ISO/IEC 27001:2022

Annex A is the reference set of information security controls that organizations draw on to treat their risks. The 2022 revision restructured Annex A into 93 controls organized under four themes: Organizational (37), People (8), Physical (14) and Technological (34). This replaced the 14 control domains used in the 2013 version and consolidated overlapping controls.

The SoA is a mandatory document that lists all Annex A controls and states whether each is applicable, with justification for inclusion or exclusion. For applicable controls it records their implementation status and links them back to the risk treatment plan. Auditors treat the SoA as the central map of your ISMS and review it closely during certification.

ISO 27001 does not mandate a specific method, only that it is documented, consistent and repeatable. Asset-based approaches enumerate assets and threats against each, which suits organizations with well-defined inventories, while scenario-based approaches model plausible risk events, which can be faster and more business-focused. Many organizations blend the two, and either is acceptable provided results are comparable over time.

The 2022 revision restructured Annex A from 114 controls in 14 domains into 93 controls across 4 themes, and added 11 new controls. The new controls include Threat intelligence, Information security for cloud services, Data leakage prevention and Secure coding, reflecting modern cloud and threat realities. Controls also gained attributes to help tagging and filtering, though the core clauses 4 to 10 saw only minor changes.

For many small and mid-sized organizations the journey from kickoff to certification takes roughly six to twelve months, depending on scope, maturity and resourcing. Costs vary widely by organization size and region and typically include internal effort, optional consultancy, and certification body audit fees. Larger or more complex scopes lengthen timelines and increase audit days and cost.

ISO 27001 is the certifiable standard that specifies the requirements for an ISMS, including risk management and mandatory clauses. ISO 27002 is a guidance document that gives detailed implementation advice for the Annex A controls but is not itself certifiable. In practice you certify against ISO 27001 and use ISO 27002 as the how-to reference for the controls.

No. Annex A is a reference set, and the controls you apply are driven by your risk assessment and treatment decisions. You may exclude controls that are not relevant to your scope and risks, provided you justify each exclusion in the SoA. What you cannot do is ignore a relevant risk, and auditors will challenge exclusions that leave real risks untreated.

Stage 1 is a readiness or documentation review where the certification body checks that your ISMS documentation, scope and SoA are in place and you are ready to proceed. Stage 2 is the main assessment where auditors evaluate whether controls are implemented and operating effectively through evidence and interviews. Passing both, after closing any major nonconformities, results in certification.

ISO 27001 certification runs on a three-year cycle. The certification body conducts annual surveillance audits, typically in years one and two, to confirm the ISMS remains effective. A full recertification audit takes place before the certificate expires at the end of the three years.

Yes. ISO 27001 is scalable and is regularly achieved by startups and small teams, because requirements are applied proportionately to the size, complexity and risk of the organization. A small company can define a tight scope, implement a lean set of relevant controls and document its ISMS pragmatically. The effort is smaller, but the same clauses and audit stages still apply.

ISO 27001 is an internationally recognized ISMS certification, while SOC 2 is a North American attestation report against Trust Services Criteria; the two overlap substantially and controls can be mapped to reduce duplicate effort. GDPR is a data protection law and NIS2 a cybersecurity directive, and a well-run ISMS provides much of the governance and control evidence they expect. However, ISO 27001 certification does not by itself prove legal compliance with GDPR or NIS2.

The ISMS scope defines the boundaries of what your management system covers, including the business processes, locations, assets, people and technologies that fall under it. It is set by considering internal and external issues, interested parties and interfaces with other organizations. A clear, well-bounded scope keeps the programme manageable and directly shapes what auditors will assess.