ISO 27001 certification requirements guide

ISO 27001 (ISO/IEC 27001:2022) is the international standard that sets the requirements for an information security management system, or ISMS. An ISMS is the set of policies, risk decisions, controls and checks an organization uses to protect the confidentiality, integrity and availability of its information. Companies can be certified against it by an accredited certification body.

For a software or IT services company, ISO 27001 is usually the first security certificate a large customer asks for outside the United States. It is also the base that several other standards build on, such as ISO/IEC 27701 for privacy and ISO/IEC 42001 for AI. This guide explains what the standard actually requires, clause by clause, what an auditor will ask to see, and how to plan the work. It is based on the published standard and its official guidance, linked in the sources at the end.

What is ISO 27001 and what does it cover?

ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The full title is "Information security, cybersecurity and privacy protection: Information security management systems: Requirements". The current edition was published in October 2022. Amendment 1, published in February 2024, added a short climate change consideration to clauses 4.1 and 4.2.

The standard does not tell you which firewall to buy or how long a password must be. It tells you how to run information security as a managed system:

Decide what the ISMS covers (the scope).
Find the risks to information in that scope.
Decide how to treat each risk, and choose controls to do it.
Run those controls, measure them, audit them and review the results with top management.
Fix what does not work and keep improving.

The scope can be the whole company or a defined part of it, such as "the development, operation and support of our SaaS platform". Whatever is inside the scope must meet every requirement in clauses 4 to 10. Customers will read the scope statement on your certificate, so a scope that leaves out the product they buy is of little use to them.

ISO 27001 covers information in every form: data in your cloud accounts, source code, laptops, paper records, and what people know and say. It also covers suppliers who handle that information for you. That breadth is why it is used across industries and not only by technology companies.

Is ISO 27001 mandatory or voluntary?

ISO 27001 is voluntary. No general law requires a private company to be certified. In practice it becomes a requirement in three ways:

Customer contracts and tenders. Enterprise buyers, banks and public bodies often list ISO 27001 certification as a condition in a request for proposal or in their supplier security policy.
Regulation that points to it. Some laws and regulators accept or reference ISO 27001 as one way to show appropriate security, without requiring it. For example, India's IT (Reasonable Security Practices) Rules of 2011 name IS/ISO/IEC 27001 as one standard that meets the "reasonable security practices" test, until the DPDP Act's main duties replace that regime. EU laws such as NIS2 ask for risk management measures and encourage the use of European and international standards.
Supply chain flow-down. A certified customer must manage supplier risk under its own ISMS (Annex A controls 5.19 to 5.22), and the simplest evidence for it to collect from you is your certificate.

Once you hold a certificate, keeping it is not optional in the same way: you must pass surveillance audits every year, or the certification body can suspend or withdraw it.

Plain answer: you are never legally forced to get ISO 27001 just because you are a software company. You get it because the customers you want will not sign without it, or because it is the most efficient way to prove the security a law or contract already demands.

Who needs ISO 27001 certification?

Any organization can implement the standard, whatever its size or sector. The companies that most often pursue certification are:

SaaS and cloud software vendors selling to enterprises, especially in Europe, the UK, India, the Middle East and Asia Pacific, where ISO 27001 is often preferred over SOC 2.
IT service and managed service providers that hold customer credentials or run customer infrastructure.
IT outsourcing, BPO and software development firms, including Indian IT services companies that bid for global contracts.
Data centers, hosting and telecom providers.
Fintech, healthtech and edtech companies that handle sensitive personal data and want one recognized proof of security across many markets.
Suppliers to government and defense where tenders ask for it.

A company is a good candidate when sales keep stalling on security questionnaires, when a key customer has asked for it by a set date, or when you want one framework that can carry SOC 2, privacy and AI requirements on top of it.

Why does ISO 27001 matter for IT and SaaS companies?

The business case is usually about selling, and the operational case is about running security in a repeatable way.

It shortens security reviews. Many buyers accept a certificate and the Statement of Applicability in place of long custom questionnaires, or ask far fewer follow-up questions.
It is recognized worldwide. One certificate, issued under an accredited scheme, is understood in most markets. You can check accredited certificates in the IAF CertSearch database, which buyers increasingly use.
It gives security an owner and a rhythm. Risk assessments, internal audits and management reviews happen on a schedule, so security does not depend on one person remembering.
It supports legal duties. Laws such as GDPR, India's DPDP Act and NIS2 require "appropriate" or "reasonable" security without listing every control. An ISMS gives you a documented, risk-based answer to what is appropriate.
It is a base for other frameworks. ISO 27701 (privacy), ISO 27017 and 27018 (cloud), ISO 22301 (continuity) and ISO 42001 (AI) all use the same management system structure, so most of the work carries over.

