ISO/IEC 27001:2022

ISO 27001 certification, led by security practitioners.

Cybergen takes you from first gap analysis to a certificate from an accredited certification body. We build an information security management system (ISMS) that fits how you work, put the right Annex A controls in place and back them with the testing, monitoring and response we deliver every day.

Book a free ISO 27001 call Check your readiness

Illustrative example only, not live data

ISO 27001ISO/IEC 27001:202293 Annex A controlsGap analysisRisk assessmentInternal auditCertification support

What is ISO 27001?

The world's leading standard for information security management

ISO 27001 (formally ISO/IEC 27001) is the international standard that sets out the requirements for an information security management system, or ISMS. It gives organisations a risk-based way to protect the confidentiality, integrity and availability of their information, and it is the standard organisations are independently certified against.

An ISMS is not a piece of software. It is the policies, processes, people and technology you use to find information security risks, decide how to treat them and prove that your controls work. ISO 27001 is published jointly by ISO and the IEC, and the current edition is ISO/IEC 27001:2022.

Risk-based: you choose the controls that match your real risks
Covers people, processes, physical security and technology
Built for continual improvement, not a one-off audit

ISO 27001 at a glance

Full title: ISO/IEC 27001:2022 Information security, cyber security and privacy protection. Information security management systems. Requirements
Edition: 2022, with Amendment 1:2024 (climate action changes)
Annex A: 93 controls in four themes
Certificate: Valid for three years, with annual surveillance audits
Issued by: An independent, accredited certification body
Adoption: 96,709 valid certificates worldwide
Old edition: ISO 27001:2013 certificates expired on 31 October 2025

Certificate count: ISO Survey 2024

Why get certified

Why organisations choose ISO 27001 certification

Customers, regulators and investors increasingly expect proof, not promises. A certificate is independent evidence that you manage information security properly.

96,709

valid ISO 27001 certificates worldwide in 2024

Annex A controls in the 2022 edition of the standard

year certificate cycle, with surveillance audits every year

Source: ISO Survey 2024

Win bigger contracts

Enterprise and public sector buyers often ask for ISO 27001 in tenders and supplier due diligence. A certificate gets you through the door.

Answer questionnaires faster

Replace long security questionnaires with a certificate and Statement of Applicability that customers already trust.

Reduce the risk of a breach

A working ISMS finds and treats risks before attackers do, and makes incidents smaller when they happen.

Support regulatory compliance

ISO 27001 gives you a strong foundation for GDPR, NIS2, DORA and the Cyber Security and Resilience Bill.

Build investor confidence

Certification shows due diligence teams and partners that security risk is under control.

Make security a business process

Clear owners, objectives and reporting give leadership real visibility of security, not just IT.

ISO 27001 requirements

What the standard actually requires

Clauses 4 to 10 are mandatory for certification. They follow the Plan-Do-Check-Act cycle used across ISO management system standards, so ISO 27001 fits neatly alongside ISO 22301, ISO 9001 and ISO 42001.

4Clause 4 · Plan

Context of the organisation

Understand internal and external issues and interested parties, and define the scope of your ISMS.

5Clause 5 · Plan

Leadership

Top management commitment, an information security policy and clear roles, responsibilities and authorities.

6Clause 6 · Plan

Planning

Information security risk assessment and treatment, the Statement of Applicability and measurable objectives.

7Clause 7 · Plan

Support

Resources, competence, awareness, communication and control of documented information.

8Clause 8 · Do

Operation

Carry out risk assessments and the risk treatment plan, and control processes and changes that affect security.

9Clause 9 · Check

Performance evaluation

Monitoring and measurement, internal audit and management review.

10Clause 10 · Act

Improvement

Manage nonconformities, take corrective action and continually improve the ISMS.

Plan · Do · Check · Act

One cycle that keeps your ISMS improving year after year.

Annex A is not a checklist

Controls are selected through your risk assessment. Every decision, including exclusions, is justified in the Statement of Applicability.

Documented information

Auditors expect a defined set of documents and records, such as the scope, policy, risk assessment results and evidence that controls operate.

You choose the scope

Certify the whole organisation or a defined part, such as one product, service or site. A sensible scope speeds up certification.

ISO 27001 Annex A controls

93 controls in four themes

Annex A of ISO 27001:2022 lists 93 reference controls, reorganised from the 114 controls in 14 domains of the 2013 edition. You select the controls that treat your risks and record the decision for each one in your Statement of Applicability.

ISO/IEC 27002:2022 gives detailed guidance on each control. Many organisations also use control attributes, such as preventive, detective or corrective, to map controls to frameworks like NIST and to their own risk register.

The 11 new controls in ISO 27001:2022, and how we help you meet them

These controls are where many organisations find gaps. Because Cybergen delivers these services, we can help you implement and evidence them, not just document them.

CONTROL 5.7Threat intelligence

Collect and analyse information about threats so you can act on it.

