What is ISO 27001? Explained simply
By Sid Varma, Founder - AllyMatter.com
help
The problem ISO 27001 solves
Every organization holds information it cannot afford to lose, leak or have altered: customer records, contracts, source code, payroll, the bank login. The people who hand you their data cannot check your security from the outside. A contract clause and a questionnaire only record what you say you do.
ISO/IEC 27001 answers that problem with a management system rather than a fixed list of technical measures. It requires you to work out which information matters, what could go wrong with it, what you will do about each risk, and how you will keep checking that those decisions still hold.
An independent certification body then audits that system and issues a certificate that a buyer anywhere can read and verify.
The current edition is ISO/IEC 27001:2022, published jointly by ISO and the IEC on October 25, 2022. It has one amendment, published February 23, 2024, which added climate change to the context requirements. The 2013 edition is withdrawn, and under the accreditation rules every certificate issued against it expired or was withdrawn by October 31, 2025.
A certificate that still says 2013 is not valid today.
What it actually asks of you
The standard is short: 19 pages including the control catalog. The requirements sit in seven clauses, numbered 4 to 10, and you must meet all seven. There is no choosing at this level.
The table puts each clause in plain words and names the record it produces, because those records are what the auditor asks for.
| Clause | What it requires | What you end up with |
|---|---|---|
| 4 Context of the organization | Work out what affects your security, who has requirements of you (customers, regulators, the law), whether climate change is a relevant issue, and draw the boundary of the system | A written scope statement |
| 5 Leadership | Top management sets the information security policy, assigns roles and responsibilities, and provides the resources | An information security policy and named owners |
| 6 Planning | Define a repeatable risk assessment, run it, decide how to treat each risk, compare your chosen controls against Annex A, write the Statement of Applicability, set measurable objectives, and plan changes to the system | Risk assessment results, a risk treatment plan, the Statement of Applicability, objectives |
| 7 Support | Competent people, security awareness, communication, and documents that are controlled and kept current | Competence and training records, controlled documents |
| 8 Operation | Run what you planned, repeat the risk assessment at planned intervals and when things change, and carry out the treatment plan | Operating records and updated risk results |
| 9 Performance evaluation | Measure what matters, run internal audits, and hold management reviews | Monitoring results, internal audit reports, management review records |
| 10 Improvement | Correct nonconformities, find their causes, and keep improving | Corrective action records |
Two of those documents decide everything. The scope statement fixes what the certificate covers, and nothing outside it is certified: a system scoped to one product or one office says nothing about the rest of the company. The Statement of Applicability (SoA) lists every control in Annex A, says whether you apply it, and justifies each inclusion and exclusion.
Auditors read it first, because it ties your risk assessment to what you actually do.
Annex A is a catalog, not a checklist
Annex A lists 93 information security controls in four groups: organizational (37), people (8), physical (14) and technological (34). The 2013 edition had 114 controls in 14 sections. In the 2022 rework 11 controls are new, 24 were merged from existing controls and 58 were updated.
In ISO/IEC 27002:2022 each control now carries a purpose and attributes instead of the old grouped control objectives. The implementation guidance for every control lives in a separate standard, ISO/IEC 27002:2022, which is guidance only. Nobody is certified to ISO/IEC 27002.
This is the point most often misstated. Annex A is not a list of requirements to implement one by one. The requirement (clause 6.1.3) is that you determine the controls your risk assessment needs, compare them against Annex A so nothing obvious is missed, and record the result in the SoA.
You may exclude an Annex A control if you can justify the exclusion, and you may add controls from any other source. Pages that present data masking, web filtering or threat intelligence as "ISO 27001 requirements" are describing individual Annex A controls that an organization selects, not obligations that apply to everyone.
What ISO 27001 is not
It is not proof that you are secure. Certification confirms that a management system conformed to the standard, within the declared scope, as judged at the audit. Certified companies still have breaches.
It is not a law, and it is not a legal defense. No US federal statute requires it. For HIPAA, the Department of Health and Human Services says outright that it does not endorse or recognize any private certification for the Security Rule, and that a certification does not stop it from later finding a violation.