Certification does not guarantee that you will never have a breach. Auditors sample evidence over a short period. What it shows is that you have a working system to find and treat risk, which is what customers and regulators ask for.

What are the ISO 27001 clauses and requirements?

ISO 27001 follows the harmonized structure that ISO uses for all management system standards. Clauses 0 to 3 are introduction, scope, references and terms. Clauses 4 to 10 contain the requirements, and every "shall" in them must be met for certification.

Clause	What it requires	What an auditor looks for
4 Context of the organization	Understand internal and external issues (including, since Amendment 1, whether climate change is relevant), interested parties and their requirements, set the ISMS scope and establish the ISMS.	A context analysis, a list of interested parties and their requirements, and a written scope with boundaries and interfaces.
5 Leadership	Top management commitment, an information security policy, and assigned roles, responsibilities and authorities.	A signed or approved policy, named role owners, and evidence that leaders take part, such as management review minutes.
6 Planning	Actions to address risks and opportunities, an information security risk assessment process, a risk treatment process, the Statement of Applicability, security objectives and plans to reach them, and (new in 2022) planning of changes to the ISMS.	A risk methodology, a risk register, a risk treatment plan approved by risk owners, the Statement of Applicability and measurable objectives.
7 Support	Resources, competence, awareness, communication and documented information (creating, updating and controlling documents and records).	Training and competence records, awareness evidence, a communication plan and document control.
8 Operation	Plan and control the processes needed (including outsourced ones), carry out risk assessments at planned intervals or after significant change, and implement the risk treatment plan.	Evidence that controls run in practice, up-to-date risk assessments and progress on the treatment plan.
9 Performance evaluation	Monitoring, measurement, analysis and evaluation, an internal audit program, and management review.	Metrics and their results, an audit program with reports, and management review minutes covering the required inputs.
10 Improvement	Continual improvement, and handling of nonconformities with corrective action.	A log of nonconformities, root cause analysis and closed corrective actions.

Risk assessment and risk treatment (clauses 6.1.2 and 6.1.3)

The heart of the standard is risk. You must define a risk assessment method that produces "consistent, valid and comparable results", identify risks to the confidentiality, integrity and availability of information in scope, name a risk owner for each, and analyze and rank them against criteria you set. Then for each risk you choose a treatment: modify it with controls, accept it, avoid it or share it. Risk owners must approve the treatment plan and accept the residual risk.

The standard does not require an asset-based method. A scenario or threat-based method is fine, as long as it is documented and repeatable.

The Statement of Applicability (clause 6.1.3 d)

The Statement of Applicability, or SoA, lists every one of the 93 Annex A controls and says, for each, whether it is included, why, and whether it is implemented. If you exclude a control you must justify the exclusion. You can also add controls from other sources. Auditors and customers read the SoA closely, because it shows what your certificate actually covers.

What are the 93 Annex A controls?

Annex A is a reference list of information security controls. The 2022 edition reorganized the 114 controls of the 2013 edition into 93 controls in four themes. The detailed implementation guidance for each control is in ISO/IEC 27002:2022, which is a guidance standard and is not itself certifiable.

Theme	Controls	Examples
5 Organizational	37	Policies, roles, threat intelligence, asset inventory, access control, supplier security, cloud services, incident management, business continuity, legal and privacy requirements
6 People	8	Screening, terms of employment, awareness and training, disciplinary process, duties after leaving, confidentiality agreements, remote working, event reporting
7 Physical	14	Secure areas, entry controls, physical security monitoring, clear desk, equipment siting, storage media, secure disposal
8 Technological	34	Endpoint devices, privileged access, authentication, malware protection, vulnerability management, configuration, backup, logging, monitoring, network security, cryptography, secure development, testing, change management

Which controls were new in 2022?

Eleven controls were added in the 2022 edition. They reflect how most software companies already work, so auditors now expect evidence for them:

5.7 Threat intelligence
5.23 Information security for use of cloud services
5.30 ICT readiness for business continuity
7.4 Physical security monitoring
8.9 Configuration management
8.10 Information deletion
8.11 Data masking
8.12 Data leakage prevention
8.16 Monitoring activities
8.23 Web filtering
8.28 Secure coding

Annex A is not a checklist you must complete in full. A control applies when your risk assessment says it is needed, or when a legal, contractual or customer requirement calls for it. In practice most SaaS companies include the large majority of controls, and exclusions tend to be in the physical theme for fully remote companies that rely on a cloud provider's data centers.

