEC 27001:2013
Revised to follow the common structure used by other ISO management system standards. Annex A holds 114 controls in 14 domains.
ISO/IEC 27001:2022
Annex A is reorganised into 93 controls in four themes, with 11 new controls. The transition period from the 2013 edition ended on 31 October 2025.
Amendment 1
A short amendment adds climate change to the issues an organisation must consider when defining its context.
Dates are for orientation. The official website holds the authoritative record.
Do you need it?
If any of these sound familiar, probably yes.
Customers send security questionnaires and ask for proof of a recognised standard.
You sell to larger companies or governments that require certified suppliers.
You handle other people’s data and want a structured way to protect it.
Security today lives in people’s heads and scattered documents.
What it asks of you
The requirements fall into six themes. The requirements-in-depth page walks through each clause and all 93 controls. Scroll down for the four control domains and all 93 controls, or read the full clause-by-clause guide.
Context and scope
Decide what the system covers: which parts of the business, which information, which people.
Leadership and policy
Management commits, sets a security policy, and gives people clear roles.
Risk assessment and treatment
Find what could go wrong, rate it, and decide what to do about each risk.
Controls
Put protections in place. Annex A is the reference list of controls, 93 in the 2022 edition. You choose the ones that fit your risks.
Monitoring and audit
Measure how it is working and run an internal audit before the certification audit.
Continual improvement
Fix what the audit and incidents show, and keep the system current.
The 93 Annex A controls
You choose the controls that fit your risks and record the ones you leave out, with reasons.
Organizational
37 controls · 5.1 to 5.37
Policies, roles, assets, access, suppliers, incidents, continuity and legal duties.
People
8 controls · 6.1 to 6.8
Hiring, training, agreements, remote work and reporting.
Physical
14 controls · 7.1 to 7.14
Premises, equipment, media, utilities and disposal.
Technological
34 controls · 8.1 to 8.34
Devices, access, malware, backup, logging, networks, encryption and secure development.
93 controls
Policies for information security
Write, approve and publish security policies, and review them on a schedule.
Information security roles and responsibilities
Name who is responsible for what in security.
Segregation of duties
Split conflicting tasks so no one person can misuse a critical process alone.
Management responsibilities
Managers make sure their teams follow the security rules.
Contact with authorities
Know who to contact, such as regulators or police, and when.
Contact with special interest groups
Stay connected to security communities and professional groups.
Threat intelligenceNew in 2022
Collect and use information about current threats to your business.
Information security in project management
Build security into projects from the start.
Inventory of information and other associated assets
Keep a list of information and assets, each with an owner.
Acceptable use of information and other associated assets
Set clear rules for how people may use information and equipment.
Return of assets
Make sure people hand back assets when they leave or change roles.
Classification of information
Sort information by sensitivity, such as public, internal or confidential.
Labelling of information
Mark information so people know how to handle it.
Information transfer
Protect information when it is sent by email, file transfer or in person.
Access control
Decide who can access what, based on business need.
Identity management
Manage the full life of each user identity, from creation to removal.
Authentication information
Control passwords and other secrets, and teach people to protect them.
Access rights
Grant, review and remove access in a controlled way.
Information security in supplier relationships
Manage the security risks that suppliers bring.
Addressing information security within supplier agreements
Put security requirements into supplier contracts.
Managing information security in the ICT supply chain
Manage security risks across the chain of technology suppliers.
Monitoring, review and change management of supplier services
Keep checking that suppliers deliver the security they promised.
Information security for use of cloud servicesNew in 2022
Set rules for choosing, using and leaving cloud services.
Information security incident management planning and preparation
Plan how you will handle incidents before they happen.
Assessment and decision on information security events
Decide quickly whether an event is a real incident.
Response to information security incidents
Respond to incidents using your documented procedure.
Learning from information security incidents
Use incidents to improve your controls.
Collection of evidence
Preserve evidence properly when an incident may need investigation.
Information security during disruption
Keep security in place during a disruption.
ICT readiness for business continuityNew in 2022
Make sure technology can recover to meet business continuity goals.
Legal, statutory, regulatory and contractual requirements
Know the laws and contracts that affect your security and follow them.
Intellectual property rights
Respect licences and protect your own intellectual property.
Protection of records
Protect important records from loss, damage and tampering.
Privacy and protection of PII
Protect personal data as the law and your contracts require.
Independent review of information security
Have someone independent review your security approach.
Compliance with policies, rules and standards for information security
Check regularly that people follow your policies.
Documented operating procedures
Write down how important operational tasks are done.
Screening
Check the background of candidates in proportion to the role.
Terms and conditions of employment
Put security duties into employment agreements.
Information security awareness, education and training
Train staff on security regularly.
Disciplinary process
Have a fair, known process for security breaches by staff.
Responsibilities after termination or change of employment
Spell out security duties that continue after someone leaves or changes role.
Confidentiality or non-disclosure agreements
Use NDAs with staff and others who see sensitive information.
Remote working
Protect information when people work away from the office.
Information security event reporting
Give people an easy way to report suspected security events.
Physical security perimeters
Define and protect areas that hold sensitive information or systems.
Physical entry
Control who can enter, and record visitors.
