ISO 27001 Requirements: The Complete Clause by Clause Guide and Checklist
Cybergen InsightsCREST-certified security team
|
|
12 min read
ISO 27001 is short. The requirements themselves run to a few pages, and most people read them in an afternoon. Yet organisations regularly spend months working out what those pages actually ask of them, which documents an auditor expects to see, and where the line sits between what is mandatory and what is simply good practice.
This guide is the version we wish every client had on day one. It walks through the ISO/IEC 27001:2022 requirements clause by clause, explains how Annex A fits in, lists the documents you must have, and ends with a readiness checklist you can work through with your team. If you would rather have experts take you from here to a certificate, our ISO 27001 certification and consultancy team does exactly that.
What ISO 27001 Actually Requires
ISO/IEC 27001 is the international standard for an information security management system, usually shortened to ISMS. An ISMS is not a piece of software. It is the set of policies, processes, roles and records an organisation uses to understand its information security risks, decide what to do about them and keep improving over time.
The current edition is ISO/IEC 27001:2022, published in October 2022. In February 2024 it was updated by a short amendment on climate action, so the full reference today is ISO/IEC 27001:2022/Amd 1:2024. Certificates issued against the older 2013 edition had to move to the 2022 version by 31 October 2025, so any certificate you rely on now should be to the 2022 edition.
The standard has two parts that matter for certification:
- Clauses 4 to 10 set out the management system requirements. Every one of them is mandatory. You cannot exclude a clause.
- Annex A lists 93 information security controls. You decide which ones apply to you based on your risk assessment, and you justify every decision in a document called the Statement of Applicability.
Clauses 0 to 3 are introduction, scope, normative references and terms. They help you read the standard but contain no requirements an auditor will test.
That split is the single most useful thing to understand. The clauses tell you how to run security as a managed, measurable system. Annex A is the menu of controls you pick from once you know your risks. Organisations that start with Annex A, treating it as a checklist, usually end up with a pile of policies and no working system behind them. Auditors spot that quickly.
The Clauses, One by One
Use the table below as a map. For each clause it shows what the standard asks for in plain English and what an auditor will typically ask to see.
| Clause | What it requires | What an auditor will look for |
|---|---|---|
| 4. Context of the organisation | Understand your internal and external issues, your interested parties and their requirements, and define the scope of the ISMS | A documented scope, a context analysis (including whether climate change is relevant) and a list of interested parties |
| 5. Leadership | Top management must lead the ISMS, set an information security policy and assign roles and responsibilities | An approved policy, named owners and evidence that leaders are genuinely involved, not just signing off |
| 6. Planning | Assess and treat information security risks, produce a Statement of Applicability, set objectives and plan changes | A risk assessment method, the risk register, a treatment plan, the SoA and measurable objectives |
| 7. Support | Provide resources, ensure competence and awareness, manage communication and control documented information | Training records, an awareness programme, a communication plan and version controlled documents |
| 8. Operation | Run the processes you planned, repeat risk assessments at planned intervals and carry out risk treatment | Evidence that controls operate in practice, updated risk assessments and records of changes |
| 9. Performance evaluation | Monitor and measure, run internal audits and hold management reviews | Metrics, an internal audit programme with reports, and minutes from management review meetings |
| 10. Improvement | Continually improve, and deal with nonconformities through corrective action | A nonconformity log, root cause analysis and evidence that corrective actions were closed |
Clause 4: Context and Scope
Everything starts with scope. Clause 4.3 asks you to decide which parts of the organisation, which locations, which systems and which services the ISMS covers. A tight, sensible scope is the biggest single lever you have on cost and timeline. A scope that is too narrow, though, may not satisfy the customers who asked you to get certified in the first place, so start by asking what they actually need to see on the certificate.
Clause 4.1 also now carries the climate amendment: you must determine whether climate change is a relevant issue for your ISMS. For most organisations this is a short, reasoned statement in the context analysis, for example noting the effect of flooding or extreme heat on data centres or offices. It does not need a sustainability programme.
