ISO/IEC 27001 Certification

ISO/IEC 27001 is the international standard that specifies requirements for establishing, implementing, maintaining and continually improving an information security management system. Its core aim is to safeguard three properties of information: confidentiality, integrity and availability (CIA).

The standard covers far more than cyber attacks. It addresses any risk that could disrupt or paralyse operations: system failures, human error, infrastructure incidents or contractual breaches. An ISMS considers organisational, personnel, physical and technological aspects together with the relevant legal, regulatory and contractual requirements.

ISO/IEC 27001 is built on continual improvement (often described as the PDCA cycle: Plan – Do – Check – Act) and uses the Harmonized Structure shared with other ISO management system standards, making it easy to integrate with ISO 9001 or ISO 14001. Guidance on the controls is provided in ISO/IEC 27002:2022.

The current edition, ISO/IEC 27001:2022 (with Amendment 1:2024), contains 93 controls in Annex A, grouped into four themes: organisational (37), people (8), physical (14) and technological (34). Compared with the 114 controls of the 2013 edition, controls were merged and 11 new ones added: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.

The IAF transition period from the 2013 edition ended on 31 October 2025. In February 2024 ISO published ISO/IEC 27001:2022/Amd 1:2024 on climate action: clause 4.1 now requires the organisation to determine whether climate change is a relevant issue, and clause 4.2 gains a note that interested parties can have requirements related to climate change. ISO/IEC 27001 certification is carried out under ISO/IEC 17021-1 and ISO/IEC 27006-1:2024, the requirements for certification bodies.

ISO/IEC 27001 suits any organisation, regardless of size or sector, and is especially relevant where information security is business-critical:

• Software companies, data centres, cloud providers and IT outsourcing firms
• Banks, financial institutions, insurers and fintechs
• Manufacturers, retailers and suppliers in global supply chains
• Operators of critical infrastructure such as energy, telecoms and healthcare

TÜV NORD can audit ISO 27001 in a combined programme with ISO 9001, ISO/IEC 20000-1 or ISO 22301.

Before the audit, your organisation needs an information security risk management process that is applied in practice: identifying, analysing, evaluating and treating risks. The outcome is documented in a Statement of Applicability (SoA), which states which controls are selected or excluded and why. The ISMS should also have been operating long enough to produce records of internal audits and management review.