--- title: "What Is ISO 27001? ISO/IEC 27001:2022 Explained" description: "What ISO 27001 is, what an ISMS does, who needs certification, the clauses and 93 controls explained, and how certification works - in plain English." canonical: https://www.isosecurity.co.uk/resources/what-is-iso-27001 updated: 2026-11-10 --- # What is ISO 27001? ISO 27001 (formally ISO/IEC 27001:2022) is the international standard for an Information Security Management System (ISMS): the policies, responsibilities, risk decisions and records through which an organisation manages information security. An independent body audits the system and certifies it for three years at a time. ## What is ISO 27001, in short? ISO 27001 sets out what a functioning information security management system (ISMS) must do. Understand what information matters, decide how it could be harmed, put proportionate controls in place, check they work, and improve them. Certification means an independent, accredited auditor has examined your system and confirmed it meets the standard. Customers ask for the certificate because it answers a hundred security questions in a form their procurement teams already trust. ## What is an ISMS? An ISMS is a management system, in the same family as the quality system behind ISO 9001. In practice it consists of a defined scope, a policy approved by leadership, and a repeatable way of assessing risk. It also needs a record of which controls you operate and why, with named owners for risks and controls. Add evidence that controls run day to day, an internal audit programme, a management review, and a way of fixing what those checks find. The standard leaves product choices to you. It governs how security decisions are made, owned and evidenced. ## Who needs ISO 27001, and why? Most organisations pursue certification for a commercial reason. A major customer requires it, a tender scores it, an investor or insurer asks for it, or a board wants credible assurance as the business grows. It is most common where you hold other people's data or provide services they depend on: software, IT services, professional services, financial services and suppliers into regulated industries. The trigger matters more than the sector. If nobody is asking and your risks are modest, the UK government's Cyber Essentials scheme may be the proportionate first step instead. ## What does ISO 27001 require? The main body of the standard, clauses 4 to 10, is mandatory in full: | Clause | What it asks for | | ---------------- | -------------------------------------------------------------------------------- | | 4 · Context | Your organisation's issues, interested parties and a defined ISMS scope | | 5 · Leadership | Visible commitment from top management, a policy, assigned roles | | 6 · Planning | Risk assessment and treatment, a Statement of Applicability, security objectives | | 7 · Support | Resources, competence, awareness, communication and controlled documents | | 8 · Operation | Running the risk process and controls you planned, day to day | | 9 · Evaluation | Monitoring, internal audit and management review | | 10 · Improvement | Handling nonconformities, corrective action and continual improvement | Annex A then provides 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). You compare your arrangements against them during risk treatment and record the outcome in your Statement of Applicability. My [ISO 27001 checklist](/resources/iso-27001-checklist) works through the requirements in order. The [glossary](/glossary-iso27001) defines the terms you will meet. ## How does ISO 27001 certification work? Once the system has been operating long enough to generate evidence, an independent certification body audits it in two stages. Stage 1 reviews your documentation and readiness, and Stage 2 tests whether the system operates in practice, interviewing the people who own controls. The certificate lasts three years, with surveillance audits in between. My guides to [Stage 1 and Stage 2 audits](/resources/iso-27001-stage-1-stage-2-audit) and to [surveillance audits](/resources/iso-27001-surveillance-audit) explain each visit. Timescales and budgets sit in my guides to [how long ISO 27001 takes](/resources/how-long-does-iso-27001-take) and [what ISO 27001 costs in the UK](/resources/iso-27001-cost-uk). ## What do people get wrong about ISO 27001? - A technical checklist or a set of products to buy will not meet it. The standard governs how you manage security. - Incidents can still happen. The certificate evidences that you manage the risk systematically. - Only an independent certification body can award it. Consultants, toolkits and training providers cannot. - It runs continuously, year after year. A certificate you stop maintaining will not survive surveillance. ## Frequently asked questions about ISO 27001 ### Is ISO 27001 a legal requirement in the UK? No: certification is voluntary in UK law, and it becomes effectively mandatory when a customer, tender, framework or contract requires it, which is how most organisations encounter it. It helps demonstrate the security measures UK GDPR expects, and your legal obligations still apply in full. ### What is the difference between ISO 27001 and ISO/IEC 27001:2022? They are the same standard: ISO/IEC 27001:2022 is the full formal title, published jointly by ISO and the IEC in its 2022 edition. The current edition replaced the 2013 version, reorganising Annex A from 114 controls in 14 groups into 93 controls in four themes. ### Do we have to implement all 93 Annex A controls? Every control needs a position in your Statement of Applicability: include it, or exclude it with a justification rooted in your risk assessment or in legal and contractual requirements. Most organisations implement the majority and exclude a minority, and an auditor tests whether your justifications stand up. ### Who awards ISO 27001 certification? An independent certification body, ideally accredited by UKAS in the UK, carries out a two-stage audit and makes the certification decision itself. Consultants like ISO Security prepare your organisation and management system, and the decision stays with the body. ### How long is ISO 27001 certification valid? Three years. During that cycle the certification body returns, usually annually, for shorter surveillance audits, with a fuller recertification audit before the end of year three, and you maintain certification by operating the system throughout. ### What is the difference between ISO 27001 and ISO 27002? ISO/IEC 27001 is the certifiable standard: it sets the requirements for the management system (clauses 4 to 10) and lists the 93 reference controls in Annex A. ISO/IEC 27002 is the companion guidance document explaining each control in detail (purpose, implementation and evidence), and you certify to 27001 while using 27002 to design controls that fit your risks. ## Contact Considering ISO 27001 for your organisation? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.