ISO 27001 explained: what the 2022 standard demands of an ISMS

What is ISO 27001?

ISO/IEC 27001 is the international standard for information security management systems (ISMS). It sets out the requirements an ISMS has to meet so that an organisation manages the confidentiality, integrity and availability of its information systematically. It is published jointly by ISO and IEC; the current version is ISO/IEC 27001:2022, supplemented by Amendment 1:2024 on climate considerations.

The standard applies to any sector and is the central certifiable standard of the 27000 family. It says what an ISMS has to achieve, not which tool or format to use.

The management system is what is actually audited

ISO/IEC 27001 describes requirements for an information security management system. What gets certified is therefore not a single firewall or a set of policies, but the organisation's ability to identify, treat and monitor information risks systematically.

Technical controls matter. But they only become defensible through a defined scope, clear responsibilities, documented decisions and a recurring improvement process.

Clauses 4 to 10 form a chain of steering

Context and scope set the frame. Leadership provides mandate and resources. Planning translates risks into objectives and controls. Support and operation bring these decisions into daily work. Evaluation and improvement close the loop.

• Define the scope and interested parties in a traceable way
• Assess and treat risks with a consistent method
• Verify effectiveness through metrics, audits and management review
• Close deviations with cause, correction and evidence of effectiveness

Annex A: 93 controls in four themes

Annex A lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Which of them apply is decided by risk treatment and recorded in the Statement of Applicability, with a justification for each inclusion and exclusion. ISO/IEC 27002:2022 provides implementation guidance for every control.

What changed with the 2022 version

Compared with the 2013 version, Annex A moved from 114 controls in 14 sections to 93 controls in four themes. Eleven controls are new, among them threat intelligence, information security for the use of cloud services, configuration management, data masking and data leakage prevention. In the main body, planning of changes (clause 6.3) was added, among other things.

Certificates under the 2013 version had to transition to the new version by 31 October 2025. Anyone certified today is audited against ISO/IEC 27001:2022.

The best starting point is a defensible scope

Many programmes start with a list of controls. It is more practical to first determine the service context that needs protection: products, processes, information, sites, platforms and dependencies. Only then can you decide which risks and controls are relevant.