ISO 27001

ISO/IEC 27001:2022 - Information Security Management Systems

ISO 27001 sets requirements for an information security management system. Define its scope, assess risks and select appropriate controls. This library explains the 93 Annex A controls; certification also covers the management system requirements in clauses 4 to 10.

Start my free ISO 27001 assessmentNo account · No credit card · Save when useful

Reference guides

Preparation depends on scope and existing practices

Planning the review

Quote audit fees separately from implementation

Budget considerations

Maintain the ISMS; surveillance and recertification follow the certification cycle

Keeping it current

Cross-Framework Control Mapping

Key ISO 27001 controls mapped to equivalent requirements in other frameworks. Work done for one framework reduces effort on the others.

ISO 27001 Control	SOC 2	GDPR	NIS2
Access Control (A.5.15, A.5.18)	CC6.1, CC6.3	Art. 25, Art. 32	Art. 21(2)(i)
Incident Response (A.5.24, A.5.26)	CC7.3, CC7.4	Art. 33, Art. 34	Art. 21(2)(b), Art. 23
Risk assessment (Clauses 6.1.2, 8.2)	CC3.1, CC3.2	Art. 24, Art. 35	Art. 21(2)(a)
Encryption (A.8.24)	CC6.1, CC6.7	Art. 32(1)(a)	Art. 21(2)(h)
Supplier Management (A.5.19-A.5.22)	CC9.2	Art. 28	Art. 21(2)(d)
Business Continuity (A.5.29, A.5.30)	A1.2, A1.3	Art. 32(1)(c)	Art. 21(2)(c)

Where auditors look first

The highest-risk ISO 27001 controls - the ones auditors probe earliest and where gaps cost the most. Start your assessment here.

A.5.1Policies for information security A.5.15Access control A.5.16Identity management A.5.17Authentication information A.5.18Access rights A.5.24Information security incident management planning and preparation A.5.26Response to information security incidents A.5.30ICT readiness for business continuity

Key ISO 27001 terms

Plain-language definitions for the concepts you will meet while working through ISO 27001.

Frequently Asked Questions

How should we plan certification?

Define the ISMS scope, review existing practices and estimate the work needed to meet the management system requirements and implement applicable controls. Agree audit dates with the certification body after assessing the gaps.

What should the budget include?

Separate certification-body fees, internal time, consulting, software and remediation. Request a scoped quote; headcount alone does not establish the cost.

Does this library cover the whole standard?

It covers the 93 Annex A controls. Certification also requires the ISMS requirements in clauses 4 to 10. Select controls through risk treatment and document applicability.

Do we need ISO 27001 if we have SOC 2?

Ask the intended recipient which assurance they require and what it must cover. Evidence may support both reviews, but the scope and assurance outcomes differ.

Control Categories

This library groups 93 review topics into 4 categories.

Organizational Controls

37 reference guides

People Controls

8 reference guides

Physical Controls

14 reference guides

Technological Controls

34 reference guides

Who Needs ISO 27001?

SaaS companiesCloud service providersFinancial services firmsHealthcare technology companiesEnterprise software vendorsManaged service providers

Applicable Regions

GlobalEuropean UnionUnited KingdomAsia-PacificNorth America

Related Frameworks

Organizations pursuing ISO 27001 often also work toward these standards.

SOC 2 GDPR NIS2

Start your ISO 27001 self-assessment

Work through the ISO 27001 assessment, record supporting evidence and review the gaps in your answers.

Start Free Assessment

Start without an account · Sign up only to save