What is ISO 27001? A plain-English guide to the information security standard

ISO 27001 is an international standard, published jointly by the International Organisation for Standardisation and the International Electrotechnical Commission, that sets out the requirements for an information security management system. The current version is ISO/IEC 27001:2022.

The key idea is the management system, usually shortened to ISMS. An ISMS is not a product you install. It is a set of policies, processes, responsibilities and records that, taken together, let your organisation manage information security in a deliberate and repeatable way. The standard cares less about which specific tools you use and more about whether you understand your risks, have decided what to do about them, and can show that the system keeps working over time.

Because it is risk-based, ISO 27001 does not hand you a fixed list of things every company must do. Instead it asks you to assess the risks to your information, decide how to treat them, and justify your choices. That is why two certified organisations can look very different from the inside while both being fully compliant.

It is worth separating two numbers you will see. ISO 27001 is the certifiable standard, the requirements you are measured against. ISO 27002 is a companion guidance document that explains how the controls can be implemented. You get certified to 27001; you read 27002 for advice.

The main body of ISO 27001 is organised into clauses. Clauses 1 to 3 are introductory. The requirements you are actually audited against live in clauses 4 to 10, and together they describe the lifecycle of running an ISMS.

Clause 4, Context of the organisation. You define what your ISMS covers, who your interested parties are, such as customers, regulators and staff, and what they expect of you. This is also where you set the scope, the boundary of what is and is not included.

Clause 5, Leadership. Senior management has to own the ISMS, set an information security policy, and assign clear roles and responsibilities. Security cannot be something quietly delegated to one engineer and forgotten.

Clause 6, Planning. This is the heart of the standard. You carry out a risk assessment to identify what could go wrong, then a risk treatment plan to decide what to do about each risk. You also set measurable security objectives.

Clause 7, Support. The resources, people, skills, awareness and documented information needed to make the system work. This includes training staff and keeping records under control.

Clause 8, Operation. Actually doing what you planned: running the risk assessment and treatment on a schedule and keeping evidence that the controls operate day to day.

Clause 9, Performance evaluation. Measuring whether the ISMS is working through monitoring, internal audits and a formal management review by leadership.

Clause 10, Improvement. Handling things that go wrong through corrective action, and continually improving the system. ISO 27001 expects the ISMS to get better over time, not to sit still after certification.

Clauses 4 to 10 tell you how to run the management system. Annex A is the menu of security controls you draw from when you decide how to treat your risks. The 2022 edition reorganised and modernised this list.

There are now 93 controls, grouped into four themes rather than the many categories used in the older 2013 version. The four themes are Organisational controls, People controls, Physical controls and Technological controls.

Organisational controls, 37 of them, cover policies, roles, supplier relationships, incident management and similar governance topics. People controls, 8 of them, cover screening, awareness, responsibilities and conduct of staff. Physical controls, 14 of them, cover offices, equipment, secure areas and physical access. Technological controls, 34 of them, cover the technical measures such as access control, encryption, logging, backups and secure development.

The 2022 update also introduced several newer controls reflecting how organisations work today, including threat intelligence, information security for cloud services, data masking, data leakage prevention and secure coding.

Crucially, you do not have to implement every control. You review each one against your risk assessment and record which apply, which do not, and why, in a document called the Statement of Applicability. The Statement of Applicability is one of the central artefacts an auditor will examine, because it shows the reasoning behind your choices.

ISO 27001 certification is awarded by an independent certification body, not by whoever helped you prepare. A consultancy or studio can guide you, build the ISMS with you and run a mock audit, but it cannot issue the certificate. That separation is deliberate and it is what gives the certificate its credibility.

The bodies that can issue a recognised certificate are themselves accredited by a national accreditation body, which oversees their competence and independence. When you choose a certification body, checking that it is properly accredited matters, because an unaccredited certificate carries far less weight with customers.

The assessment happens in two stages. Stage 1 is a documentation review. The auditor checks that your ISMS exists on paper, that your scope, policies, risk assessment and Statement of Applicability are in place and coherent, and that you are ready for the deeper audit. It often surfaces gaps you still have time to fix.

Stage 2 is the main audit. The auditor gathers evidence that your ISMS is not just written down but actually operating: that controls run, records are kept, incidents are handled and management reviews happen. If you pass, the body issues a certificate, typically valid for three years.

Certification is not a one-off event. During those three years the body carries out surveillance audits, usually annually, to confirm the ISMS is still working, and a full recertification audit at the end of the cycle. The standard assumes you keep the system alive, not that you prepare once and relax.

ISO 27001 is voluntary. There is no law that forces a typical company to hold it. In practice, demand is driven by customers and markets rather than regulators.

It tends to matter most for software vendors and SaaS companies selling to larger organisations, managed service providers, data processors, and any business whose customers run formal vendor security reviews. In many enterprise and public-sector procurement processes, an accredited ISO 27001 certificate shortens or replaces a long security questionnaire.

It is also common when expanding internationally, because ISO 27001 is recognised worldwide and gives a single, portable answer to the question of whether you take security seriously.

You probably do not need it yet if you have no customers asking for it, handle little sensitive data, and have more urgent product risks. That said, building good security habits early makes eventual certification far less painful, and the clauses 4 to 10 discipline is valuable even before you pursue a certificate.

It is worth noting how ISO 27001 differs from SOC 2, which readers often confuse it with. ISO 27001 certifies that your management system meets a defined standard and is issued by an accredited certification body. SOC 2 is an attestation report produced by a licensed CPA firm against defined trust criteria. They overlap heavily in substance but differ in format and in who issues the result.

Preparation is more manageable than the standard's dense wording suggests. Much of it is writing down and consistently following what your team already does, then closing the genuine gaps.

Define your scope first. Decide which products, systems, teams and locations the ISMS covers. A tighter, honest scope is easier to certify than an overambitious one.

Get leadership genuinely involved. Clause 5 is not a formality; auditors can tell when management has signed a policy but is not engaged. Assign a clear owner for the ISMS.

Run a real risk assessment. Identify your information assets and what could threaten them, then decide for each risk whether to treat, accept, transfer or avoid it. This drives everything else, including which Annex A controls you select.

Write the core documents: an information security policy, the risk assessment and treatment plan, and the Statement of Applicability. Keep them readable, because people have to follow them.

Implement the controls you selected and then operate them long enough to produce evidence. Auditors want to see the system running, so build up a few months of records, logs and review meetings before the Stage 2 audit.

Run an internal audit and a management review before the certification body arrives. Finding and fixing your own gaps first is exactly what clauses 9 and 10 are asking for, and it makes the external audit far smoother.

A specialist studio such as tr3labs, founded in 2024, can help you scope the ISMS, run the risk assessment, build the documentation and prepare for the audit. The certificate itself always comes from an independent accredited certification body, never from the firm that helped you prepare.