ISO/IEC 27001 Explained: Annex A, Certification and How to Start

By Thomas Lovas Lokoy · Published October 25, 2026 — researched and drafted with AI assistance from published sources; edited and published by NorwegianSpark SA.

ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system, usually shortened to ISMS: a documented, risk-based way of running security across an organisation, rather than a list of products to buy. The current edition is ISO/IEC 27001:2022. It applies to organisations of any type and size, certification against it is optional, and when an organisation does certify, the certificate comes from an accredited certification body, not from ISO itself.

What ISO/IEC 27001 actually is

The full title is a mouthful: Information security, cybersecurity and privacy protection, Information security management systems, Requirements. It is published jointly by ISO and the International Electrotechnical Commission (IEC), which is why the correct name is ISO/IEC 27001 rather than ISO 27001, and it is maintained by the joint subcommittee ISO/IEC JTC 1/SC 27.

The word that matters is requirements. The standard does not tell you which firewall to buy. It tells you what a management system has to do: understand the organisation's context, get leadership to own security, assess information security risks and decide how to treat them, run the controls, measure whether they work, audit them internally, review them at management level, and keep improving. Those requirements sit in clauses 4 to 10, and the abstract published on the ANSI webstore is explicit that excluding any of them is not acceptable if you claim conformity.

ISO frames the purpose around three properties of information, often called the CIA triad: confidentiality (only the right people can access it), integrity (it is stored reliably and not erased or damaged) and availability (people who need it can get to it when they need it). An ISMS that meets the standard protects all three by applying a risk management process.

Who needs it

ISO describes the standard as relevant to companies of any size and from every sector, and says it lets an organisation apply a risk process scaled to its own size and needs. The ANSI abstract says the same in requirement language: the requirements are generic and intended for all organisations, regardless of type, size or nature.

Needing it and being certified are different things. ISO's own FAQ says organisations implementing the standard can decide whether to go through certification at all: some use it purely as best practice, others certify to reassure customers and clients. In practice the second group is the one that feels the pressure, because a certificate is something a customer can ask to see. ISO's FAQ also reports that the ISO Survey 2022 counted over 70,000 certificates in 150 countries, across all economic sectors.

If you run a small business and nobody has asked you for a certificate, the standard is still a useful map of what a well-run security programme looks like. If a customer or tender has asked, it is no longer optional for that contract.

What changed in the 2022 revision

According to ANAB, the US accreditation body, the 2022 edition was published on 25 October 2022, and the changes to the main clauses were modest. The ones that matter in practice:

• Clause 4.4 now requires the organisation to establish and improve the processes the ISMS needs and how they interact, not just the ISMS as a whole. ANAB calls this the change with the most impact on how an ISMS is run.
• Clause 6.3, Planning of changes, is new: changes to the ISMS must be carried out in a planned way.
• Clause 6.1.3 now describes Annex A as a list of possible controls rather than a comprehensive one, and says the list is not exhaustive.
• Clauses 9.2 and 9.3 gained sub-sections for the internal audit programme and for the inputs and results of management review.

The bigger change was in Annex A. ANAB's comparison counts 93 controls in the 2022 edition against 114 in 2013: 11 controls are new, and 56 older controls were merged into 24.

The transition is over. ANAB set out the timetable: certification bodies had until 31 October 2023 to move to the new edition, and certified organisations had until 31 October 2025. An ISO SC 27 Journal article from 2026 confirms that after the end of October 2025 all valid ISO/IEC 27001 certifications must reference the 2022 edition. If a supplier shows you a certificate to the 2013 edition today, ask why.

ISO also lists one amendment, ISO/IEC 27001:2022/Amd 1:2024, titled Climate action changes. On ISO's store it was listed at no charge when we checked.

Annex A at a high level

Annex A is a reference list of controls. You do not have to implement every one; you have to decide which ones your risks require and justify that decision. The 93 controls are grouped into four themes, and ANAB's mapping table numbers them as follows:

The 11 controls that were new in 2022, as listed in ANAB's comparison, are threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Most of them describe things that were already good practice; the revision made them explicit.

The document that ties Annex A to your organisation is the Statement of Applicability. Under clause 6.1.3 it lists the controls you need, why you included them, whether they are implemented yet, and why you excluded any Annex A control you left out. Auditors read it closely. An ISO SC 27 Journal article on running an ISMS names weak traceability between the risk assessment, the risk treatment plan and the Statement of Applicability as one of the most common root causes of audit findings.

Detailed guidance on each control is not in ISO/IEC 27001 itself. It sits in a separate standard, ISO/IEC 27002:2022, which ISO describes as offering best practice and control objectives while ISO/IEC 27001 holds the requirements.

How certification works

ISO does not issue certificates. Its FAQ explains that a certificate from an accredited conformity assessment body carries extra confidence because an accreditation body has independently confirmed that certification body's competence. Accredited certification bodies for ISO/IEC 27001 are assessed against two further standards, ISO/IEC 17021-1 and ISO/IEC 27006-1, as the SC 27 Journal sets out.

The shape of the process:

• You implement and run the ISMS first, including at least one round of internal audit and management review, because those are requirements in their own right.
• A certification audit follows, which the SC 27 Journal describes as a systematic, independent and documented process for gathering evidence and judging how far the requirements are met. It is run in two stages, Stage 1 and Stage 2.
• Surveillance audits continue afterwards. A certificate is not a one-off; the certification body keeps checking that the system is still working.

