What Is ISO 27001? A Complete Guide to ISO/IEC 27001:2022

The short answer
ISO 27001 is the international standard for information security management systems (ISMS). It requires organizations to protect the confidentiality, integrity and availability of information through risk management, and organizations can be certified by an accredited certification body. The latest version is ISO/IEC 27001:2022 (with its 2024 amendment).

Key takeaways

• Latest version: ISO/IEC 27001:2022, plus Amendment 1 from February 2024 (climate change). As of October 2026 there is no 2025 or 2026 edition.
• Certificates issued under the 2013 version expired on October 31, 2025. All new certifications and recertifications now use the 2022 version.
• It's a management system standard. It doesn't tell you which firewall to buy; it requires policies, risk assessment, internal audit and continual improvement.
• Clauses 4 to 10 are mandatory; Annex A lists 93 controls you select based on risk.
• Certificates last three years, with surveillance audits every year.
• Organizations with existing security practices typically certify in 4 to 6 months; starting from scratch takes about 6 to 8 months.

What is ISO 27001?

ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full title is Information security, cybersecurity and privacy protection — Information security management systems — Requirements. It's the world's most widely adopted security standard, with close to 100,000 valid certificates according to ISO's survey.

Four terms people often mix up

The core goal: CIA

• Confidentiality: only authorized people can access information
• Integrity: information hasn't been altered or tampered with
• Availability: authorized people can get information when they need it

How it works

At its heart, ISO 27001 is risk management plus continual improvement:

1. Identify what could happen to your information (risk assessment)
2. Decide how to treat each risk (risk treatment)
3. Select and implement the corresponding controls
4. Check whether they work (internal audit, management review)
5. Improve — then go round again

This is the familiar Plan-Do-Check-Act (PDCA) cycle.

Versions: which one is current?

Claims of an "ISO 27001:2025" or "2026 edition" circulating online are not accurate as of October 2026. What was published in July 2026 is ISO/IEC 27000:2026 (overview and vocabulary), which does not replace 27001.

What changed in 2022?

The 11 new controls:

Clause structure: what gets audited?

The heart of the audit: the Statement of Applicability

You don't have to adopt all 93 Annex A controls. Based on your risk assessment, you state for each control whether it's included or excluded and why. That document is the Statement of Applicability (SoA), and it's the most closely scrutinized document in an ISO 27001 audit — auditors usually turn to it on day one.

Annex A: the 93 controls

Who needs ISO 27001?

ISO 27001 is voluntary and open to organizations of any size and industry. In practice, adoption is usually driven by:

• Customer requirements: enterprise and international customers ask suppliers for a certificate in procurement or contracts.
• Government rules: in some jurisdictions, public agencies and critical infrastructure operators must implement an ISMS and get certified within set deadlines.
• Public tenders: many tenders list ISO 27001 as a qualification or scoring criterion.
• Industry: finance, healthcare, cloud and software providers handle sensitive data and tend to adopt it first.

Does a small company have to do it? Not necessarily. Without a customer or regulatory requirement, start with a security health check and basic policies; expand into a full ISMS when customers start asking for the certificate.

How to implement: six steps

Documentation usually comes in four tiers: policy → procedure → work instruction → forms and records. What matters is that what's written matches what's done.

Mandatory documents

ISMS scope; information security policy and objectives; risk assessment and treatment methodology; Statement of Applicability; risk treatment plan; evidence of competence and training; internal audit programme and results; management review records; nonconformity and corrective action records. Most organizations end up maintaining 20 to 25 policies.

Certification process and cycle

Certification bodies typically like to see about three months of ISMS operating records before the Stage 2 audit (the standard itself doesn't require this).

Timing and cost

• Timing: about 4–6 months with an existing security foundation; about 6–8 months from scratch.
• Cost: varies widely with size and scope. The main components are consulting support, certification audit fees (charged by auditor-days), internal staff time and tools. Because surveillance audits recur every year, budget over three years.

What auditors actually look for

They focus on:

• Whether the SoA clearly justifies every included and excluded control
• Whether controls have been operating continuously, not assembled just before the audit
• Whether internal audit and management review were completed and documented
• Whether the incident management process has actually been used (incident records)
• Whether access control records are consistent: joiners, leavers and periodic access reviews

Common audit findings:

• Policies that exist on paper but aren't followed in practice
• Thin risk treatment rationale in the SoA
• Internal audits skipped or undocumented
• Evidence gaps between Stage 1 and Stage 2

Common mistakes

• Treating Annex A as a checklist. Select the 93 controls based on real risk and justify each choice in the SoA.
• Skipping the asset inventory. Without a complete asset register you can't scope the ISMS or assess risk.
• Treating it as an IT-only project. ISO 27001 is a management system: it needs leadership sign-off, HR involvement and cross-team ownership.
• Underestimating evidence collection. Gathering screenshots, logs and records for more than 90 controls is where timelines most often slip.
• Assuming certification is the finish line. Surveillance audits require evidence of continuous operation every year.

How ISO 27001 relates to other standards

Read more: What is CMMC, What is the CRA, What is GRC

How Guidant AI helps

The most time-consuming part of ISO 27001 isn't writing policies. It's continuously collecting evidence for 93 controls and proving at every surveillance audit that they're still operating.

• Built-in ISO 27001:2022 framework: the 93 Annex A controls and their assessment objectives are ready to use — pick the framework and start a project.
• Statement of Applicability and implementation narrative: record inclusion or exclusion rationale and current implementation for every control in the system security plan, updated year after year.
• Tasks and evidence: assign each control as a task; uploaded evidence attaches to the matching item, with AI-assisted classification.
• Automated scanning: the detection agent runs vulnerability and configuration scans, and the reports become evidence for A.8 technological controls.
• From internal audit to closing: audit plans, results, remediation plans and closing reports on one platform; next year's surveillance audit picks up where this one left off.
• On-premises: install it in your own data center so security evidence never leaves your environment.

Guidant AI is not a certification body and does not issue ISO certificates. We help you and your consultants run the ISMS more efficiently.

[Book a demo →]

See how Guidant AI maps to it →

FAQ