ISO 27001 compliance, certify your ISMS with less effort
Scope the ISMS, choose your Annex A controls, and keep evidence current between surveillance audits.
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS). Certification needs a risk-based ISMS, a Statement of Applicability covering the 93 Annex A controls, internal audits and management review, verified by an accredited certification body in a two-stage audit. ComplyEasyAI maps your environment to each clause and control.
TL;DR
- Current edition: ISO/IEC 27001:2022, with Amendment 1:2024 on climate change.
- Annex A has 93 controls in four themes: organizational, people, physical and technological.
- Certificates last three years, with surveillance audits in between.
- The transition from the 2013 edition ended on 31 October 2025.
Reviewed by the ComplyEasyAI compliance teamLast reviewed
Sources: ISO, ISO/IEC 27001:2022
What does ISO 27001 require?
The requirements below define ISO 27001. ComplyEasyAI maps your environment to each one.
ISMS scope & context
Define the boundaries, interested parties and objectives of your management system.
Risk assessment & treatment
Identify, analyze and treat information-security risks systematically.
Statement of Applicability
Document which Annex A controls apply and justify any exclusions.
Annex A controls
Implement the selected controls from the 93 in the 2022 revision.
Management review & audit
Run internal audits and management reviews to drive continual improvement.
How do you prepare for ISO 27001?
Scope
Define the systems, boundaries and requirements your program will cover.
Connect your stack
Link cloud, identity, code and ticketing systems, read-only for evidence collection; controls are discovered and mapped.
Collect evidence
AI agents gather configuration and activity evidence on a schedule, building a versioned trail.
Monitor & remediate
Continuous monitoring flags drift the moment it happens and routes it to an owner.
Track effectiveness
Operating effectiveness is recorded over time, ready for your observation window.
Report & hand off
Organized, current evidence is packaged for auditors and stakeholders.
How does ComplyEasyAI automate ISO 27001 compliance?
Control mapping
Your environment is mapped to each requirement, so you see exactly which control satisfies what.
Automated evidence
Integrations build a versioned, timestamped evidence trail instead of manual screenshots.
Continuous monitoring
Drift surfaces as soon as it happens, not during fieldwork.
Readiness dashboards
Real-time views highlight failing or unmapped controls with owners attached.
Multi-framework reuse
Shared controls are mapped once and reused across every framework you run.
Audit-ready reporting
Export organized, current evidence packages on demand.
Which frameworks are related to ISO 27001?
ISO 27001 FAQ
Is ISO 27001 a certification?
Yes. Unlike SOC 2, ISO 27001 results in a certificate issued by an accredited certification body after a two-stage audit of your ISMS.
What changed in the 2022 revision?
Annex A went from 114 controls in 14 domains to 93 controls in four themes, including 11 new controls such as threat intelligence, information security for cloud services and data leakage prevention. Amendment 1:2024 added climate-change considerations to the context clauses.
Is a certificate to the 2013 edition still valid?
No. The transition period ended on 31 October 2025, so organizations now need a certificate to ISO/IEC 27001:2022.
How does it relate to SOC 2?
The two overlap heavily. A shared control library means work done for one accelerates the other.
How long does certification take?
It depends on maturity. You need an operating ISMS, with internal audit and management review completed, before the Stage 2 audit. Automating evidence and the Statement of Applicability removes much of the preparation.
Start your ISO 27001 program.
Map the requirements, automate the evidence, stay audit-ready.