What documents does ISO 27001 require?

The standard calls documents and records "documented information". It requires some by name, and it lets you decide what else you need to run the ISMS. The documented information the clauses require is:

The scope of the ISMS (4.3)
The information security policy (5.2)
The risk assessment process (6.1.2) and the risk treatment process (6.1.3)
The Statement of Applicability (6.1.3 d)
Information security objectives (6.2)
Evidence of competence (7.2)
Documented information the organization decides is necessary for the ISMS (7.5.1 b)
Information to show that processes have been carried out as planned (8.1)
Results of risk assessments (8.2) and of risk treatment (8.3)
Evidence of monitoring and measurement results (9.1)
Evidence of the audit program and audit results (9.2)
Evidence of the results of management reviews (9.3)
Evidence of nonconformities, actions taken and the results of corrective action (10.2)

Several Annex A controls also expect documented procedures or records, for example documented operating procedures (5.37), an inventory of assets (5.9), rules for acceptable use (5.10) and logs (8.15). Keep documents short and true to what you do. Auditors find far more problems with policies that describe a process nobody follows than with policies that are brief.

What training and awareness does ISO 27001 require?

People requirements appear in three places, and together they are among the most commonly sampled areas in an audit.

Clause 7.2 Competence

You must decide what competence is needed for people whose work affects information security, make sure they are competent on the basis of education, training or experience, take action to close gaps (such as training or mentoring), evaluate whether that action worked, and keep documented information as evidence of competence. For a software company that includes developers (secure coding, control 8.28), administrators with privileged access, incident responders and the people who run the ISMS itself, such as internal auditors.

Clause 7.3 Awareness

Everyone doing work under the organization's control must be aware of the information security policy, how they contribute to the ISMS and the benefits of better security, and what happens if they do not follow the ISMS requirements. "Everyone doing work under the organization's control" includes contractors and temporary staff, not only employees.

Annex A 6.3 Information security awareness, education and training

Control 6.3 asks that personnel and relevant interested parties receive appropriate awareness, education and training, and regular updates of the organization's policies and procedures relevant to their job. ISO/IEC 27002 adds guidance: an awareness program should take account of the organization's policies and the risks, cover topics such as reporting incidents, password and access rules, phishing and social engineering, and be repeated regularly, with extra training for people moving into roles with higher risk.

The standard does not set a fixed frequency. Most organizations pick annual refresher training plus onboarding training within a set number of days, because that is easy to defend and to measure. Whatever you choose, write it down and then meet it, because an auditor will sample a list of staff and ask for their completion dates.

What auditors usually sample: a list of new joiners in the last year with their awareness completion dates, the latest annual refresher completion rate, proof that contractors were included, evidence of role-based training for developers and admins, and how you checked that the training worked (for example a quiz score or a phishing test result). See our guide to security awareness training requirements for how other frameworks set the same expectation.

Keep the evidence in one place. In LMS Advisor you can build or upload your security awareness course (SCORM is supported), assign it to every employee and contractor group with a due date, send reminder emails, add a scored quiz, and export dated completion and certificate records when the auditor asks. See how compliance training works in LMS Advisor.

How does ISO 27001 certification work?

Certification is done by a certification body, sometimes called a registrar. Choose one that is accredited for ISO 27001 by a national accreditation body that belongs to the International Accreditation Forum (IAF), such as UKAS in the UK, ANAB in the US, NABCB in India or DAkkS in Germany. Certificates from unaccredited bodies are cheaper but many buyers do not accept them.

Stage 1 and stage 2 audits

Stage 1 is a readiness and documentation review. The auditor checks the scope, the policy, the risk assessment, the SoA and whether the ISMS is ready for a full audit. Gaps found here are raised as areas of concern to fix before stage 2.
Stage 2 is the certification audit. The auditor interviews people, samples records and tests whether the ISMS and the controls you selected actually work. Findings are graded as major nonconformities (a requirement is not met or the system has broken down), minor nonconformities (an isolated lapse) and opportunities for improvement.

A major nonconformity must be corrected and verified before the certificate is issued. Minor nonconformities need an accepted corrective action plan. Before stage 2, the certification body will expect to see at least one full internal audit and one management review completed, because those are requirements in their own right.