A certificate can help you show due diligence. It does not replace the legal obligation.
It is not SOC 2. A SOC 2 report is an attestation report issued by a CPA firm under standards set by the AICPA. ISO 27001 certification is a certificate issued by an accredited certification body against a management system standard.
US buyers ask for SOC 2 more often; buyers elsewhere ask for ISO 27001 more often; many companies hold both.
It is not a credential for a person. Lead auditor and lead implementer courses train people. Only organizations are certified, and only organizations appear on a certificate.
It is not a product certification. It covers how an organization manages information security, not whether a particular piece of software is secure.
It is not "accreditation." Organizations are certified. Certification bodies are accredited. The two words get swapped constantly, including by people selling the service.
How certification works end to end
Certification bodies must follow ISO/IEC 17021-1, the rules for certifying any management system, plus ISO/IEC 27006-1:2024, the extra rules for information security. Those two standards fix the sequence, so it is the same whichever body you choose.
| Step | What happens | Who |
|---|---|---|
| Application and audit time | You describe your scope, sites and the number of people doing work in scope. The certification body calculates audit days from the tables in ISO/IEC 27006-1 (Annex C). | You and the certification body |
| Stage 1 | A review of your documentation and readiness: scope, policy, risk assessment, SoA, internal audit and management review. The findings tell you whether stage 2 makes sense yet. | Certification body auditors |
| Stage 2 | An audit of implementation and effectiveness against every clause and every control marked applicable in your SoA, on site or partly remote. | Certification body auditors |
| Nonconformities | A major nonconformity affects the system's ability to achieve its intended results; a minor one does not. Every major must be corrected and the correction verified before a decision. For minors an accepted plan is enough. | You, then the certification body |
| Decision | Someone who was not on the audit team decides. The three-year cycle starts on the decision date. | The certification body's decision maker |
| Years 1 and 2 | Surveillance audits covering internal audit, management review, action on earlier findings, complaints, changes and your use of the certificate mark. | Certification body auditors |
| Year 3 | A recertification audit before the expiry date. The new certificate keeps the original expiry rhythm. If work slips past expiry, certification can be restored within six months once it is finished. | Certification body |
| Suspension and withdrawal | Persistent or serious failure, or refusing surveillance, leads to suspension, during which the certificate is temporarily invalid, then to withdrawal or a reduced scope if it is not fixed. | Certification body |
You can move to a different certification body in the middle of a cycle. Under the accreditation rules only a valid, accredited certificate can be transferred, a suspended one cannot, and the new body runs a pre-transfer review and then continues the existing cycle. A certificate from an unaccredited body is treated as if you were a new client.
Independence is written into the rules. A certification body, and anything under its control, may not offer consultancy on the management systems it certifies, may not certify a system on which a related body gave consultancy until at least two years after that consultancy ended, and may not market itself as linked with any consultancy.
Your consultant cannot be your auditor, and an auditor who offers to help you fix the findings is breaking the rules that keep the certificate worth something.
A worked example
Take an illustrative company: 40 people, selling a scheduling app to clinics, hosted on a public cloud, with two large customers asking for ISO 27001 in their next renewal. It is a made-up business, but the sequence is the ordinary one.
The first decision is scope. Certifying only the product team would be quicker, but the customers' data is touched by support, sales and finance too, so the company scopes the whole business and all systems that hold customer data.
It writes down the issues that shape its security (a small team, one cloud provider, health customers, state privacy laws) and the parties with requirements of it (customers, the cloud provider, regulators, staff), and notes that climate change is not a relevant issue for this system and why.
The risk assessment identifies about 60 risks, each with an owner. Most are treated by controls, a few are accepted with a signed-off reason. The SoA marks 88 Annex A controls as applicable and excludes five, each with a written justification, for example controls about physical cabling in premises the company does not own.
Policies, an asset list, access reviews, supplier rules, backups, logging and an incident process follow, then staff training, an internal audit by someone who did not build the system, and a management review.
At stage 1 the auditor finds that the internal audit never covered the risk assessment process itself. The company fixes that before stage 2.
