Information Security Management Systems (ISO 27001)
ISO 27001 is the international standard for building and running an information security management system (ISMS): a risk-driven, continuously improving security program rather than a checklist of controls.
Who Needs It
No law mandates ISO 27001, but it is the assurance credential most widely requested outside North America. You'll pursue it when:
- Enterprise customers, especially in Europe, the UK, Asia-Pacific, or the public sector, require certification before signing
- You sell internationally and want one credential that travels; outside North America, ISO 27001 often carries more weight than SOC 2
- You want the ISMS discipline itself: a management system that forces regular risk assessment, internal audit, and executive review
If your buyers are mostly US enterprises, SOC 2 may come first, but the underlying controls overlap enough that adding ISO 27001 later is incremental, not a restart.
How the Standard Is Organized
ISO 27001 has two halves, and both get audited.
Clauses 4-10 define the ISMS itself: the management machinery. In plain terms: understand your context and scope (4), get leadership commitment and a security policy (5), assess risks and plan treatment (6), resource and document the program (7), run it (8), measure it with internal audits and management reviews (9), and fix what's broken (10). This half is what makes ISO 27001 different from a control checklist: the auditor cares as much about how you decide as about what you deployed.
Most organizations consolidate the clause 4-10 requirements into a single ISMS plan document, and auditors will ask for it. A workable plan records the scope with justified exclusions, the interested parties and the legal and contractual requirements they impose, who holds top-management and security roles and the competencies those roles require, the risk assessment methodology (run at least annually or when significant changes occur) and the resulting treatment plan, measurable security objectives with owners and evaluation criteria, a communication plan, how documented information is created, approved, and version controlled, the monitoring and measurement approach, and the internal audit and management review cadence. Auditors expect this content to reflect your actual environment; template language left generic is treated as a gap.
Annex A lists 93 reference controls, organized in the 2022 edition into four themes:
| Theme | Controls | Examples |
|---|---|---|
| Organizational | 37 | Policies, supplier relationships, incident management, threat intelligence |
| People | 8 | Screening, terms of employment, awareness, remote working |
| Physical | 14 | Secure areas, equipment protection, media disposal |
| Technological | 34 | Access control, cryptography, logging, secure development |
You don't blindly implement all 93. Your risk assessment drives a Statement of Applicability (SoA): the document declaring which controls apply, how they're implemented, and why any are excluded. The SoA is the single most scrutinized artifact in the audit, so keep exclusion justifications defensible.
Certification Process
Certification runs on a three-year cycle:
- Stage 1 audit: documentation review and readiness check
- Stage 2 audit: on-site verification that the ISMS actually operates, covering control testing, staff interviews, and evidence sampling
- Surveillance audits: annually in years one and two, narrower in scope
- Recertification audit: in year three to renew the certificate
Before Stage 1, the standard requires you to have run at least one internal audit and one management review. Auditors check for both, so we recommend building the cadence early rather than staging it for the audit.
For the artifacts that typically satisfy manually evidenced control areas, see Example Evidence.
FAQ
ISO 27001 vs SOC 2: what's the actual difference?
ISO 27001 is a certification of your management system against a fixed international standard; SOC 2 is a Certified Public Accountant (CPA) firm's attestation report on controls you selected against the Trust Services Criteria. ISO gives you a certificate anyone can verify; SOC 2 gives you a detailed report customers read. Many companies end up with both, sharing most of the control set.
How long is certification valid?
Three years, contingent on passing annual surveillance audits. Skip or fail surveillance and the certificate can be suspended.
Do we have to implement all 93 Annex A controls?
No, but you must consider all 93 and justify inclusions and exclusions in your Statement of Applicability based on your risk assessment. Exclusions are normal (no data center means most physical controls shrink); unjustified exclusions are findings.
Can we certify just part of the company?
Yes. The ISMS scope is yours to define: a product line, a business unit, a set of locations. Just know that customers read the scope statement on the certificate, and a scope that excludes the service they buy defeats the purpose.