Clause 5: Leadership
Auditors increasingly test leadership directly. Expect them to interview a director or senior manager and ask how information security objectives connect to business goals, what resources have been committed and what the last management review decided. If the only person who can answer questions about the ISMS is the person who wrote it, that is a finding waiting to happen.
Clause 6: Planning and Risk
Clause 6 is the engine of the standard. You need a documented risk assessment process that produces consistent, comparable results, a risk treatment process, and a Statement of Applicability that lists every Annex A control, says whether it applies, explains why and states whether it is implemented. Clause 6.2 adds measurable information security objectives, and clause 6.3, new in the 2022 edition, requires changes to the ISMS to be carried out in a planned way.
Clauses 7 and 8: Support and Operation
These clauses turn plans into practice. Clause 7 covers people (competence and awareness), communication and the control of documents and records. Clause 8 is where you prove that the processes you designed are running. The most common Stage 2 findings sit here: a policy that says access is reviewed quarterly with no record that any review ever happened, or a supplier process that exists on paper but has never been applied to a new supplier.
Clauses 9 and 10: Evaluation and Improvement
Before a certification body will grant a certificate, it will want to see at least one internal audit and at least one management review. Internal audits must be objective and impartial, so the person auditing should not be checking their own work. Many organisations bring in an external internal auditor for exactly this reason. Clause 10 then asks you to log nonconformities, find their root cause and fix them, and to show the ISMS is getting better over time.
How Annex A Fits In
Annex A in the 2022 edition contains 93 controls, down from 114 in the 2013 edition. Most of the reduction came from merging similar controls rather than removing them, and eleven controls are new, including threat intelligence, cloud security, data leakage prevention and secure coding.
93 controls in four themes
ISO/IEC 27002:2022 gives guidance on implementing each control. It is a companion standard, not a certification requirement.
You do not have to implement all 93. You do have to consider all 93, and every exclusion needs a reason that ties back to your risk assessment, your legal obligations or your contracts. "We do not do software development" is a sound reason to exclude secure coding. "It would take too long" is not.
We explain every control in plain English, with the eleven new ones highlighted, in our guide to ISO 27001 Annex A controls.
The Mandatory Documents
ISO 27001 does not dictate a fixed document set, but the clauses do name specific documented information you must keep. These are the ones auditors expect to find.
Documents you must maintain
Written down, approved and kept up to dateRecords you must retain
Evidence that the system is runningUsually needed for Annex A
Depending on which controls apply to youA word of caution about document templates. Templates are useful for structure, but an auditor will read your documents against how your organisation actually works. A policy copied from a template that describes processes you do not follow creates findings rather than preventing them. Fewer, shorter documents that are true are worth far more than a thick binder that is not.
How Certification Works
Certification is carried out by an independent certification body. In the UK, look for one accredited by UKAS. Elsewhere, look for accreditation by a national body that is a member of the International Accreditation Forum. Accreditation is what gives the certificate weight with customers and in tenders.
Stage 1 audit
- Mostly a document and design review
- Checks scope, risk assessment, SoA and readiness
- Confirms you are ready for Stage 2
Stage 2 audit
- Tests whether the ISMS works in practice
- Interviews staff and samples evidence
- Leads to the certification decision
The three year cycle
- Surveillance audits in years two and three
- Recertification audit before expiry
- Continual improvement throughout
Findings are graded. A major nonconformity, such as a required process that is missing entirely, must be fixed before a certificate can be issued. Minor nonconformities need a corrective action plan. Observations and opportunities for improvement are advice rather than failures.
The two questions every board asks next are how much this costs and how long it takes. We answer both in detail in how much ISO 27001 certification costs and how long ISO 27001 certification takes.
ISO 27001 Readiness Checklist
Work through this checklist with your team. It covers the things a certification body will check at Stage 1 and the evidence it will sample at Stage 2.
