ISO/IEC 27001:2022
ISO 27001
The certificate customers ask for. It certifies a management system, not a product: that you know your risks, run the controls that treat them, and can show it. The catalog carries the 93 Annex A controls, and readings from the tools you run land on them as that evidence.
Do you need it?
No law requires it. Customers do, and the question is only when.
Yes
Your customers ask for the certificate.
Enterprise procurement and security questionnaires accept one answer faster than any other. ISO 27001 is that answer, and it closes most of the questionnaire with it.
Yes
Your customers are regulated.
NIS2 and DORA push supplier security down the chain. A certified supplier is the proof a regulated customer can file without further questions.
Not yet
Nobody has asked.
Run the controls anyway. The evidence is the same with or without an auditor, and the certificate becomes a decision about timing rather than a project.
What the standard asks
Clause 6
Know your risks and decide on your controls
A risk assessment with a method you can repeat, a treatment plan, and the Statement of Applicability: which Annex A controls you apply, which you leave out, and why.
Clause 8
Run the controls, every day
The plan is operated, not filed. Access, suppliers, backups, encryption and the rest work as described, with records that show it.
Clause 9
Measure, audit, review
Monitoring of the controls, an internal audit, and a management review on a schedule. The auditor reads these records first.
Annex A
93 controls in four themes
Organisational, people, physical and technological. Implementation guidance lives in ISO 27002; the certificate is issued against this list.
The cycle
One edition, one certificate, audited every year. The standard at ISO.
- 25 October 2022ISO/IEC 27001:2022 published, with Annex A restructured from 114 controls in 14 domains to 93 in four themes.
- 31 October 2025Transition from the 2013 edition ended. Audits from here are against the 2022 edition.
- Every yearA surveillance audit keeps the certificate valid.
- Every three yearsA recertification audit renews it.
How the evidence lands
Readings on Annex A
Access, two-factor, backups, encryption, logging and the rest, read from your tools on a schedule and filed on the controls they prove. The ISMS reflects today, not audit day.
Statement of Applicability
The controls you adopt from the catalog, each linked to its evidence, and the ones you exclude with their reason. The document the auditor opens first, kept current by the readings behind it.
Supplier controls
A.5.19 to A.5.23 from the vendor graph: who processes your data, who they pass it to, and whether their posture changed since the last review.
The audit trail
Every reading, every change and every acknowledgement in an append-only event log with its timestamp. Surveillance audits read the year; the log has it.
See Annex A filling up from your own tools
Thirty minutes. We connect one of your integrations live and show the first readings landing on your controls.