The three-year cycle

A certificate is valid for three years. In the first and second years after certification the certification body runs a surveillance audit, which samples part of the ISMS and always checks internal audit, management review, corrective actions and changes. In the third year a recertification audit covers the whole system again. The length of each audit is set from the number of people in scope and the complexity of the ISMS, following the accreditation rules in ISO/IEC 27006.

Did the transition from the 2013 edition end?

Yes. Under the IAF transition rules, certificates to ISO/IEC 27001:2013 expired or were withdrawn at the end of the transition period on 31 October 2025. Any valid certificate today should refer to ISO/IEC 27001:2022. If a supplier still shows a 2013 certificate, ask for the current one.

How do you implement ISO 27001 step by step?

There is no single required method. This is the order most software companies follow, and each step maps to a clause the auditor will test.

Get a sponsor and set the goal. Agree with leadership why you are doing it, which customers or markets it serves and a target date. Name an ISMS owner with time to do the work.
Define the scope (clause 4). Decide which products, locations, teams and systems are in. Record interfaces with things outside the scope, such as a cloud provider or a parent company.
Write the policy and assign roles (clause 5). Keep the top-level policy short. Assign owners for risk, assets, access, incidents and suppliers.
Choose a risk method and run the first risk assessment (clause 6.1.2). Use a simple likelihood and impact scale that people understand. Involve engineering and operations, not only the security team.
Decide treatments and write the SoA (clause 6.1.3). Map each risk to controls, mark which Annex A controls apply and why, and get risk owners to approve the plan and the residual risk.
Set objectives and metrics (clauses 6.2 and 9.1). Examples include patching critical vulnerabilities within a set number of days, awareness completion rate, and access review completion.
Implement and document controls (clause 8). Most effort goes here: access reviews, joiner, mover and leaver steps, logging and monitoring, backups and restore tests, secure development, supplier reviews and incident response.
Train people (clauses 7.2 and 7.3, control 6.3). Run awareness training for everyone in scope and role-based training for high-risk roles, and keep the records.
Operate the controls for a while. Auditors need records showing controls ran, such as a quarterly access review or a monthly vulnerability report. Many certification bodies want to see the system working for a period before stage 2.
Run an internal audit (clause 9.2). Use someone competent and independent of the area being audited. This can be an outside auditor if you do not have one in house.
Hold a management review (clause 9.3). Cover every input the clause lists: status of previous actions, changes, feedback on performance, nonconformities, metrics, audit results, interested party feedback, risk results and opportunities for improvement.
Fix findings (clause 10.2), then book stage 1 and stage 2.

ISO 27001 readiness checklist

Tick what you can already show an auditor. Your progress is saved in this browser.

Management system

Written ISMS scope with boundaries and interfaces
Approved information security policy
Named owners for the ISMS, risks and key controls
Documented risk assessment method
Current risk register with risk owners
Risk treatment plan approved by risk owners
Statement of Applicability covering all 93 controls
Measurable security objectives

People

Awareness training assigned to all employees and contractors in scope
Onboarding training due within a set number of days of joining
Annual refresher with dated completion records
Role-based training for developers, admins and incident responders
Competence records for the ISMS team and internal auditors

Checks and improvement

Monitoring results for each objective
Completed internal audit with a report
Management review minutes covering all required inputs
Nonconformity and corrective action log
Accredited certification body selected

How long does ISO 27001 certification take and what drives the cost?

Timelines vary widely, so treat any fixed promise with caution. A small SaaS company with modern cloud tooling and good engineering habits can often reach stage 2 in a few months. Larger or more complex organizations, or ones starting with little documented security, usually take longer. The main drivers are:

Scope size. The number of people, locations, products and systems in scope sets the audit days under ISO/IEC 27006, and so the certification body's fee.
Starting point. If you already run access reviews, logging, backups and incident response, you are mostly documenting. If not, you are building.
How much you do in house. Internal staff time is the largest cost for most companies. Some also pay for an outside internal auditor, tooling or advisory help.
Tooling. Compliance automation platforms can collect evidence from cloud accounts and HR systems. They help with operating the controls but they do not replace the risk decisions and management review the standard requires.
Remediation. Gaps found in the risk assessment, such as missing MFA or untested backups, may need engineering work before the audit.

Ask several accredited certification bodies for quotes based on your headcount and scope. Their proposals will show the audit days for stage 1, stage 2 and each surveillance year.

What are the most common ISO 27001 audit findings?