At stage 2 the auditor raises one major nonconformity (the supplier register contains no security requirements for the cloud host, and nobody has reviewed the host's own certificate) and two minors (one system has never had an access review; backups have never been restored as a test). The company fixes the major, sends evidence, and the certification body verifies it.
The minors get an accepted plan. A decision maker who was not on the audit issues the certificate. Twelve months later the surveillance audit checks that the plan was carried out and that the internal audit and management review happened again.
Who does what
Four separate parties keep the system honest, and each one can be checked.
| Role | Who | What they do |
|---|---|---|
| Writes the standard | ISO/IEC JTC 1/SC 27, the joint ISO and IEC subcommittee for information security | Develops and revises ISO/IEC 27001, 27002, 27006-1, 27701 and the rest of the 27000 family. ISO publishes and sells the text. ISO certifies nobody. |
| Implements | You, with or without a consultant | Builds and runs the management system. A consultant may help with all of it but can never certify it. |
| Certifies | An accredited certification body (also called a registrar) | Audits to ISO/IEC 17021-1 and 27006-1, then issues, maintains, suspends or withdraws the certificate. |
| Accredits the certifier | A national accreditation body: ANAB in the US, UKAS in the UK, DAkkS in Germany, and their peers | Assesses the certification body's competence and impartiality, witnesses its audits and lists it in a public directory. |
| Recognizes accreditation bodies worldwide | Global Accreditation Cooperation Incorporated (Global ACI) | Peer-evaluates accreditation bodies. Its Multilateral Recognition Arrangement makes an accredited certificate from one country acceptable in another. Global ACI replaced the IAF and ILAC on January 1, 2026; it lists 129 recognized accreditation bodies, and IAF marks stay valid during the changeover. |
| Holds the public register | IAF CertSearch | The database of accredited management system certificates, and since 2025 the source of the ISO Survey. |
Nothing stops an unaccredited body from printing a certificate. Such a certificate sits outside the recognition arrangement, cannot be transferred to an accredited body, and is not what a buyer's procurement clause usually means.
ISO's own page says a certificate from an accredited body brings an additional layer of confidence, and asks that certification be referred to by its full reference, "certified to ISO/IEC 27001:2022."
How to read and verify a certificate
The certification rules (ISO/IEC 17021-1, clause 8.2) fix what a certificate must show: the certified organization and the location of every site covered, the date certification was granted, the expiry or recertification date, a unique certificate number, the standard with its edition, the scope of certification, and the certification body's name and mark, usually with the accreditation body's symbol beside it.
Read it in this order. First the edition: it must say ISO/IEC 27001:2022. Second the scope and the sites: check that the service you buy and the location that delivers it are inside the words on the certificate, because anything outside them is not certified.
Third the dates, and ask when the last surveillance audit took place, since a certificate within its three years but with a missed surveillance may already be suspended. Fourth, ask which version of the Statement of Applicability was in force at the last audit, so you know which controls were in play.
Then verify it. Look the certificate up on IAF CertSearch or on the certification body's own public register, and confirm the certification body appears in its accreditation body's directory and that the accreditation body is a Global ACI signatory.
A certificate that carries no accreditation symbol, or names a body you cannot find in any of those places, should be treated as a claim rather than evidence.
What it costs and how long it takes
The text of the standard costs CHF 155 on the ISO store (published), and Amendment 1 is free there. ISO's practical guide for small and medium businesses is CHF 44 (published). ISO/IEC 27006-1, which most organizations never need, is CHF 196 (published).
Copies of the standard circulating free on the web are unlicensed.
There is no published tariff for certification. ISO, Global ACI and the accreditation bodies set no certification fees, and every certification body quotes.
What they must quote from is audit time, which ISO/IEC 27006-1 makes them calculate from the number of people doing work inside the scope (with rules for people doing identical work), the number of sites and the complexity of the system, with extra time for scope extensions.
Headcount and site count drive the quote more than anything else, and you can ask a certification body to show its audit-time calculation. Consultants and software are separate costs that nothing regulates. Quote only, in every case.
