# ISO/IEC 27001:2022 compliance: a practical implementation guide > ISO/IEC 27001:2022 certifies that you run an information security management system, not merely that you have security controls. This guide covers what the standard requires, how to scope and sequence the work for a cloud-native company of 10 to 500 people, which Annex A controls take real engineering effort in AWS, Azure and GCP, what evidence auditors ask for, and how certification and surveillance actually run, current as of October 2026. - Source: https://support.icompaas.com/compliance/iso-27001-2022 - Reviewed: 2026-10-08 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ## At a glance - **Issuing body:** ISO/IEC JTC 1/SC 27 (joint ISO and IEC technical committee) - **Current edition:** ISO/IEC 27001:2022 (third edition, published 25 October 2022) plus Amendment 1:2024 (climate change) - **Structure:** Clauses 4–10 (mandatory management-system requirements) and Annex A (93 reference controls in 4 themes) - **Applies to:** Any organisation of any size; voluntary, driven by customer contracts, procurement reviews and partner requirements - **Assessment type:** Third-party certification by an accredited certification body: Stage 1, Stage 2, annual surveillance, recertification every three years - **Typical first-time timeline:** 4–8 months from kick-off to Stage 2 for a 10–500-person cloud-native company (our readiness experience; longer if logging and vulnerability management start from zero) - **2013 edition status:** Retired. All ISO/IEC 27001:2013 certificates expired or were withdrawn on 31 October 2025 - **Consequences:** No statutory penalties. Lost or blocked deals, failed vendor reviews, and certificate suspension or withdrawal if the ISMS stops running ## Who needs ISO 27001, and what triggers it ISO/IEC 27001 is a voluntary standard. No law in any major jurisdiction says "you must be certified". The pressure comes from the people who buy from you. In practice a cloud-native SaaS company meets one of four triggers: - **Enterprise procurement.** Security questionnaires from customers with more than a few thousand staff routinely ask for an ISO 27001 certificate or a SOC 2 report, and outside North America ISO 27001 is the one they recognise. Without it, every deal gets a bespoke security review that can add weeks to the cycle. - **Acting as a processor for EU and UK customers.** GDPR Article 32 requires "appropriate technical and organisational measures"; controllers who must evidence that their processors have them accept an accredited ISO 27001 certificate as a strong answer. See the [GDPR guide](https://support.icompaas.com/compliance/gdpr) for the legal side. - **Regulated and public-sector buyers.** Banks, insurers, healthcare groups and government bodies frequently write ISO 27001 into their supplier security schedules as the minimum baseline, sometimes alongside sector add-ons. - **Partnerships and marketplaces.** Integration partners and cloud marketplaces ask for it before listing or co-selling. It also underpins related certifications. ISO/IEC 27017 (cloud security controls) and ISO/IEC 27018 (PII in public cloud) are audited as extensions of a 27001 certificate, and ISO/IEC 42001 (AI management) reuses the same management-system skeleton. **What happens if you ignore it.** Nothing legal, but commercially real: deals stall at the security review, renewals get conditional on "certification within 12 months", and you spend engineering time answering the same 300 questions per prospect. One more point that matters today: the 2013 edition was retired on 31 October 2025. If you or a supplier still present a 2013 certificate it is no longer valid, and you should expect the certification body to treat you as a new applicant. ## How the standard is structured, and what changed in 2022 The standard is short (19 pages) and has two parts that are audited differently. ### Clauses 4–10: the management system (all mandatory) - **4 Context**: internal and external issues, interested parties and their requirements, the scope statement (4.3), and the ISMS itself. - **5 Leadership**: top-management commitment, the information security policy, roles and authorities. - **6 Planning**: the risk assessment process (6.1.2), the risk treatment process and the Statement of Applicability (6.1.3), security objectives (6.2) and, new in 2022, planning of changes (6.3). - **7 Support**: resources, competence, awareness, communication and documented information. - **8 Operation**: running the processes you planned, performing risk assessments at planned intervals and implementing the treatment plan. - **9 Performance evaluation**: monitoring and measurement, internal audit (9.2) and management review (9.3). - **10 Improvement**: continual improvement and nonconformity and corrective action. You cannot exclude anything in clauses 4–10. Internal audit and management review are not "nice to have"; a certification body will not issue a certificate until both have been performed at least once. ### Annex A: 93 reference controls Annex A lists 93 controls in four themes: Organisational (37), People (8), Physical (14) and Technological (34). It