Standard status
- Current published edition
- ISO/IEC 27001:2022 (third edition, published October 2022), incorporating Amendment 1:2024
- Assessments conducted against
- The 2022 edition as amended. The transition from the 2013 edition has closed.
- Scheme type
- Management systems (information security)
ISO/IEC 27001 is the international standard for an information security management system, the way an organization protects the information it holds and handles, its own and other people's. The system assists in ensuring that the confidentiality, integrity and availability of information are preserved, and that information security risks are identified and treated rather than found only after an incident. An organization certified to ISO/IEC 27001 has had that system assessed against the standard by a certification body. The current edition is ISO/IEC 27001:2022, together with a 2024 amendment. What lets a client rely on an ISO/IEC 27001 certificate is independent accreditation of the body that issued it, applied on top of the standard itself.
What an information security management system is
An information security management system is the set of policies, processes and responsibilities through which an organization works out what information it must protect, what could go wrong, and what it is doing about it. The three properties at stake are confidentiality, so information reaches only those meant to see it; integrity, so it is accurate and complete; and availability, so it is there when needed. A system meeting ISO/IEC 27001 manages all three, deliberately and demonstrably.
The standard is risk-driven rather than checklist-driven. It does not hand the organization a fixed set of security measures; it requires the organization to assess its own information security risks and choose controls that treat them, justify those choices in writing, and stand behind the residual risk it accepts. Two organizations with the same certificate can therefore run quite different controls, each defensible for its own risks.
One consequence matters to anyone reading a certificate: the scope. An ISO/IEC 27001 certificate covers the information security management system as scoped, which may be the whole organization or a defined part of it. Reading the scope statement on the certificate is as important as checking the certificate itself. The standard also permits no carve-outs from its own requirements: whatever the scope, a conforming system meets every requirement of clauses 4 to 10.
What ISO/IEC 27001 requires
The requirements are set out across seven areas, clauses 4 to 10, using the harmonized structure ISO now applies to its management system standards, with the plan-do-check-act cycle underneath. The subject matter threaded through them is information, the risks to it, and the controls that treat those risks.
Context of the organization
The organization works out which internal and external issues affect what its information security management system is meant to deliver, identifies the interested parties who matter to it and their requirements, and draws the system's boundaries. Scoping is a substantive decision here, because it defines what the eventual certificate covers.
Leadership
Top management demonstrates leadership and commitment to the system, establishes an information security policy, integrates the system's requirements into the organization's processes, and assigns the roles and authorities that keep it working and reported on.
Planning
The planning clause carries the core of the standard. The organization:
• defines an information security risk assessment process, with criteria for accepting risk, and applies it to identify, analyze and evaluate the risks to the confidentiality, integrity and availability of its information;
• defines a risk treatment process, selects treatment options and determines all the controls necessary to carry them out, drawn from any source;
• checks the controls it has determined against the reference set in Annex A, to verify nothing necessary has been overlooked;
• produces a Statement of Applicability recording the necessary controls, why each is included, whether each is implemented, and the justification for any Annex A control it excludes;
• has the risk owners approve the treatment plan and accept the residual risks;
• sets measurable information security objectives and plans how to achieve them, and carries out changes to the system in a planned manner.
Support
The resources the system needs, the competence of the people running it, awareness among everyone working under the organization's control, the communication the system depends on, and the documented information the standard and the organization require.
Operation
Running the planned processes, keeping control of change, and performing the risk assessment at planned intervals and when significant change occurs, with the risk treatment plan implemented and its results retained in writing.
Performance evaluation
Monitoring and measuring the system's performance and effectiveness, internal audit at planned intervals, and management review by top management.
Improvement
Continual improvement of the system, and reaction to nonconformity with correction, cause analysis and corrective action so the problem does not return.
Annex A and the Statement of Applicability
Annex A is the part of ISO/IEC 27001 most people have heard of. It is a normative reference list of 93 information security controls arranged in four themes: 37 organizational, 8 people, 14 physical and 34 technological. It is a checkpoint rather than a checklist. The organization determines its controls from its own risk treatment, from any source, and then compares them against Annex A to verify that nothing necessary has been missed. Controls that are not relevant to the organization's risks can be excluded, with the exclusion justified.
The Statement of Applicability is where all of that lands. It records the controls the organization has determined necessary, the reason each is included, whether each is implemented, and the justification for every Annex A control left out. It is the single document that connects the risk assessment to what the organization actually operates, and it is central to how the system is audited.
The 2022 edition reorganized this material. The 2013 edition's fourteen control clauses became the four themes, and the controls were consolidated and updated, in step with ISO/IEC 27002:2022, the companion guidance standard that explains each control in depth. ISO's own summary of the 2022 revision is exactly that: alignment with the harmonized structure and with ISO/IEC 27002:2022. The transition from the 2013 edition has closed, so a current accredited certificate is against the 2022 edition. A 2024 amendment added the climate change consideration that now runs across ISO's management system standards.
Certification is not the whole story
An ISO/IEC 27001 certificate is a certification body's conclusion that an organization's information security management system meets the standard, at the stated scope and as found when assessed. It says nothing about who examined the certifier.
Accreditation supplies that answer. ASCB assesses the bodies certifying information security management systems against ISO/IEC 17021-1 together with ISO/IEC 27006, the standard that adds the requirements specific to ISMS certification, and ASCB itself works to ISO/IEC 17011, the international standard for accreditation bodies.