These are the problems auditors raise again and again in first-time audits. Most are about evidence, not technology.

The risk assessment is out of date or was done once for the audit and never repeated after a significant change, such as a new product or a cloud migration.
The SoA does not match reality. A control is marked as implemented but there is no evidence, or an exclusion has no justification.
Training gaps. New joiners started work weeks before completing awareness training, contractors were left out, or there is no record of role-based training.
Access reviews are missing or were done without removing the access they found.
Leavers kept access to SaaS tools after their last day.
Management review is incomplete. The minutes do not cover all the inputs clause 9.3.2 lists, or top management did not attend.
Internal audit was not independent, or it did not cover the whole ISMS over the audit cycle.
Supplier security is undocumented. There is no list of key suppliers, or no record of how their security was assessed.
Backups were never restored in a test.
Corrective actions are open with no root cause or owner.

Are you ready for an ISO 27001 stage 2 audit?

Answer yes or no for your organization today. Each yes is something you can already prove with a record.

Our ISMS scope is written down and matches what customers buy from us.
We completed a risk assessment in the last 12 months, or after our last significant change.
Every risk has an owner who approved its treatment and the residual risk.
Our Statement of Applicability covers all 93 Annex A controls with reasons.
Every employee and contractor in scope completed awareness training, and we have the dates.
New joiners complete awareness training within a set number of days.
Developers and admins received role-based security training.
We review user and privileged access on a schedule and act on the results.
Leavers lose access to all systems on their last day, and we can show it.
We test backup restores and keep the results.
We completed an independent internal audit of the whole ISMS.
Top management held a management review covering every required input.

Early stage. Focus on scope, the risk assessment and the SoA first. Stage 2 is likely some months away.

Getting close. The structure is there. Close the evidence gaps, run the internal audit and management review, then book stage 1.

Ready to book. Run a final check of training and access records, then schedule your stage 1 and stage 2 audits.

How does ISO 27001 compare with SOC 2 and other frameworks?

ISO 27001 and SOC 2 are the two security proofs buyers ask for most. They overlap heavily in controls but differ in form.

	ISO 27001	SOC 2
What you get	A certificate that your ISMS conforms to the standard	An attestation report by a CPA firm with the auditor's opinion
Who issues it	An accredited certification body	A licensed CPA firm under AICPA standards
What is assessed	The management system plus the controls in your SoA	Controls against the Trust Services Criteria you select
Period	Point-in-time audits, with yearly surveillance over 3 years	Type I at a date, Type II over a period (often 6 or 12 months)
Public detail	Short certificate and scope, SoA shared on request	Long report, usually shared under NDA
Where it is preferred	Europe, UK, India, Middle East, Asia Pacific, many global tenders	United States and US-headquartered buyers

Many SaaS companies do both, running one control set and two audits. Other common pairings:

ISO/IEC 27701 adds a privacy information management system. Since its 2025 edition it can be certified on its own, but it is most often added to an ISO 27001 ISMS.
ISO/IEC 27017 and ISO/IEC 27018 add cloud security and cloud privacy controls, usually audited as an extension of the ISO 27001 scope.
ISO/IEC 42001 uses the same structure for AI management systems.
NIST CSF 2.0 is a voluntary framework from the US that maps well to Annex A. Some companies use it to describe their security program and ISO 27001 to certify it.
GDPR and the DPDP Act are laws. An ISMS helps you meet their security duties but does not cover all of their privacy requirements.

What changed in ISO 27001:2022 and what is next?

The 2022 edition made modest changes to the clauses and larger changes to Annex A.

Clauses. The text was aligned to the harmonized structure. Clause 4.2 now asks which interested party requirements will be addressed through the ISMS. Clause 6.3 Planning of changes is new. Clause 8.1 asks you to set criteria for processes and control externally provided processes, products or services. Clause 9.3 split its inputs and added changes in the needs of interested parties.
Annex A. 114 controls became 93 in four themes, with 11 new controls (listed earlier in this guide), many merged controls and new attributes in ISO/IEC 27002 that let you sort controls by type, security property and cybersecurity concept.
Amendment 1:2024. Organizations must decide whether climate change is a relevant issue (clause 4.1) and note that interested parties may have climate-related requirements (clause 4.2). For most software companies this is a short recorded decision, but auditors do check that it was considered.

We review this guide when ISO publishes a new edition, amendment or technical corrigendum, and when the IAF changes its transition rules. The last review date is shown at the top of this page.

