What is ISO 27001?

What does ISO 27001 protect?

Information is among the most valuable assets a business holds, and customers, partners and regulators look for strong assurance that it is handled with precision and care. A single breach of customer records, source code or financial data can end contracts that took years to win.

ISO/IEC 27001:2022 addresses this directly: it requires the organization to manage information security as a risk-driven management system, not as an antivirus installation or an annual IT checklist. Information security rests on three properties—confidentiality, integrity and availability. Customer records should reach only authorized people, business information should remain accurate, and essential information should be available when needed. These concerns apply to paper records, people and suppliers as well as IT systems.

For a small business, an ISMS turns scattered security decisions into an owned, repeatable process. It can help you respond to customer due diligence and demonstrate how you manage risk. Certification may support commercial trust, but it does not mean incidents cannot happen.

What is an ISMS?

An ISMS combines policies, responsibilities, risk assessments, controls and review activities within a defined scope. Leadership sets direction and resources; staff operate the processes; the organization evaluates results and improves them.

Start by defining the services, locations, information and dependencies your system covers. A cloud service provider might include its product operations and supporting teams. The scope must be meaningful and must account for relevant interfaces and dependencies—not simply exclude difficult risks.

ISO 27001 requirements, clause by clause

The certifiable requirements of ISO/IEC 27001:2022 sit in clauses 4 to 10. Clauses 1 to 3 set the scope, references and terms. Each clause below is reduced to what the organization is mandated to establish, do and keep evidence of.

• Clause 4 — Context of the organization: Determine internal and external issues, the needs of interested parties, and the scope of the ISMS. A software house, for example, would consider its clients' contractual security demands and its cloud dependencies before drawing the scope boundary.
• Clause 5 — Leadership: Top management must take accountability for the ISMS, establish an information security policy, and assign roles, responsibilities and authorities. Security direction comes from the top, not only from the IT administrator.
• Clause 6 — Planning: Establish the information security risk assessment and risk treatment processes, and set measurable security objectives. Risk owners must approve the treatment plan and accept residual risks.
• Clause 7 — Support: Provide resources, competent people, awareness, communication and controlled documented information. Staff must be aware of the policy and of what happens if they act outside it.
• Clause 8 — Operation: Carry out the risk assessment at planned intervals, implement the risk treatment plan, and keep documented information to the extent necessary to have confidence the processes ran as planned.
• Clause 9 — Performance evaluation: Monitor and measure the ISMS, conduct internal audits at planned intervals, and hold management reviews. Are the controls actually operating, or only written down?
• Clause 10 — Improvement: React to nonconformity, take corrective action to eliminate root causes, and continually improve the ISMS. Correction fixes the immediate issue; corrective action prevents recurrence—the two are not the same.

Risk assessment and risk treatment

Risk assessment is the engine of the ISMS. In the scope of clause 6.1.2, the organization identifies risks associated with the loss of confidentiality, integrity and availability, identifies the risk owners, and analyzes and evaluates those risks against defined criteria. The process must produce consistent, valid and comparable results—and be repeated at planned intervals and when significant changes occur.

Risk treatment, in the scope of clause 6.1.3, means selecting options to modify, retain, avoid or share each risk, choosing the controls needed, and comparing them against Annex A to verify that no necessary control has been missed. Consider a practical case: if developers access production data from personal laptops, is that risk assessed, and is the chosen control implemented—or merely assumed?

Annex A controls and the Statement of Applicability

ISO/IEC 27001:2022 Annex A contains 93 reference controls across four themes: organizational (37), people (8), physical (14) and technological (34). Controls are selected through risk treatment and applicable requirements; all 93 are not automatically mandatory, and necessary controls can also come from outside Annex A.

The Statement of Applicability (SoA) records the necessary controls, the reasons for including them, whether they are implemented, and the justification for excluding any Annex A control. It is one of the first documents a certification auditor will ask for. ISO/IEC 27002 provides implementation guidance for the controls; it is not the certification requirements standard.

How to implement ISO 27001, step by step

Implementation should fit your business rather than imitate a larger company's policy folder. A useful starting sequence is:

• 1. Agree the ISMS scope, stakeholders and relevant obligations.
• 2. Assign leadership responsibilities and assess current gaps.
• 3. Assess information security risks and approve a treatment plan.
• 4. Select controls, prepare the SoA and implement the safeguards.
• 5. Train staff and retain operational evidence.
• 6. Conduct an internal audit and management review; resolve findings.
• 7. If certification is your goal, arrange an independent certification audit.

How does ISO 27001 certification work?

An independent certification body evaluates the ISMS within its stated scope. An initial certification audit generally includes a Stage 1 assessment of readiness—scope, documentation and the SoA—and a Stage 2 assessment of implementation and effectiveness. Findings may require corrective action before a certification decision.

After certification, the system still needs to operate and improve. Surveillance and recertification assessments form part of the certification cycle. ISO itself does not certify organizations, and buying compliance software does not issue a certificate.

Timing and cost depend on scope, complexity, current maturity and audit arrangements. Treat promises of an automatic certificate or a universal implementation deadline cautiously.

What documentation should you prepare?

Mandatory documented information includes the ISMS scope (4.3), the information security policy (5.2), the risk assessment and treatment processes and results (6.1.2, 6.1.3, 8.2, 8.3), security objectives (6.2), evidence of competence (7.2), operational planning and control (8.1), monitoring and measurement results (9.1), internal audit evidence (9.2), management review results (9.3) and corrective-action evidence (10.1)—plus the Statement of Applicability.

The key distinction is between a document that describes an intention and evidence that shows the process happened. A supplier review procedure, for example, needs actual evaluation records—not just the procedure text.

The importance of a vigorous security culture

Treated as a paperwork exercise, ISO 27001 produces a policy folder that nobody opens between audits. Treated as an operating discipline, it becomes the way the organization protects its most valuable asset: every incident, near-miss and review feeds the next improvement.

Organizations that build a vigorous security culture answer customer due-diligence questionnaires in hours, not weeks, and win trust before the first meeting. Who would wish for more incidents, more questionnaires left unanswered and more deals lost at the security review?

How ComplyEncrypt helps with ISO 27001

ComplyEncrypt brings AI-assisted gap analysis, risk scoring, policy drafting and the Statement of Applicability into a guided workflow. Instead of starting from disconnected documents, your team works through requirements and reviews outputs against its real operations.

Our 90% automation claim refers to documentation only. Your organization remains responsible for implementing controls, validating risk decisions, gathering evidence and maintaining the ISMS. Certification is a separate assessment by a certification body.