Two practical checks protect you whether you are buying certification or relying on someone else's. First, ISO asks that certificates name the full reference, for example certified to ISO/IEC 27001:2022, not just certified to ISO 27001. Second, the SC 27 Journal points to the IAF CertSearch database as the place to validate accredited certificates issued by accredited certification bodies. The same article warns that cheap and easy certification can dilute the commercial value of the certificate, which is a polite way of saying that a customer who checks will notice.

ISO/IEC 27001, NIST CSF and SOC 2 compared

These three are often mentioned together, and they are not the same kind of thing.

The practical difference is the output. ISO/IEC 27001 ends in a certificate against a fixed set of requirements. NIST CSF 2.0 is guidance: NIST's own document says it does not prescribe how outcomes should be achieved and instead links to resources that describe practices and controls. SOC 2 ends in an auditor's report on your controls, produced by a CPA firm under AICPA standards.

They overlap heavily, and there are published mappings. NIST's CSF 2.0 Informative References catalogue lists a mapping from ISO/IEC 27001:2022 to CSF 2.0, with NIST's caveat that it does not test the correctness of mappings submitted by others and that listing one is not an endorsement. The AICPA publishes a mapping from its 2017 Trust Services Criteria to ISO 27001. If you already run one framework, a mapping tells you where the gaps are for another; it does not replace the other's audit.

What drives the cost

There is no list price for ISO/IEC 27001, and any article that gives you one figure is guessing. What can be said honestly is where the money and time go. The SC 27 Journal, describing why smaller organisations find certification hard, puts it in one line: the cost is turning security into a governed management system. Broken down, that means:

• Scope. The more sites, people, systems and services inside the scope, the more risk assessment, evidence and audit time you need. A tightly drawn scope is the single biggest cost lever you control.
• Internal effort. Asset inventories, the risk assessment, maintaining the Statement of Applicability, training records, internal audits, corrective actions and management reviews are ongoing work, not a project with an end date.
• Starting maturity. An organisation that already has backups it has tested, multi-factor authentication and documented access control has far less to build than one starting from nothing.
• Skills. The same SC 27 Journal article lists skill shortages in information security and certification as a barrier that can delay adoption. If you do not have the skills in house, you buy them in as consultancy or training.
• The certification body's audits, both the initial two-stage audit and the surveillance audits that follow.
• The standards themselves, which are inexpensive next to the rest, and are covered below.

Get quotes from more than one accredited certification body, and ask each what drives their audit duration for your scope.

How a small business starts

ISO publishes a practical handbook aimed at exactly this audience, ISO/IEC 27001:2022, Information Security Management Systems, A practical guide for SMEs. Whether or not you buy it, the starting sequence is the same:

• Read the standard itself. It is 19 pages. Reading the actual requirements is cheaper than paying someone to summarise them, and it makes you a much better buyer of help. The official PDF is sold by ISO and by national standards bodies; the ANSI webstore sells the ISO/IEC 27001:2022 PDF.
• Draw the scope. Decide which parts of the business, which locations and which systems the ISMS covers. Start narrow if a customer only needs one service covered.
• Get leadership to own it. Clause 5 puts responsibility on top management, including setting the information security policy and assigning roles. In a small company that is usually the founder.
• Do the risk assessment and treatment. List the information you hold, what could go wrong with its confidentiality, integrity or availability, and what you will do about each risk.
• Write the Statement of Applicability. Go through the 93 Annex A controls and record which apply, which are already in place, and why any are excluded.
• Fix the basics first. Most of the early wins are ordinary: tested backups, multi-factor authentication on email, a password manager for everyone, antivirus on every device. Our small business security guide covers those, and the password rules NIST says to stop using explains why forced rotation is no longer best practice.
• Run an internal audit and a management review before you book a certification audit. Both are requirements, and they are where you find the gaps cheaply.
• Choose an accredited certification body, and check its accreditation before you sign.

Where to buy the official standard

ISO/IEC 27001 is a paid document, and copies passed around for free are often an older edition or an unofficial summary. Buy the current edition from an official seller.

The ANSI webstore, run by the American National Standards Institute, sells the ISO/IEC 27001:2022 PDF with ISO as the content provider. When we checked on 25 October 2026, it listed the PDF at USD 254.00, or USD 203.20 for ANSI members, with printed versions also available. ISO's own store listed the edition at CHF 155 for PDF and ePub on the same day. Prices change and may vary by currency, so check the checkout page. If you also want the control-by-control guidance, ISO/IEC 27002:2022 is a separate document; ISO's store listed it at CHF 227 when we checked.

Buy ISO/IEC 27001:2022 on the ANSI webstore.

The short version

ISO/IEC 27001:2022 is a set of requirements for running security as a managed, risk-based system, with 93 Annex A controls to choose from and a Statement of Applicability to justify the choice. Certification is optional, done by accredited certification bodies, and checked by ongoing surveillance audits. NIST CSF 2.0 is guidance and SOC 2 is an auditor's report; neither is a substitute for the other two, but mappings make it easier to run more than one. For a small business, the cheapest first step is to read the standard, fix the basics, and only then talk to an auditor. This is general guidance, not compliance or legal advice for a specific organisation.

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.

Explore