What is ISO 27001?
ISO/IEC 27001 sets out the requirements for an information security management system (ISMS). It helps organisations protect the confidentiality, integrity and availability of information, whether it is held digitally, on paper or in the cloud.
At its heart is risk management: you identify the risks to your information, then choose and apply controls to treat them. The 2022 edition includes 93 controls in Annex A, covering organisational, people, physical and technological security.
Who needs ISO 27001 certification?
Any organisation that handles valuable or sensitive information can benefit. It is often required by clients in:
- Banks, fintech and payment providers
- Insurance and pension companies
- Telecoms and internet providers
- Software and IT service providers
- Data centres and cloud providers
- Healthcare organisations
- Government and public agencies
- Oil and gas and energy companies
Benefits of ISO 27001 certification
Protect your data
Reduce the risk and impact of breaches, cyber attacks and data loss.
Win contracts
Many clients and tenders require ISO 27001 from technology and service suppliers.
Client trust
Independent proof that information entrusted to you is handled securely.
Data protection
A strong framework that supports your obligations under data protection laws.
Business resilience
Better preparation for incidents and continuity of operations.
Clear responsibilities
Everyone knows their role in keeping information secure.
What the standard requires
ISO 27001 follows the same structure as other ISO management system standards, so it integrates easily with ISO 9001, ISO 14001 and ISO 45001.
Context of the organisation
Understand your organisation, interested parties and their needs, and define the scope of the system.
Leadership
Top management commitment, a clear policy, and defined roles and responsibilities.
Planning
Address risks and opportunities and set measurable objectives.
Support
Resources, competence, awareness, communication and documented information.
Operation
Carry out information security risk assessments and risk treatment, and operate the controls you have selected.
Performance evaluation
Monitoring and measurement, internal audit and management review.
Improvement
Correct nonconformities and continually improve the system.
The 93 controls in Annex A
The 2022 edition groups its controls into four themes. You select the controls that apply to your risks and record your decisions in a Statement of Applicability.
| Theme | Controls | Examples |
|---|---|---|
| Organisational | 37 | Policies, supplier security, cloud services, incident management |
| People | 8 | Screening, awareness training, remote working |
| Physical | 14 | Secure areas, equipment protection, physical monitoring |
| Technological | 34 | Access control, encryption, backup, secure development |
How SCL certifies you
STEP 1
Request a quote
Tell us about your organisation, sites and scope.
STEP 2
Apply
Complete the application and agree the audit plan.
STEP 3
Stage 1 audit
We review your ISMS documentation, risk assessment and Statement of Applicability.
STEP 4
Stage 2 audit
We assess how your security controls work in practice.
STEP 5
Get certified
Receive your accredited certificate, listed on IAF CertSearch and maintained by annual surveillance audits over its 3-year term.
Frequently asked questions
What changed in the 2022 edition?
Annex A was reorganised from 114 controls into 93, grouped in four themes, with new controls such as threat intelligence, information security for cloud services and data leakage prevention. The transition period for certificates to the 2013 edition has ended.
Do we have to implement all 93 controls?
No. You choose controls based on your risk assessment, and justify any you exclude in your Statement of Applicability.
Does ISO 27001 make us compliant with data protection law?
On its own it does not guarantee legal compliance, but it gives you a strong, recognised framework for protecting personal data and supports your obligations.
How long is the certificate valid?
Three years, with annual surveillance audits and a recertification audit before expiry.