On time, the standard sets no minimum implementation period and no waiting time before an audit. The only fixed durations are the three-year certificate, surveillance in each of the first two years, and the six-month window to restore a lapsed certificate.
Treat pages that give you months and dollars with care: the ones we reviewed cite no source, and their figures differ several-fold.
What changed in 2025 and 2026
The transition from the 2013 edition ended on October 31, 2025. Under IAF MD 26, certification bodies had to audit new and recertifying clients to the 2022 edition from April 30, 2024, and every remaining 2013 certificate expired or was withdrawn at the deadline.
Certification bodies themselves moved to ISO/IEC 27006-1:2024, published in March 2024, with all transitions complete by March 31, 2026 under IAF MD 29. The new edition refines the rules for remote audits, changes the audit-time calculation, drops the old fixed experience requirement for auditors and realigns its control guidance with the 2022 Annex A.
On January 1, 2026 the International Accreditation Forum and the International Laboratory Accreditation Cooperation were replaced by a single body, Global Accreditation Cooperation Incorporated, with one recognition arrangement. Existing accreditations and the IAF mark continue to be recognized during the changeover, so nothing on a valid certificate changed.
The ISO Survey 2024, published in 2025, counted 96,709 ISO/IEC 27001 certificates covering 179,877 sites worldwide, 4,260 of them in the United States and 4,455 in the United Kingdom.
The SC 27 Journal gives the 2023 figure as 47,291 (other summaries of the same survey give 48,671), and because ISO now compiles the survey from IAF CertSearch, the Journal cautions that part of the jump likely reflects better coverage rather than new certifications. The dataset is downloaded from CertSearch after a free login.
In October 2025 ISO published ISO/IEC 27701:2025, the second edition of the privacy information management standard, which now stands on its own rather than only as an extension to ISO/IEC 27001.
In July 2026 ISO published ISO/IEC 27000:2026, the sixth edition of the overview document named in ISO/IEC 27001's normative references; ISO says the new edition focuses on concepts and relationships rather than serving as a terminology document. As of September 27, 2026 ISO lists ISO/IEC 27001:2022 and its amendment as published with no revision under way.
Where it leads next
Once the certificate exists, the work is keeping it: an internal audit and a management review every year, the risk assessment repeated when the business changes, findings closed, and the surveillance audit passed. Most organizations find the second year easier than the first because the records already exist.
The same management system can carry other standards. ISO/IEC 27701:2025 adds privacy management for organizations that control or process personal data. Companies selling into the United States often run a SOC 2 examination alongside, using the same controls and evidence for both.
Buyers who need to compare the two will find them described on their own pages here.
If you are choosing who to work with, the consultant and the certification body must be different organizations, and the certification body must hold accreditation for ISO/IEC 27001 from a recognized accreditation body. Both lists are on this site.
What we could not verify
We read the ISO preview of ISO/IEC 27001:2022, which covers the contents page, the introduction and the requirements up to the start of risk treatment (clauses 4 to 6.1.2), not the full text, so the risk treatment requirement (6.1.3) and Annex A are described from the ISO/IEC 27002:2022 contents page, IAF MD 26 and the ISO/IAF communiqué.
The exact wording of Amendment 1 comes from that communiqué of February 22, 2024, not from the amendment itself, which ISO's browsing platform shows only after accepting its terms.
We did not open Annex B of ISO/IEC 27002:2022, the table that maps old controls to new, so we do not list the 11 new controls by number. The ISO Survey 2024 figures come from the ISO/IEC JTC 1/SC 27 Journal 2026 Issue 1, which quotes the survey; the dataset itself sits behind a CertSearch login.
We did not read the clause of ISO/IEC 27006-1 that says what an information security certificate must state beyond the general rule in ISO/IEC 17021-1, so the advice to ask for the SoA version is practical rather than a rule we can cite.
UKAS told its certification bodies to finish the ISO/IEC 27006-1 transition by July 31, 2025, earlier than the IAF deadline; other accreditation bodies may have set their own dates.
Need a hand implementing it?
