What the standard requires
ISO/IEC 27001:2022 sets out the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). It is not a checklist of security tools; it is a governance framework that requires an organisation to define its context, identify risks, set objectives, run processes, monitor performance and drive improvement.
The standard has four main components: context and leadership (Clauses 4 to 6), planning and support (Clauses 7 to 8), operation and evaluation (Clauses 8 to 9), and improvement (Clause 10). Annex A then provides the control reference set, organised into 93 controls across four themes: organisational controls, people controls, physical controls and technological controls.
The 2022 revision and the 93 Annex A controls
The 2022 revision replaced the previous 114 controls of Annex A with 93 controls, merging some, adding new ones and aligning the structure with ISO/IEC 27002:2022. The themes are: organisational controls, people controls, physical controls and technological controls. New or renamed controls include threat intelligence, cloud services, business continuity ICT readiness, and monitoring activities. The 2022 standard remains compatible with the previous management-system clauses; the major change is in the control set and the way organisations demonstrate their chosen controls.
The certification path
Certification is awarded by an accredited certification body after a two-stage audit:
- Stage 1 — documentation review. The auditor checks that the ISMS is documented, the scope is clear, the risk assessment and treatment are appropriate, and the organisation is ready for the full audit.
- Stage 2 — implementation audit. The auditor examines whether the ISMS is actually operating as described, interviews staff, reviews records and tests evidence for a sample of Annex A controls.
If nonconformities are found, the organisation must correct them before certification is granted. After initial certification, the body returns for surveillance audits annually, with a full recertification audit every three years.
ISO 27001 and NIS2
A well-implemented ISO 27001 ISMS is a strong starting point for meeting NIS2's Article 21 risk-management measures. Many of the controls map directly to topics such as risk analysis, information-system security, incident handling, business continuity, cryptography and access control.
Not equivalent
How CYBERVETTER helps
We work with organisations that are preparing for ISO 27001 certification for the first time or need to keep it alive after the 2022 revision. Our support includes:
- Scoping the ISMS and aligning it with business boundaries and risk appetite.
- Risk assessment, treatment plans and Statement of Applicability.
- Annex A control selection and evidence preparation.
- Internal audit and management review before the certification body arrives.
- Mapping the ISMS to NIS2 and other overlapping obligations so the work counts twice.