Are you ready for Stage 1?
Tick what your organisation already has. Nothing is sent or stored.
Common Mistakes to Avoid
After many ISO 27001 projects, the same problems come up again and again. Avoiding them saves months.
- Starting with policies instead of risk. Policies should answer the risks you found. Written first, they describe a business that does not exist.
- A scope that does not match what customers need. Agree the scope with the people asking for the certificate before you build anything.
- Treating the SoA as paperwork. It is the document auditors use to plan their sampling. Weak justifications lead straight to findings.
- No evidence of operation. A control that is designed but has no records will not pass Stage 2. Start collecting evidence early.
- Leadership in name only. If directors cannot speak to objectives and resources, expect a nonconformity against clause 5.
- An internal audit marking its own homework. Internal auditors need independence from the work they audit.
- Ignoring technical testing. Vulnerability management and security testing controls need real evidence. Our article on whether ISO 27001 requires penetration testing explains how testing supports certification.
ISO 27001 and Other Frameworks
ISO 27001 rarely lives alone. Many organisations already hold Cyber Essentials Plus, face customer demands for SOC 2 reports or fall under regulations such as NIS2 and DORA. A well built ISMS gives you the risk management, governance and evidence these frameworks expect, so work done once can be reused many times.
ISO 27001 also shares its high level structure with other management system standards. If resilience matters as much as security, ISO 22301 for business continuity fits alongside it, and organisations building or using AI can extend the same system with ISO 42001. Our ISO consultancy team runs integrated programmes that cover several standards with one set of processes.
How Cybergen Can Help
Cybergen takes organisations from first conversation to certificate, and stays with them through surveillance audits. Our ISO 27001 certification service includes:
- A gap analysis against every clause and all 93 Annex A controls, with a prioritised plan
- Scope definition and a risk assessment method that suits how your organisation works
- Policies, procedures and a Statement of Applicability written around your real processes
- Technical controls and evidence from our CREST-certified team, including penetration testing and vulnerability management
- Independent internal audits and support through Stage 1 and Stage 2
- Ongoing support as a virtual CISO so the ISMS keeps working after certification
If you want to know how close you are today, book a free ISO 27001 readiness call with our team.
This guide reflects ISO/IEC 27001:2022 including Amendment 1:2024, as of November 2026. Always work from your own licensed copy of the standard.
Frequently Asked Questions
What are the main requirements of ISO 27001?
The mandatory requirements are in clauses 4 to 10: understanding your context and scope, leadership commitment, risk assessment and treatment, support and resources, operating your processes, measuring performance with internal audits and management reviews, and continual improvement. Annex A then lists 93 controls you select from based on your risks.
Do we have to implement all 93 Annex A controls?
No. You must consider every control and record in your Statement of Applicability whether it applies, why, and whether it is implemented. Controls can be excluded when your risk assessment, legal obligations and contracts do not call for them, but each exclusion needs a sound justification.
What is the Statement of Applicability?
The Statement of Applicability, or SoA, is a mandatory document that lists all 93 Annex A controls, states whether each one is applicable, justifies the decision and records whether it is implemented. Auditors use it to plan what they will test, so it is one of the most important documents in your ISMS.
Is ISO 27001:2013 still valid?
No. The transition period for moving certificates from the 2013 edition to ISO/IEC 27001:2022 ended on 31 October 2025. Certificates should now be issued against the 2022 edition, which includes Amendment 1:2024 on climate change.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the requirements you are certified against. ISO 27002 is guidance that explains how to implement each Annex A control in more detail. You cannot be certified to ISO 27002.
Can a small business get ISO 27001 certified?
Yes. The standard scales to organisations of any size, and audit time is calculated largely by the number of people in scope. Small businesses with a clear scope often certify faster and at lower cost than larger organisations.
Sources
CREST-certified consultants with over 100 years of combined experience in threat intelligence, penetration testing, MDR and compliance.