Securing offices, rooms and facilities
Secure the rooms and buildings that hold your assets.
Physical security monitoringNew in 2022
Watch premises for unauthorised access, for example with cameras or alarms.
Protecting against physical and environmental threats
Guard against fire, flood and similar threats.
Working in secure areas
Set rules for working inside protected areas.
Clear desk and clear screen
Do not leave sensitive material on desks or screens.
Equipment siting and protection
Place equipment where it is safe from damage and prying eyes.
Security of assets off-premises
Protect equipment that leaves the office.
Storage media
Manage USB drives, disks and other media through their life.
Supporting utilities
Protect equipment from power and utility failures.
Cabling security
Protect power and network cabling from damage and tapping.
Equipment maintenance
Maintain equipment so it stays available and intact.
Secure disposal or re-use of equipment
Wipe data before equipment is discarded or reused.
User endpoint devices
Protect laptops, phones and other devices people use.
Privileged access rights
Tightly control and monitor administrator-level access.
Information access restriction
Limit access to information according to your access rules.
Access to source code
Control who can read and change source code.
Secure authentication
Use strong sign-in methods, such as multi-factor authentication, for sensitive systems.
Capacity management
Monitor and plan capacity so systems keep running.
Protection against malware
Detect and block malicious software and train users.
Management of technical vulnerabilities
Find and fix weaknesses in systems on a regular basis.
Configuration managementNew in 2022
Set, document and monitor secure configurations.
Information deletionNew in 2022
Delete information when it is no longer needed.
Data maskingNew in 2022
Hide parts of sensitive data where full data is not needed.
Data leakage preventionNew in 2022
Detect and stop sensitive data leaving your control.
Information backup
Take backups and test that you can restore them.
Redundancy of information processing facilities
Build in spare capacity so a single failure does not stop service.
Logging
Record activity so you can investigate later.
Monitoring activitiesNew in 2022
Watch systems and networks for unusual behaviour.
Clock synchronization
Keep system clocks aligned so logs can be trusted.
Use of privileged utility programs
Restrict powerful tools that can bypass normal controls.
Installation of software on operational systems
Control what software goes onto production systems.
Networks security
Secure networks and the devices on them.
Security of network services
Define security requirements for network services you use.
Segregation of networks
Separate networks so a problem in one stays contained.
Web filteringNew in 2022
Block access to harmful websites.
Use of cryptography
Use encryption and manage keys properly.
Secure development life cycle
Build security into each stage of software development.
Application security requirements
Define security needs when building or buying applications.
Secure system architecture and engineering principles
Apply sound security design principles to systems.
Secure codingNew in 2022
Follow secure coding practices.
Security testing in development and acceptance
Test security before software goes live.
Outsourced development
Oversee the security of development done by others.
Separation of development, test and production environments
Keep these environments apart.
Change management
Control changes to systems and processes.
Test information
Choose and protect data used for testing.
Protection of information systems during audit testing
Plan audit tests so they do not disrupt live systems.
Your path to certification
Six steps from first look to certificate. Effort depends on your size and starting point.
- 1
Set your scope
Agree what the system covers and who owns it.
- 2
Assess your risks
List assets and threats, then rate and rank the risks.
- 3
Choose your controls
Pick controls from Annex A and record the ones you leave out, with reasons.
- 4
Write policies, gather evidence
Document how things work and keep proof that they happen.
- 5
Run an internal audit
Check yourself first and fix gaps before the auditor arrives.
- 6
Certification audit
An accredited certification body reviews your system and issues the certificate.
How Optimus GRC helps
Each area maps to a part of the platform, so the work and the evidence sit together.
| What it asks | What you do in Optimus GRC |
|---|---|
| Context and scope | Scope and asset records |
| Leadership and policy | Policy management with owners, approvals and review dates |
| Risk assessment and treatment | Risk register with treatment plans |
| Controls | Controls library mapped to Annex A, with evidence attached |
| Monitoring and audit | Audit plans, findings and follow-up |
| Continual improvement | Tasks and tickets for corrective actions |
Free ISO 27001 readiness checklist
A one-page PDF you can print or share with your team. No sign-up needed.
Download the checklist (PDF)- Information security policy (sample)
- Risk assessment worksheet
- Statement of Applicability starter
- Internal audit checklist
Share or cite this page
Writing about ISO 27001? You are welcome to link to this guide. Copy the link below.
<a href="/frameworks/iso-27001/">ISO 27001 explained in plain English - Optimus CyberX</a>Common questions
Is ISO 27001 mandatory?
No. It is voluntary, but customers and partners often ask for it.
What does certification mean?
An accredited certification body has audited your system against the standard and found it meets the requirements.
How long does it take?
It depends on your size and where you start. The readiness check gives you an indicative estimate.
Do small companies need every Annex A control?
No. You choose controls based on your risk assessment and record any you exclude, with reasons, in a Statement of Applicability.
How long does a certificate last?
Certificates are typically valid for three years, with surveillance audits in between.
Can Optimus GRC certify us?
No. Only accredited certification bodies can certify. The platform helps you prepare and keep your evidence ready.
Related frameworks
See how ready you are for ISO 27001
Answer questions across every area. We email you a report showing where you comply and where you do not.