ISO 27001: The Complete Guide to Information Security Management
ISO 27001 is the international standard for information security management. NIS2 and DORA reference it, and enterprise procurement demands it. StartComply maps all 93 Annex A controls to automated evidence collection so you stay audit-ready continuously, not just before a surveillance audit.
Trusted by 100+ organisations across Europe
ISO 27001:2022 
NIS2 
DORA 
ISMS What ISO 27001 means for European organisations
- ISO 27001 is the international standard for information security management systems, requiring third-party certification by an accredited audit body.
- The current version is ISO 27001:2022, which introduced 11 new controls and reorganised Annex A into 93 controls across four themes.
- Certification follows a two-stage audit process with annual surveillance audits and full recertification every three years.
- ISO 27001:2022 maps directly to NIS2 Article 21 technical measures and DORA ICT risk management requirements, making it the natural framework for European companies.
- Mandatory documentation includes the ISMS scope, security policy, risk assessment, risk treatment plan, and Statement of Applicability, all of which StartComply keeps audit-ready.
Sources: ISO/IEC 27001. Last updated May 2026.
What Is ISO 27001?
ISO 27001 is a globally recognised standard published by the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (IEC). It specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System.
The standard does not prescribe specific technologies. It prescribes a management framework. Organisations must define the scope of their ISMS, assess information security risks, select controls to treat those risks, and demonstrate that those controls are working. The emphasis is on evidence, not intention. You cannot self-certify; an accredited external certification body must audit you.
ISO 27001 does not stand alone. ISO 27005 provides the methodology for information security risk management, and the wider ISO 27000 family supports the standard. A structured cybersecurity risk assessment is the foundation that determines which Annex A controls actually apply to your organisation.
ISO 27001 is the natural framework for European companies. It maps directly to NIS2 Article 21 technical measures and DORA ICT risk management requirements. StartComply maps every Annex A control to those frameworks simultaneously.
ISO 27001 Is Europe’s Expected Security Baseline
A documented, evidenced, continuously audited ISMS
- 93 Annex A controls across four themes: Organisational, People, Physical, Technological
- Mandatory documents: ISMS scope, security policy, risk assessment, risk treatment plan, Statement of Applicability
- Two-stage certification audit by an accredited body, valid three years
- Annual surveillance audits and full recertification every three years
- Continuous control monitoring required, not pre-audit document gathering
The transition reality: organisations certified to the 2013 version had until October 2025 to move to ISO 27001:2022. New programmes work to the 2022 standard from day one.
Spreadsheets, shared drives, pre-audit panic
- No continuous control monitoring; evidence scattered across spreadsheets and shared drives
- Risk assessments that are out of date by the time of the audit
- Statements of Applicability with unjustified control exclusions
- Internal audit programmes that exist on paper but have not run
- Controls listed as implemented with no operational evidence behind them
- Management reviews that were never documented
The audit reality: auditors do not count pages. They check whether documents reflect actual practice and whether the evidence exists.
Who Needs ISO 27001?
ISO 27001 applies to organisations of any size and sector. In practice, two groups feel the strongest pull towards certification: those facing regulatory pressure and those facing commercial pressure from enterprise procurement.
The distinction is narrowing. Even where certification is not mandatory by law, NIS2 obligations and enterprise procurement increasingly make it mandatory in practice.
ISO 27001 Timeline: From 2013 to 2022
ISO 27001:2013 published, with 114 controls across 14 domains. It became the dominant information security certification worldwide.
ISO 27001:2022 published. Annex A reorganised into 93 controls across four themes, with 11 entirely new controls including threat intelligence and cloud security.
Transition deadline. Organisations certified to the 2013 version had to migrate to ISO 27001:2022 by this date or lose certification.
All new certification programmes work to the 2022 standard from day one. NIS2 and DORA enforcement makes a recognised ISMS baseline more valuable than ever.
Still on the 2013 version? The transition window has closed. Align your Statement of Applicability and Annex A controls to ISO 27001:2022 before your next surveillance audit.
The 8 Components of an Audit-Ready ISO 27001 ISMS
A working ISMS is not a binder of policies. It is a living evidence system with defined scope, named owners, current risk data, operating controls and traceable remediation. Your ISO 27001 documentation set holds it together, and your ISO 27001 audit tests whether it genuinely operates.
ISMS scope
Define which legal entities, locations, systems and information assets are inside the ISMS, with documented boundaries and exclusions.
Information security policy
A top-level policy approved by management that sets the direction and commitment for information security across the organisation.
Risk assessment
A repeatable methodology that identifies, analyses and evaluates information security risks across your in-scope assets.
Risk treatment plan
Documents how each identified risk is treated, which controls apply, who owns them, and the residual risk accepted.
Statement of Applicability
Lists every Annex A control, whether it applies, and justifies each inclusion or exclusion. Auditors scrutinise this document closely.
Operating controls
Each applicable control needs a documented policy, operational evidence that it runs, and a periodic review schedule.
Internal audit programme
Independent internal audits conducted at planned intervals to confirm the ISMS conforms to requirements and is effectively implemented.
Management review
Documented senior leadership reviews of ISMS performance, including risk results, audit findings and corrective action status.
How ISO 27001 Certification Works, Step by Step
Define Scope and Risk Assessment Clause 4-6
Define the boundaries of your ISMS, then assess information security risks using a repeatable methodology. The risk assessment determines which Annex A controls are applicable.
