ISO 27001 guide
ISO 27001 certification: scope, audits and support
ISO/IEC 27001 is the international standard for an information security management system (ISMS). Certification shows customers and regulators that you manage information security risk through a defined, audited process.
The current edition is ISO/IEC 27001:2022, with Amendment 1 from 2024. The transition from the 2013 edition ended on 31 October 2025, so certificates against ISO/IEC 27001:2013 are no longer valid.
Published 30 October 2026. Last reviewed 6 November 2026. This guide is general information, not legal advice.
What the standard requires
Clauses 4 to 10 set the management system requirements: understanding your context and interested parties, leadership commitment, risk assessment and treatment, resources and competence, operations, performance evaluation through internal audit and management review, and continual improvement. Amendment 1:2024 added a requirement to consider whether climate change is a relevant issue for the ISMS.
Annex A lists 93 reference controls grouped into four themes: organisational (37), people (8), physical (14) and technological (34). You decide which apply based on your risk assessment and record the decisions and reasons in a Statement of Applicability.
The 2022 edition cut Annex A from 114 controls to 93 by merging many of them, and added 11 new ones, including threat intelligence, information security for cloud services, data leakage prevention and secure coding.
How certification works
- Define the ISMS scope: which parts of the organisation, sites and services it covers
- Run a risk assessment and choose controls, recorded in the Statement of Applicability
- Implement the controls and operate the ISMS long enough to produce records
- Run an internal audit and a management review
- Stage 1 audit: the certification body reviews your documentation and readiness
- Stage 2 audit: the certification body checks that the ISMS works in practice
- Surveillance audits each year, then recertification in year three
What good ISO 27001 help looks like
Consultants and vCISOs help define scope, run the risk assessment, write policies and prepare for audits. An accredited certification body performs the Stage 1 and Stage 2 audits. ISO/IEC 17021-1, the standard certification bodies work to, bars them from offering management system consultancy, so your certification body cannot also be your implementation consultant.
Ask providers how many organisations they have taken through certification, which certification bodies they have worked with, and how they leave your team able to run the ISMS without them.
How CISO Talents helps
At launch you can post an ISO 27001 or SOC 2 readiness request through a guided brief. Verified consultants and vCISOs who list ISO 27001 work see it with the reason it matched, and reply in a common format.
Frequently asked questions
How long does ISO 27001 certification take?
It depends on scope and starting point. Small, focused organisations sometimes certify within six months; larger scopes take longer. The ISMS must run long enough to produce the records the Stage 2 auditor needs to see.
Does ISO 27001 make us NIS2 compliant?
Not on its own. ISO 27001 covers much of what NIS2 Article 21 asks for and is a strong foundation, but NIS2 adds specific duties such as incident reporting deadlines and management accountability under national law.
What is the Statement of Applicability?
A required document that lists the Annex A controls, says whether each one applies, and justifies the decision. Auditors use it as a map of your ISMS.
