What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). The current 2022 edition, amended in 2024, requires a risk assessment, a Statement of Applicability covering 93 Annex A controls, internal audits and management review. Accredited certification bodies certify organizations for three years, with annual surveillance audits in between.
TL;DR
- 93 Annex A controls in four themes.
- Certificates last three years, with annual surveillance audits.
- Certificates to the 2013 edition expired on 31 October 2025.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
How does ISO 27001 work in practice?
ISO/IEC 27001 provides a risk-based framework for managing information security. Rather than prescribing a fixed checklist, it requires an organization to identify its information security risks and select controls to treat them, drawing on the reference controls in Annex A.
Certification is granted by an accredited body following a two-stage audit and is maintained through periodic surveillance audits and a recertification cycle, typically every three years. Central to the standard is the Information Security Management System (ISMS) — the policies, procedures, and governance structure that operationalize security.
Many organizations pursue ISO 27001 alongside SOC 2 because the two share substantial control overlap. Cross-framework control mapping lets a single piece of evidence satisfy requirements in both, reducing duplicate work.
What else do people ask about ISO 27001?
What is a Statement of Applicability?
The document that lists which Annex A controls apply to your organization, whether they are implemented, and why any are excluded.
How does ISO 27001 differ from SOC 2?
ISO 27001 leads to a certificate for a management system; SOC 2 is an attestation report on controls. Their controls overlap heavily, so evidence can serve both.
Go deeper: ISO 27001 compliance guide
Which terms are related to ISO 27001?
- SOC 2SOC 2 is an AICPA attestation that reports how a service organization protects customer data against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. An independent CPA firm issues it, either as a Type I report on control design or a Type II report on operating effectiveness over a period, typically three to twelve months.
- Control MappingControl mapping links each internal control to every framework requirement it satisfies, so one piece of evidence can support several frameworks at once. For example, an access-review control can satisfy SOC 2 CC6, ISO 27001 Annex A 5.15 to 5.18, and HIPAA’s access-control safeguard. Adding a framework then means covering only the gaps.
- Risk RegisterA risk register is the central record of an organization’s identified risks. Each entry describes the risk, its likelihood and impact, the resulting rating, the owner, and the treatment decision: mitigate, transfer, accept or avoid. ISO 27001, the NIST AI RMF and most other frameworks expect one, kept current and linked to controls.
- Audit ReadinessAudit readiness is the state of having controls implemented, evidence current and known gaps fixed, so an organization can start an audit at any time without a last-minute scramble. It results from continuous monitoring and automated evidence collection, and it also speeds up customer security reviews and recertification.