ISO/IEC 27001 is the international standard for an information security management system (ISMS). It helps organisations protect the confidentiality, integrity and availability of information — customer data, financial records, intellectual property, source code, employee details — through a risk-based management system rather than a one-off technical fix.
It is widely requested from IT and IT-enabled services companies, fintech, healthcare providers, data centres, BPOs and any supplier that handles a client's sensitive data.
Current edition
- The current edition is ISO/IEC 27001:2022, with Amendment 1:2024 adding climate change considerations to the organisational context clauses.
- The transition from the 2013 edition ended on 31 October 2025. Certificates to ISO/IEC 27001:2013 have expired or been withdrawn, so any organisation still referring to a 2013 certificate should check its status with its certification body.
- ISO lists no new revision project for ISO/IEC 27001 at the time of writing.
Two parts: the management system and the controls
Clauses 4–10: the ISMS
Like other management system standards, ISO/IEC 27001 follows the Harmonized Structure. You must understand your context and interested parties, define the ISMS scope, show leadership commitment, plan around risks, provide resources and competence, operate the controls, measure performance, audit internally, review and improve.
Annex A: the reference set of controls
Annex A of the 2022 edition lists 93 controls grouped into four themes:
| Theme | Number of controls | Examples |
|---|---|---|
| Organizational | 37 | Policies, asset inventory, access control rules, supplier security, incident management, threat intelligence |
| People | 8 | Screening, awareness and training, disciplinary process, remote working |
| Physical | 14 | Secure areas, equipment protection, clear desk and screen, physical security monitoring |
| Technological | 34 | Endpoint protection, privileged access, malware protection, backup, logging, secure development, data leakage prevention |
The controls are explained in more detail in the companion guidance standard, ISO/IEC 27002.
The heart of the ISMS: risk assessment and treatment
- Define a risk assessment method — criteria for likelihood, impact and acceptance — so results are consistent and repeatable.
- Identify risks to the confidentiality, integrity and availability of information within the scope, and who owns each risk.
- Analyse and evaluate the risks against your criteria.
- Choose treatment options — modify the risk with controls, avoid it, share it (for example through insurance or contracts) or retain it.
- Compare chosen controls with Annex A to make sure nothing necessary has been overlooked.
- Produce a Statement of Applicability (SoA) listing the necessary controls, why each is included, whether it is implemented, and justification for excluding any Annex A control.
- Prepare a risk treatment plan and obtain risk owners' approval of the plan and the residual risks.
What auditors typically ask for
- ISMS scope, information security policy and objectives
- Risk assessment method, risk register, risk treatment plan and the SoA
- Evidence that controls are operating — access reviews, backup restore tests, patch records, logs, training records, supplier assessments
- Incident records and lessons learned
- Internal audit reports and management review minutes
ISO 27001 and Indian data protection law
ISO/IEC 27001 certification demonstrates a structured approach to information security, but it does not by itself establish compliance with laws such as India's Digital Personal Data Protection Act, 2023 or sector-specific regulations. Treat legal obligations as inputs to your ISMS (they are "requirements of interested parties") and seek legal advice on what applies to you.
Implementation tips
- Keep the scope realistic. A clearly defined scope — for example, a specific service delivery centre — is better than an over-ambitious one you cannot control.
- Involve IT, HR, facilities and business owners; information security is not only an IT project.
- Use existing practices where they work and record them, instead of writing new procedures nobody follows.
- Allow enough time for controls to operate and generate evidence before the stage 2 audit.
Key takeaways
- ISO/IEC 27001:2022 (with Amd 1:2024) is the current standard; the 2013 transition is over.
- Certification is about a risk-based management system, not a checklist of 93 controls.
- The Statement of Applicability links your risks to the controls you have chosen.
Sources & further reading
- ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements — ISO
- IAF MD 26:2023 — Transition requirements for ISO/IEC 27001:2022 — IAF (archived) (February 2023)
Links open the original publisher's page. Summaries on this page are written by Certsure; for the authoritative text of any standard, refer to the official publication.
