ISO/IEC 27001 is the international standard for information security management. It tells organizations how to set up, run and continually improve an information security management system (ISMS). Companies around the world use it to protect data, meet legal duties and prove to customers that they take security seriously.
This introduction explains what the standard requires, how its structure works, who needs it and how certification happens.
What is ISO/IEC 27001?
The standard is published jointly by ISO and the IEC. The current version is ISO/IEC 27001:2022, amended in 2024 to add climate change considerations. Certification to the older 2013 edition ended on 31 October 2025.
ISO/IEC 27001 does not tell you which products to buy. Instead, it requires a risk-based management system: you identify your information security risks and choose controls to treat them.
Structure of the standard
Clauses 4 to 10: the mandatory requirements
| Clause | Topic | What you must do |
|---|---|---|
| 4 | Context | Understand your organization, interested parties and ISMS scope |
| 5 | Leadership | Top management commitment, policy, roles |
| 6 | Planning | Risk assessment, risk treatment, objectives |
| 7 | Support | Resources, competence, awareness, communication, documents |
| 8 | Operation | Carry out risk assessment and treatment in practice |
| 9 | Performance evaluation | Monitoring, internal audit, management review |
| 10 | Improvement | Nonconformities, corrective action, continual improvement |
Annex A: the reference controls
Annex A lists 93 controls in four themes: organizational (37), people (8), physical (14) and technological (34). You decide which ones apply, and you record the decisions in a Statement of Applicability. For the full list, see our guide to ISO 27001:2022 Annex A controls.
Who needs ISO 27001?
It is voluntary, but many organizations pursue it because:
- enterprise customers and government tenders ask for it;
- it helps meet laws such as India’s DPDP Act and sector rules;
- it gives a structured way to manage security risk;
- it builds trust with partners and investors.
IT services firms, SaaS companies, data centres, fintech, healthcare and BPO companies are typical adopters.
How certification works
- Prepare: define the scope, assess risks, implement controls and write required documents.
- Internal audit and management review: check the ISMS yourself first.
- Stage 1 audit: an accredited certification body reviews your documents and readiness.
- Stage 2 audit: the auditor tests whether the ISMS works in practice.
- Certification: if there are no major nonconformities, you receive a certificate valid for three years.
- Surveillance audits: yearly audits in years two and three, then recertification.
Choose a certification body accredited by a recognised accreditation body, such as NABCB in India or UKAS in the UK.
How long does it take?
Small and mid-sized organizations usually need six to twelve months from start to certificate. The timeline depends on scope, existing maturity and available staff. A readiness assessment helps you see the size of the gap early.
Related standards
- ISO/IEC 27002: guidance on implementing each Annex A control.
- ISO/IEC 27005: guidance on information security risk management.
- ISO/IEC 27701: privacy information management, extending ISO 27001.
- ISO/IEC 27017 and 27018: cloud security and cloud privacy.
Read more about the whole family in our guide to the ISO/IEC 27000 series.
FAQ
Is ISO 27001 mandatory?
No, it is voluntary. However, contracts or regulators may require it.
Does certification mean we cannot be hacked?
No. It shows that you manage security risks systematically. You still need strong technical controls and good monitoring.
Sources
Preparing for an ISO 27001 or IT audit? Our ISO 27001 readiness assessment finds your gaps before the auditor does. You can also start with our free ISO 27001:2022 readiness checklist, or contact us for a quote.