An accredited ISO/IEC 27001 certificate accordingly rests on checks at two levels, the organization's and the certifier's. Without accreditation, the second level is simply absent.
Accreditation is a periodic, risk-based assessment of a certification body against the requirements of the relevant standard, carried out by sampling and reflecting what was found at the time of assessment. It is not a continuous or exhaustive check, and it is not a guarantee of any individual certification decision or of any certified organization's products, services or outcomes. What it provides is independent, repeated assessment of the body issuing certificates against the requirements of ISO/IEC 17021-1, including its impartiality and the consistency of its decisions.
Why an accredited ISO/IEC 27001 certificate carries more weight
Information security certification is most often demanded by customers, in vendor assessments, procurement questionnaires and contractual security schedules, because the buyer is trusting the supplier with its data. That makes the credibility of the certificate a live commercial question. Accredited certification answers that question with evidence a reviewer can check: the certificate’s current status, on IRQAO, the independent register and validation service recording certificates issued by ASCB-accredited bodies, and the issuing body’s accreditation, scope included, on ASCB’s verify page.
A security questionnaire that asks for accredited certification rather than certification alone makes the credential something the reviewer verifies for themselves, at the level of the certificate and at the level of the certifier.
Is ISO/IEC 27001 certification the same as accreditation?
No, and the two words are often used as if they mean the same thing. Certification applies to the organization: a certification body certifies that an organization's information security management system meets ISO/IEC 27001. Accreditation applies to the certification body: an accreditation body assesses the certification body against ISO/IEC 17021-1. An organization is certified to ISO/IEC 27001. A certification body is accredited against ISO/IEC 17021-1. Accreditation is the level above certification: accreditation bodies are not themselves accredited by a higher body, and what stands behind an accreditation body is the standard it works to. ASCB works to ISO/IEC 17011, the international standard setting the requirements for accreditation bodies.
How to check an ISO/IEC 27001 certificate
There are three things to check:
• To confirm a specific certificate, verify it on the register on which the issuing body records its certificates; for ISO/IEC 27001 certificates issued by ASCB-accredited bodies, that is IRQAO.
• To confirm that the certification body itself is accredited, and for what, use
ASCB's verify page.
• Read the scope statement on the certificate itself, because an information security certificate covers the management system as scoped, which may be the whole organization or a defined part of it.
The checks together confirm that the certificate is current, that the body that issued it was independently assessed, and that the certificate actually covers the activity you care about.
Where ISO/IEC 27001 sits among the standards
ISO/IEC 27001 is the certifiable requirements standard in the information security family:
• ISO/IEC 17021-1: the standard a certification body is assessed against to certify ISO/IEC 27001, and the accreditation behind an accredited ISO/IEC 27001 certificate.
• ISO/IEC 27000: the overview and vocabulary for information security management systems, and the normative reference for the standard's terminology.
• ISO/IEC 27002: guidance on the information security controls, explaining each Annex A control in depth; guidance, not a certification standard.
• ISO/IEC 27005: guidance on information security risk management.
• ISO/IEC 27701: the privacy information management extension, which builds on an ISO/IEC 27001 system for organizations handling personal data.
• ISO 9001, ISO 14001, ISO 45001 and ISO/IEC 42001: other widely held management system standards that share the same high-level structure, so an organization can run them as one integrated system.
Common questions
What is ISO/IEC 27001?
ISO/IEC 27001 is the international standard for an information security management system. It sets out what an organization's system for protecting the confidentiality, integrity and availability of information must address, driven by the organization's own assessment of its risks.
What does ISO/IEC 27001 certification mean?
It means a certification body has assessed an organization's information security management system and judged it to meet the requirements of ISO/IEC 27001, at the scope stated on the certificate and at the time of assessment.
What is the latest version of ISO/IEC 27001?
ISO/IEC 27001:2022, the third edition, published in October 2022, as amended in 2024. The transition from the 2013 edition has closed, so current accredited certificates are against the 2022 edition.
What is the Statement of Applicability?
The document recording which controls the organization has determined necessary from its risk treatment, why each is included, whether each is implemented, and the justification for any Annex A control excluded. It is the bridge between the risk assessment and the controls actually operated.
Does ISO/IEC 27001 require all 93 Annex A controls?
No. Controls are determined by the organization's own risk treatment and can come from any source. Annex A is the reference set used to verify that nothing necessary has been overlooked, and any Annex A control not applied must have its exclusion justified in the Statement of Applicability.
Does ISO/IEC 27001 certification mean an organization cannot be breached?
No. Certification concerns the organization's management system, assessed against the standard at a point in time. It is evidence that a system meeting the standard's requirements was in place and operating, not a guarantee against any particular incident.
What does the scope on an ISO/IEC 27001 certificate mean?
The certificate covers the information security management system as scoped, which may be the whole organization or a defined part of it, such as particular services, sites or business units. Reading the scope statement is part of checking the certificate.
What is the difference between ISO/IEC 27001 certification and accreditation?
Certification is of the organization against ISO/IEC 27001. Accreditation is of the certification body against ISO/IEC 17021-1. Accreditation is the independent check on the certifier behind the certificate.
How do I check an ISO/IEC 27001 certificate is genuine?
Verify the certificate on the register on which the issuing body records it, confirm on
ASCB's verify page that the certification body is accredited and for what scope, and read the scope statement on the certificate itself.
How to apply
How to apply for accreditation to certify other organizations against ISO/IEC 27001, under ISO/IEC 17021-1, including the process, the fees and the application documents, is set out on Become Accredited.