Implement Controls and Documentation Annex A
Select and implement controls to treat your risks, then produce the mandatory documents. Each control needs a documented policy and operational evidence behind it.
Stage 1 Documentation Audit Readiness
The certification body reviews your ISMS documentation, Statement of Applicability and risk methodology to assess whether you are ready for the full audit. Budgeting matters here too: see our ISO 27001 certification cost guide.
Stage 2 Certification Audit Evidence
Auditors interview staff, sample evidence and test whether your controls are operational in practice. Passing Stage 2 results in a certificate valid for three years.
Surveillance and Recertification Continuous
Surveillance audits occur annually in years one and two. At year three, a recertification audit repeats the full Stage 2 process. Continuous compliance is built into the lifecycle.
Everything Your ISO 27001 Programme Needs. Built Into One Platform.
Annex A Control Mapping
All 93 controls across the four 2022 themes, mapped to owners and evidence tasks.
- Organisational, People, Physical, Technological themes covered
- Eleven new 2022 controls including threat intelligence and cloud security
- Statement of Applicability generated and kept current
- Control exclusions justified and audit-defensible
Risk Assessment and Treatment
Run a structured, repeatable risk assessment aligned to ISO 27005 methodology.
- Repeatable risk assessment workflow
- Risk treatment plan linked to Annex A controls
- Residual risk tracking and acceptance records
- Auditable methodology for external parties
Continuous Evidence Collection
Evidence is built continuously, not gathered in the weeks before an audit.
- Scheduled evidence tasks per control
- Automated reminders on review due dates
- Timestamped, organised audit trail
- Internal audit and management review tracking
Cross-Framework Mapping
ISO 27001 rarely runs in isolation. Map controls across the regulations that apply to you.
- ISO 27001 to NIS2 Article 21 technical measures
- ISO 27001 to DORA ICT risk management requirements
- ISO 27001 to GDPR technical measures
- One control, evidence for multiple frameworks
StartComply vs. The Alternatives
Not every approach to ISO 27001 produces the continuous evidence an accredited auditor expects.
StartComply was built specifically for European organisations navigating ISO 27001:2022, NIS2, and DORA.
Frequently Asked Questions About ISO 27001
How long does it take to get ISO 27001 certified?
For most organisations, the journey from starting an ISMS programme to receiving a certificate takes between six and eighteen months. Smaller organisations with a tightly defined scope and mature existing controls can move faster. Larger organisations or those with fragmented documentation typically take longer. The biggest time variable is internal preparation: defining scope, completing the risk assessment, implementing missing controls, and gathering operational evidence. Starting with a platform that automates evidence collection significantly reduces preparation time.
Is ISO 27001 certification mandatory for European companies?
ISO 27001 certification is not directly mandated by law in most European jurisdictions. However, NIS2 Article 21 requires essential and important entities to implement security measures equivalent to the standard, and regulators increasingly treat ISO 27001 certification as evidence of compliance. DORA similarly references recognised standards. In practice, many enterprise customers and public sector procurement processes require it contractually. The distinction between mandatory by law and mandatory in practice is narrowing fast.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 is the certifiable standard. It specifies the requirements your ISMS must meet and the controls your organisation must address through Annex A. ISO 27002 is a guidance standard. It provides detailed implementation advice for each of the 93 Annex A controls. You certify to ISO 27001. You use ISO 27002 to understand how to implement controls to a credible standard. Certification auditors reference ISO 27002 when assessing whether your controls are genuinely operational rather than superficially documented.
How many controls are in ISO 27001:2022 Annex A?
ISO 27001:2022 Annex A contains 93 controls organised into four themes: Organisational (37 controls), People (8 controls), Physical (14 controls), and Technological (34 controls). The previous 2013 version had 114 controls across 14 domains. Eleven controls are entirely new in the 2022 version, covering areas such as threat intelligence, cloud service security, and data masking. Not all controls are automatically applicable. Your risk assessment and Statement of Applicability determine which controls are in scope for your organisation.
Can a small company achieve ISO 27001 certification?
Yes. ISO 27001 is applicable to organisations of any size. The standard is risk-based and scope-based, meaning a small company can define a narrower ISMS scope that reflects its actual operations. Certification bodies regularly certify organisations with fewer than 50 employees. The key factors are the quality of your risk assessment, the completeness of your documentation, and the operational evidence that your controls are running. Small teams often find that automation tools reduce the burden of evidence collection to a manageable level.
What happens if you fail an ISO 27001 certification audit?
Failing a certification audit typically results in one of two outcomes: minor nonconformities or major nonconformities. Minor nonconformities require a corrective action plan submitted to the certification body within a set timeframe, usually 90 days. The auditor reviews evidence of remediation remotely. Major nonconformities mean certification cannot be granted until the issue is resolved and a follow-up audit confirms the fix. Most organisations with solid preparation encounter only minor findings, if any. The key is addressing gaps before the Stage 2 audit, not during it.
Client Testimonials
“We evaluated enterprise platforms costing 10x more. StartComply does what we need at a price that makes sense.”Elena Kowalski
“Finally, a compliance tool that understands European regulations. StartComply got us audit-ready in weeks, not months.”Maria Papadopoulou
“The AI policy engine alone saved us hundreds of hours. And the third-party risk management is exactly what DORA requires.”Thomas Müller
