What ISO/IEC 27001 Requires

ISO/IEC 27001 is a management-system standard. It requires defined scope/context, leadership, risk-based planning, resources/competence, operational risk treatment, monitoring/audit/review and continual improvement.

The current third edition is ISO/IEC 27001:2022. ISO lists Amendment 1:2024 for climate-action changes. Avoid 2013-era control lists when planning current certification.

Clauses 4–10

Annex A is only part of the story. An auditor also evaluates whether the management system is governed and operated.

Risk Assessment and Treatment

Use a repeatable method to identify, analyze and evaluate information-security risks against defined criteria. Risk treatment determines necessary controls. ISO does not mandate one quantitative risk formula.

Auditing guidance emphasizes comparing necessary controls with Annex A so needed controls are not inadvertently omitted.

Annex A: 93 Reference Controls

The 2022 Annex A contains 93 controls aligned with ISO/IEC 27002:2022 and grouped into organizational, people, physical and technological themes. Annex A is a reference set—not 93 controls every organization must blindly implement.

Statement of Applicability (SoA)

The SoA identifies necessary controls, why they are included, implementation status and justification for Annex A exclusions. Custom/other-framework controls can also be part of the control set.

Audit Evidence

• Approved ISMS scope.
• Risk methodology and current assessments.
• Risk-treatment plan and SoA.
• Owned/approved policies and standards.
• Competence and awareness records.
• Access reviews, logs, vulnerability and incident evidence.
• Information-security objectives and measurements.
• Internal audit, management review and corrective actions.

Certification and Audit Process

Certification is optional under ISO. Organizations may implement an ISMS without certification. If certification is needed, use a competent certification body; accreditation can add confidence in the certifier.

Certification programs commonly include Stage 1 readiness/document review and Stage 2 implementation/effectiveness audit, followed by surveillance and recertification. ISO/IEC 27006-1:2024 governs requirements for ISMS certification bodies.

Common Gaps

• Treating Annex A as the whole ISMS.
• Static risk assessments disconnected from treatment.
• SoA inconsistent with deployed controls.
• Policies without operating evidence.
• Supplier/cloud dependencies missing from scope.
• Unmeasurable objectives.
• Weak internal audit independence/evidence.
• Corrective actions closed without root-cause/effectiveness proof.

APIs and the ISMS

APIs, cloud services and third-party integrations can sit inside the ISMS scope. API inventory, authentication/authorization, sensitive-data handling, secure development, gateway configuration, monitoring and incident response all generate evidence for applicable controls.

Related Ammune reading: NIST SP 800-228 API security guidelines and SOC 2 compliance guide.

Documented Information and Evidence That the ISMS Operates

ISO/IEC 27001 does not require a giant library of documents for its own sake, but the organization needs enough controlled documented information to operate the ISMS and demonstrate that required processes occurred. The strongest evidence is generated by normal work: risk decisions in a governed register, approved changes in ticketing systems, access reviews with remediation, vulnerability metrics, incident records, internal-audit workpapers and management-review decisions.

Control documents should have ownership, approval, versioning and review expectations. Avoid duplicating the same requirement across policy, standards and procedures with conflicting language. Policies can state intent and accountability; standards can define mandatory technical expectations; procedures can describe repeatable operating steps.

The 2024 climate amendment also matters at the management-system level. It adds consideration of whether climate change is a relevant issue in organizational context and notes that relevant interested parties can have climate-related requirements. That does not turn ISO 27001 into an environmental-security standard, but current ISMS context reviews should not ignore the amendment.

Annex A Control Themes and Counts

The 93 Annex A controls are grouped into four themes in the 2022 edition: 37 organizational, 8 people, 14 physical and 34 technological controls. These counts help navigation but are not maturity scores. A smaller risk-justified set of controls can be more appropriate than copying every Annex A control into the Statement of Applicability.

Map each applicable control to a real owner, operating process and evidence source. Avoid measuring readiness only by whether a control row has been marked “implemented.”

ISO 27001 Certification Readiness: What “Ready” Looks Like

Certification readiness is stronger than “all documents completed.” The ISMS should have operated long enough to produce real evidence: risks have owners and treatment decisions, controls have operating records, objectives have measurements, internal audit has identified findings and management review has made decisions.

A Stage 1 audit should not be the first time the organization discovers that its scope, SoA and risk-treatment story disagree. Run a readiness review that traces a sample risk all the way from assessment to control implementation and evidence.

ISO 27001 Checklist

• Use ISO/IEC 27001:2022 and applicable amendment.
• Define scope/context/interested parties.
• Establish risk criteria and assess risk.
• Create treatment plan.
• Determine controls and compare with Annex A.
• Maintain the SoA.
• Implement controls and recurring evidence.
• Set measurable objectives.
• Complete internal audit and management review.
• Correct nonconformities before certification.

Frequently Asked Questions

Primary References