Find a consultant for ISO 27001
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
What people ask.
Is ISO 27001 mandatory?
No. It is a voluntary standard. Customers, tenders and some sector schemes require it by contract, which is why most organizations pursue it, but no US federal law does. Where a regulator asks for "appropriate" security, a certified system can help you show what you did, without replacing the legal duty.
How long does an ISO 27001 certificate last?
Three years from the certification decision, on condition that you pass a surveillance audit in each of the first two years and a recertification audit before the expiry date. Miss a surveillance and the certificate can be suspended, which makes it temporarily invalid.
Can our consultant also certify us?
No. The certification rules forbid a certification body from consulting on the systems it certifies, and from certifying a system on which a related body consulted until at least two years after that work ended. The consultant and the certification body must be independent organizations.
Does ISO 27001 make us HIPAA compliant?
No. HHS states that it does not endorse or recognize any private certification for the HIPAA Security Rule and that holding one does not prevent a finding of violation. ISO 27001 can organize the work HIPAA requires, but the legal obligation stays with you.
What is the difference between ISO 27001 and SOC 2?
ISO 27001 ends in a certificate issued by an accredited certification body against an international management system standard. SOC 2 ends in an attestation report from a CPA firm under AICPA standards. US buyers ask for SOC 2 more often, buyers elsewhere for ISO 27001, and many companies hold both using the same underlying controls.
What is the Statement of Applicability?
A document that lists all 93 Annex A controls, states whether each one applies to you, and justifies every inclusion and exclusion, linked back to your risk assessment. It is the map an auditor uses to decide what to test.
Is a certificate to ISO 27001:2013 still valid?
No. The accreditation rules required every 2013 certificate to expire or be withdrawn by October 31, 2025. If a supplier shows you a 2013 certificate, ask for its current 2022 certificate and look that up.
How do I check a supplier's certificate?
Read the edition, scope, sites and dates on the certificate, then look it up on IAF CertSearch or the certification body's public register, and confirm the certification body is accredited by a body that Global ACI recognizes. Ask when the last surveillance audit was.
What each one is doing here.
ISO: ISO/IEC 27001:2022 standard page (edition 3, October 2022, 19 pages, CHF 155, one amendment, lifecycle stage 60.60)ISO: ISO/IEC 27001:2022/Amd 1:2024 Climate action changesISO and IAF: Joint communiqué on the addition of climate change considerations to management system standards, February 22, 2024ISO: preview of ISO/IEC 27001:2022 (contents, foreword, introduction, clauses 1 to 6.1.2)IAF MD 26:2023 Issue 2, Transition requirements for ISO/IEC 27001:2022ISO: preview of ISO/IEC 27002:2022 (contents page)ISO: ISO/IEC 27002:2022 standard pageISO: ISO/IEC 17021-1:2015 standard pageISO: preview of ISO/IEC 17021-1:2015 (clauses 1 to 5)SADCAS (accreditation body): checklist reproducing the requirements of ISO/IEC 17021-1:2015, Issue 5ISO: ISO/IEC 27006-1:2024 standard pageISO: preview of ISO/IEC 27006-1:2024 (contents page)IAF MD 29:2024, Transition requirements for ISO/IEC 27006-1:2024UKAS technical bulletin: transition to ISO/IEC 27006-1:2024IAF MD 2:2023 Issue 2, Transfer of accredited certification of management systemsIAF: notice that IAF ceased operations on January 1, 2026 and news release on the launch of Global Accreditation Cooperation IncorporatedGlobal ACI: recognized accreditation bodiesISO: The ISO SurveyISO/IEC JTC 1/SC 27 Journal 2026 Issue 1, ISO/IEC 27001 certificationIAF CertSearchANAB: management systems accreditation and directory of accredited organizationsISO: ISO/IEC 27701:2025 standard pageISO: ISO/IEC 27000:2026 standard pageISO: ISO/IEC 27001:2022, a practical guide for SMEs (PUB100484)HHS: Are we required to certify our organization's compliance with the standards of the Security Rule?AICPA: System and Organization Controls (SOC) suite of services