Threat intelligence CONTROL 5.23Information security for use of cloud services

Manage security across buying, using and exiting cloud services.

Cloud posture management CONTROL 5.30ICT readiness for business continuity

Make sure technology can be recovered in line with business continuity needs.

ISO 22301 business continuity CONTROL 7.4Physical security monitoring

Monitor premises continuously to detect unauthorised physical access.

Risk and maturity assessment CONTROL 8.9Configuration management

Define, record and enforce secure configurations for hardware, software and networks.

Vulnerability management CONTROL 8.10Information deletion

Delete information when it is no longer needed, on every system and device.

Data loss prevention CONTROL 8.11Data masking

Mask personal and sensitive data in line with policy and legal requirements.

Thales data protection CONTROL 8.12Data leakage prevention

Detect and stop sensitive information leaving through email, web, cloud and devices.

Data loss prevention CONTROL 8.16Monitoring activities

Monitor networks, systems and applications for anomalous behaviour and respond.

24x7x365 MDR CONTROL 8.23Web filtering

Control access to external websites to reduce exposure to malicious content.

iboss secure web gateway CONTROL 8.28Secure coding

Apply secure coding principles throughout software development.

DevSecOps & code security ALL 93 CONTROLSSee where you stand on every control

Our gap analysis scores you against every Annex A control and every clause.

Book a gap analysis

How to get ISO 27001 certified

Your path to certification, step by step

Cybergen prepares and supports you at every stage. An independent, accredited certification body carries out the audit and issues your certificate.

01Gap analysis

Scoping workshop
Benchmark against clauses 4 to 10 and Annex A
Prioritised roadmap and fixed quote

02Risk assessment

Assets, threats and vulnerabilities
Risk treatment plan
Statement of Applicability

03Build the ISMS

Policies and procedures
Control implementation
Evidence and records

04Operate and prove

Awareness training
Internal audit
Management review

05Certification audit

Stage 1: documentation and readiness
Stage 2: implementation audit
Close any nonconformities

06Stay certified

Annual surveillance audits
Continual improvement
Recertification in year three

Stage 1 audit

The certification body reviews your documentation, scope and readiness, and confirms you are ready for Stage 2.

Stage 2 audit

Auditors test that your controls work in practice, using interviews, observation and evidence.

Choose an accredited body

Use a certification body accredited by UKAS in the UK, or by an IAF member elsewhere, so your certificate is widely recognised.

Timescales and cost

How long does ISO 27001 take, and what does it cost?

The two questions every board asks first. Here are honest answers.

How long does ISO 27001 take?

Most organisations take between three and twelve months to reach certification. A smaller business with well-run IT can move quickly. A larger organisation with several sites, legacy systems or little existing documentation will take longer.

Your ISMS also needs to run long enough to produce evidence, including at least one internal audit and a management review, before the Stage 2 audit.

Scope: the people, sites and services covered
Existing controls and documentation
How quickly decisions are made internally
Certification body availability for audit dates

How much does ISO 27001 cost?

The total cost has three parts: preparing for certification, the certification body's audit fees and your own team's time. Audit fees depend mainly on the number of people in scope, and apply to the initial audit, each surveillance audit and recertification.

We give you a fixed quote after the gap analysis, so you know the full cost before you commit.

Consultancy for gap analysis, implementation and internal audit
Certification body fees for Stage 1, Stage 2 and surveillance
Any technical controls you still need to put in place
Optional compliance automation with Vanta or Drata

ISO 27001 compared

ISO 27001 vs SOC 2, Cyber Essentials, NIS2 and DORA

They are often confused, and many organisations need more than one. The good news: they overlap heavily, so you can build controls once and map them to each framework.

Compare	ISO 27001	SOC 2	Cyber Essentials Plus	NIS2 and DORA
What it is	International standard for an information security management system	Attestation report on controls, based on the AICPA Trust Services Criteria	Government-backed scheme covering five technical controls	EU laws placing cyber security and resilience duties on in-scope organisations
Outcome	Certificate from an accredited certification body	Auditor's report (Type 1 or Type 2) from a licensed CPA firm	Certificate after a hands-on technical audit	Regulatory compliance, supervised by national authorities
Coverage	Governance, risk, people, physical security and technology	Controls relevant to the services you provide to customers	Internet-connected devices, software and user accounts	Risk management, incident reporting, supply chain, testing and governance
Best for	Organisations selling worldwide, to enterprises or to the public sector	Technology and SaaS companies selling into North America	Organisations bidding for UK government contracts	Regulated EU sectors and financial services
Validity	Three years, with annual surveillance audits	Usually renewed every year	12 months	An ongoing legal obligation
Learn more	You are on the right page	SOC 2 with Vanta	Cyber Essentials Plus	NIS2 and DORA

How we help

ISO 27001 support at the level you need

A quick health check, a full implementation or someone to run your ISMS for you. Every engagement starts with a fixed quote.

