What Is ISO 27001

ISO 27001 is the international standard for information security management systems (ISMS). It defines the requirements for establishing, implementing, maintaining, and continually improving a systematic approach to managing sensitive information. The standard covers governance, risk assessment, control implementation, and continual improvement. It applies to any organisation, regardless of size or sector, that wants to manage information security risks systematically and demonstrate that management to clients, regulators, and auditors.

ISO 27001 certification is not universally mandated by law in Europe, but it is increasingly required by enterprise clients as a condition of supplier contracts, particularly in financial services, healthcare, and the public sector. Regulatory frameworks like NIS2 and DORA reference security requirements that align closely with ISO 27001 controls. While holding certification does not automatically mean full NIS2 or DORA compliance, it provides a strong, auditable evidence base that competent authorities and regulators will recognise.

ISO 27001 is the certifiable standard. It sets out the requirements an organisation must meet to achieve and maintain certification. ISO 27002 is the companion guidance document. It provides detailed implementation advice for each of the 93 controls listed in ISO 27001 Annex A. You certify against ISO 27001. You use iso 27002 to understand how to implement the controls effectively. Both documents are updated together: the current versions are both dated 2022.

ISO 27001:2022 contains 93 controls in Annex A, organised into four themes: organisational (37 controls), people (8 controls), physical (14 controls), and technological (34 controls). This replaces the 114 controls across 14 domains in the 2013 edition. New controls in 2022 cover threat intelligence, cloud security, data masking, web filtering, and ICT readiness for business continuity. Not all controls must be implemented. Each organisation must assess applicability based on its risk profile and document the decisions in a Statement of Applicability.

Most European SMEs and mid-market organisations take six to twelve months from starting their ISMS to achieving certification. The timeline depends on the organisation’s current security maturity, the complexity of its scope, and the quality of its documentation and evidence. Using structured tooling rather than spreadsheets compresses this timeline. For a detailed breakdown of costs and timelines, see our guide on iso 27001 certification cost.

If an auditor raises a major nonconformity at a Stage 2 audit, certification is not awarded until the nonconformity is closed and verified. This typically requires a follow-up audit visit. Minor nonconformities require a documented corrective action plan but do not necessarily block certification. At surveillance audits, repeated or unresolved nonconformities can result in suspension or withdrawal of certification. Preparation and continuous monitoring are the only reliable ways to avoid audit surprises. Our iso 27001 audit guide covers the full audit process in detail.