ISO/IEC 27001

What is ISO/IEC 27001?

ISO/IEC 27001 is the international standard that specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system, usually shortened to ISMS. It is a management standard, not a technical one: it tells an organisation how to run security as a repeatable process with risk assessment, selected controls, measurement, internal audits and management reviews.

The current edition is ISO/IEC 27001:2022. Clauses 4 to 10 hold the mandatory requirements: context of the organisation, leadership, planning (including risk assessment and risk treatment), support, operation, performance evaluation and improvement. Annex A lists 93 reference controls in four themes: organisational, people, physical and technological. Which controls apply is decided in the Statement of Applicability, which has to justify every inclusion and every exclusion.

Certification is optional. An accredited certification body audits the ISMS in two stages and issues a certificate valid for three years with annual surveillance audits. ISO itself certifies nobody, and neither does Zyberum; the certificate comes from a certification body.

Where is it defined?

ISO/IEC 27001:2022 is published jointly by ISO and IEC through their Joint Technical Committee 1, subcommittee 27. The companion standard ISO/IEC 27002:2022 explains each Annex A control and how to implement it. ISO/IEC 27005 covers information security risk management. Sector extensions exist, for example ISO/IEC 27019 for the energy industry and ISO/IEC 27701 for privacy.

The 2022 edition replaced the 2013 edition; certificates to the old edition could not be maintained after the end of the transition period on 31 October 2025. In Germany the BSI offers a second route to the same certificate: ISO 27001 certification on the basis of IT-Grundschutz, which uses the IT-Grundschutz methodology to meet the standard’s requirements.

What it means in practice

For a security team the standard matters in two places: the controls it expects and the evidence auditors ask for. The controls most relevant to testing are 8.8 (management of technical vulnerabilities), 8.29 (security testing in development and acceptance), 8.9 (configuration management), 8.16 (monitoring activities), 8.28 (secure coding) and 5.7 (threat intelligence, new in 2022). Clause 9.1 then asks how you know those controls are effective. The honest answer is usually a penetration test, a vulnerability management process with measurable patch times, and logs that someone actually reads.

Three patterns we see when organisations prepare for or hold a certificate:

• The scope ends at the office network. Production systems, OT, the product itself or the cloud environment are excluded from the ISMS scope, and the certificate says so in small print that customers rarely read.
• Controls exist on paper. The vulnerability management policy says 30 days for critical patches; the pentest finds a web server with a two-year-old version. Auditors sample, testers measure.
• Risk assessment without attackers. The risk register lists “malware” and “data loss” but not the concrete paths an attacker would take through the environment. A test report turns those into risks with owners and dates.

Zyberum runs gap analyses against ISO/IEC 27001, penetration tests as control evidence, and the technical parts of the implementation. We do not audit for certification.

Common misunderstandings

A certificate means the management system meets the standard, not that the systems in scope are free of vulnerabilities. ISO/IEC 27001 covers an organisation, not a product: product security is the domain of the Cyber Resilience Act, IEC 62443-4-1 and 4-2 for industrial components, and ISO/SAE 21434 for vehicles. The Annex A controls are not individually mandatory; what is mandatory is deciding about each one in the Statement of Applicability and being able to defend the decision.