ASSESS

Know where you stand

Discovery workshop and scope
Gap analysis against clauses 4 to 10 and Annex A
Prioritised roadmap with timescales
Pre-certification readiness review

Discuss a gap analysis

IMPLEMENT

Get certified with us

Everything in Assess
Risk assessment and Statement of Applicability
Policies, procedures and control implementation
Awareness training and internal audit
Support through Stage 1 and Stage 2 audits

Discuss implementation

MAINTAIN

Stay certified

We run your ISMS for you
Scheduled independent internal audits
Management review support
Surveillance and recertification preparation

Discuss a managed ISMS

Why Cybergen

We don't just write the policies. We prove the controls work.

Many ISO consultants hand you documents and leave. Cybergen is a cyber security company, so we can also deliver and evidence many of the controls your auditor will test.

A.8.8Penetration testing

CREST-certified testing that evidences how you manage technical vulnerabilities.

Explore A.8.15 · A.8.1624x7x365 monitoring

Logging and monitoring around the clock, with analysts who respond to what they find.

Explore A.5.24 to A.5.28Incident response

Plans, playbooks and an emergency response team, so incident controls are real.

Explore A.6.3Awareness and phishing

Security awareness training and phishing simulations with reporting auditors accept.

Explore A.5.19 to A.5.22Supplier security

Assess and monitor the suppliers your ISMS depends on.

Explore A.5.29 · A.5.30Business continuity

Continuity and ICT readiness built to ISO 22301, the business continuity standard.

Explore

Part of Cybergen ISO Consultancy

One partner for every ISO standard you need

ISO 27001 is delivered by our ISO Consultancy team, alongside ISO 22301 for business continuity, ISO 27701 for privacy, ISO 42001 for AI and ISO 9001 for quality. Run several standards as one integrated management system, with shared policies, risk assessments, internal audits and management reviews.

Explore ISO Consultancy

ISO 27001You are here ISO 22301Business continuity management ISO 42001AI management systems Internal auditsIndependent ISO internal auditing

Guides and insights

Learn more about ISO 27001

ISO 27001 FAQ

Your questions, answered

Can't see your question? Ask our team.

What is ISO 27001?

ISO 27001 (ISO/IEC 27001) is the international standard for information security management. It sets out the requirements for an information security management system (ISMS) that identifies risks, applies controls to treat them and continually improves. Organisations can be independently certified against it.

Is ISO 27001 mandatory?

No. ISO 27001 is voluntary, but customers, tenders and supplier due diligence increasingly require it. It also helps you show you meet regulations such as GDPR, NIS2 and DORA, even though they do not require certification.

How long does ISO 27001 certification take?

Most organisations take between three and twelve months. It depends on your scope, your existing controls and documentation, and how quickly decisions are made. A gap analysis gives you a realistic timeline before you commit.

How much does ISO 27001 certification cost?

The cost depends on the number of people and sites in scope and how mature your security already is. It is made up of preparation and consultancy, the certification body's audit fees and your own team's time. Cybergen provides a fixed quote after the gap analysis.

What is the latest version of ISO 27001?

The current edition is ISO/IEC 27001:2022, with Amendment 1:2024 adding climate change considerations to clauses 4.1 and 4.2. The transition period for the 2013 edition ended on 31 October 2025, so certificates to the old edition are no longer valid.

How many controls are in ISO 27001?

Annex A of ISO 27001:2022 contains 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. You apply the controls that treat your risks and justify any exclusions in the Statement of Applicability.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 contains the requirements you can be certified against. ISO 27002 is a guidance standard that explains how to implement each of the Annex A controls.

What is a Statement of Applicability?

The Statement of Applicability (SoA) is a mandatory ISO 27001 document listing every Annex A control, whether it applies to you, why, and whether it has been implemented. Auditors use it as a map of your ISMS.

How long is an ISO 27001 certificate valid?

Three years. The certification body carries out surveillance audits in years one and two, then a recertification audit before the certificate expires.

Can a small business get ISO 27001 certified?

Yes. ISO 27001 scales to organisations of any size. A smaller business needs a proportionate ISMS, not a mountain of paperwork, and can often certify faster than a large one.

Does ISO 27001 require penetration testing?

The standard does not name penetration testing, but controls such as 8.8 (management of technical vulnerabilities) and 8.29 (security testing in development and acceptance) expect you to test your security. Penetration testing is one of the most common ways to evidence them.

What is the difference between ISO 27001 and SOC 2?

ISO 27001 is an international certification of your whole management system. SOC 2 is a US attestation report on specific controls, based on the AICPA Trust Services Criteria. Many technology companies selling worldwide hold both, and most controls overlap.

Does Cybergen issue the ISO 27001 certificate?

No. We prepare you for certification and support you through the audits. An independent, accredited certification body carries out the Stage 1 and Stage 2 audits and issues the certificate.