Key ISO 27001 terms

ISMSInformation security management system: the policies, processes, risk decisions and controls the organization uses to manage information security. Statement of Applicability (SoA)The document that lists all Annex A controls, which are included, why, and whether they are implemented. Risk ownerThe person with the accountability and authority to manage a risk, who approves its treatment and residual risk. NonconformityA requirement that is not met. Major nonconformities block certification until fixed. Surveillance auditThe yearly audit in years one and two of the certification cycle. Certification bodyThe independent organization that audits you and issues the certificate, accredited by a national accreditation body. ISO/IEC 27002The companion guidance standard with implementation advice for each Annex A control.

ISO 27001 FAQs

Is ISO 27001 a legal requirement?

No. ISO 27001 is a voluntary standard. It becomes a requirement when a customer contract or tender demands it, and some laws accept it as one way to show reasonable security.

How many controls are in ISO 27001:2022?

Annex A of ISO 27001:2022 lists 93 controls in four themes: 37 organizational, 8 people, 14 physical and 34 technological. You include the ones your risk assessment and requirements call for, and justify exclusions in the Statement of Applicability.

How long is an ISO 27001 certificate valid?

Three years. The certification body runs a surveillance audit in each of the first two years and a full recertification audit in the third year.

Can a small company get ISO 27001 certified?

Yes. The standard applies to organizations of any size. Audit time is based on the number of people in scope and the complexity of the ISMS, so a small, well-defined scope means a shorter audit.

Is a 2013 ISO 27001 certificate still valid?

No. The transition period ended on 31 October 2025, so certificates to ISO/IEC 27001:2013 are no longer valid. Current certificates refer to ISO/IEC 27001:2022.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 contains the requirements you are certified against. ISO 27002 is guidance that explains how to implement each Annex A control. You cannot be certified to ISO 27002.

Does ISO 27001 require security awareness training?

Yes. Clause 7.3 requires everyone working under the organization's control to be aware of the security policy and their role, clause 7.2 requires competence with records, and Annex A control 6.3 covers awareness, education and training.

How often must ISO 27001 training happen?

The standard does not set a frequency. You decide one, write it down and meet it. Many organizations choose training at onboarding plus an annual refresher, with extra training when roles or risks change.

Do contractors need ISO 27001 awareness training?

Usually yes. Clause 7.3 covers persons doing work under the organization's control, which includes contractors and temporary staff who work inside your ISMS scope.

Should we get ISO 27001 or SOC 2 first?

Follow your customers. US buyers usually ask for SOC 2 and buyers in Europe, the UK, India and many global tenders ask for ISO 27001. The controls overlap, so many companies run one program and add the second audit later.

How do I check if a supplier's ISO 27001 certificate is real?

Check the certificate on the issuing certification body's website or in the IAF CertSearch database, confirm the accreditation body, and read the scope to make sure it covers the service you buy.

Can we exclude Annex A controls?

Yes, if your risk assessment and requirements show a control is not needed. Each exclusion must be justified in the Statement of Applicability. The requirements in clauses 4 to 10 cannot be excluded.

Does LMS Advisor hold ISO 27001 certification?

No. LMS Advisor is a learning management system and does not hold ISO 27001 or any other security certification. It helps certified and certifying organizations run and record the awareness training the standard asks for.

Official sources and references

We checked these sources while writing and reviewing this guide. Where a rule is a proposal or a draft, the guide says so.

ISO/IEC 27001:2022, Information security management systems: Requirements Standard page, edition and amendment status
ISO/IEC 27001:2022/Amd 1:2024, Climate action changes Amendment to clauses 4.1 and 4.2
ISO/IEC 27002:2022, Information security controls Guidance for each Annex A control
IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022 Transition period ending 31 October 2025
ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of ISMS Audit time and certification body rules
IAF CertSearch Database for checking accredited certificates
Information Technology (Reasonable Security Practices) Rules, 2011 (India) Rule 8 names IS/ISO/IEC 27001 (WIPO Lex copy)

Next steps

Write a one-paragraph ISMS scope and test it against what your largest customers buy.
Run a first risk assessment with engineering and operations in the room.
Draft your Statement of Applicability from the 93 controls and mark the gaps.
Assign security awareness training to every employee and contractor in scope, with a due date, and keep the completion records. Book a demo to see how LMS Advisor tracks it.
Ask two or three accredited certification bodies for quotes based on your headcount and scope.

ISO 27001 certification: requirements, controls and how to get certified