is a reference set, not a checklist. Clause 6.1.3 requires you to determine the controls you need from your risk assessment, compare them with Annex A to make sure nothing necessary has been omitted, and record the result in a **Statement of Applicability (SoA)**: every control, whether it applies, why, and whether it is implemented. Exclusions are allowed with a justification. Implementation guidance for each control lives in ISO/IEC 27002:2022, which is not itself certifiable, and gives each control five attributes (control type, security property, cybersecurity concept, operational capability, security domain) that are handy for mapping to NIST CSF functions. ### What changed from 2013 to 2022 The 2013 edition's 114 controls in 14 domains were consolidated into 93 controls in 4 themes, with **11 genuinely new controls**: [A.5.7 threat intelligence](https://support.icompaas.com/compliance/iso-27001-2022/a-5-7-threat-intelligence), [A.5.23 use of cloud services](https://support.icompaas.com/compliance/iso-27001-2022/a-5-23-information-security-for-use-of-cloud-services), [A.5.30 ICT readiness for business continuity](https://support.icompaas.com/compliance/iso-27001-2022/a-5-30-ict-readiness-for-business-continuity), [A.7.4 physical security monitoring](https://support.icompaas.com/compliance/iso-27001-2022/a-7-4-physical-security-monitoring), [A.8.9 configuration management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-9-configuration-management), [A.8.10 information deletion](https://support.icompaas.com/compliance/iso-27001-2022/a-8-10-information-deletion), [A.8.11 data masking](https://support.icompaas.com/compliance/iso-27001-2022/a-8-11-data-masking), [A.8.12 data leakage prevention](https://support.icompaas.com/compliance/iso-27001-2022/a-8-12-data-leakage-prevention), [A.8.16 monitoring activities](https://support.icompaas.com/compliance/iso-27001-2022/a-8-16-monitoring-activities), [A.8.23 web filtering](https://support.icompaas.com/compliance/iso-27001-2022/a-8-23-web-filtering) and [A.8.28 secure coding](https://support.icompaas.com/compliance/iso-27001-2022/a-8-28-secure-coding). Clause changes were smaller: 6.3 planning of changes, an explicit requirement to control externally provided processes in 8.1, and management review must now consider changes in the needs and expectations of interested parties. **Amendment 1:2024**, published in February 2024, adds the harmonised climate-change text used across ISO management-system standards: clause 4.1 now requires you to determine whether climate change is a relevant issue, and 4.2 notes that interested parties can have climate-related requirements. Auditors check for a documented decision; a sentence in your context document is enough if your conclusion is "not relevant". The current normative text is therefore [ISO/IEC 27001:2022](https://www.iso.org/standard/27001) plus [Amd 1:2024](https://www.iso.org/standard/88435.html). ### The transition is over [IAF MD 26:2023](https://iaf.nu/iaf_system/uploads/documents/IAF_MD26_Issue_2_15012023.pdf) set a 36-month transition: from 30 April 2024 all initial and recertification audits had to be against the 2022 edition, and all client transitions had to be complete by 31 October 2025, at which point every 2013 certificate expired or was withdrawn. Companion standards have since caught up too: ISO/IEC 27018:2025 (PII in public cloud, August 2025) and [ISO/IEC 27017:2026](https://webstore.iec.ch/en/publication/115400) (cloud controls, July 2026), both built on the current ISO/IEC 27002 control set, and ISO/IEC 27701:2025 (privacy management, October 2025, now a standalone management-system standard; see the [ISO 27701 guide](https://support.icompaas.com/compliance/iso-27701-2025)). ## Scoping the ISMS: what is in, what is out Clause 4.3 asks for a scope that states boundaries and applicability, considering your context, your interested parties' requirements, and the interfaces and dependencies with other organisations. The scope statement is printed on the certificate, and procurement teams read it. A certificate that says "the ISMS supporting the Acme platform, delivered from AWS eu-west-1 and operated by Acme's engineering, support and corporate IT teams in London and remotely" closes deals. One that says "the information security management system of Acme Ltd" invites a follow-up questionnaire. ### What a cloud-native SaaS should include - The product or products customers buy, and every production cloud account, subscription or project that delivers them. - The delivery pipeline: source control, CI/CD, artefact registries, the identity provider and the secrets store. Attackers do not respect your scope boundary. - The people who can touch production or customer data: engineering, SRE, support, data, and the IT function that manages their endpoints, including remote workers ([A.6.7](https://support.icompaas.com/compliance/iso-27001-2022/a-6-7-remote-working)). - Non-production environments that ever hold copies of production data ([A.8.33](https://support.icompaas.com/compliance/iso-27001-2022/a-8-33-test-information)). - External interfaces, named: the cloud provider, sub-processors, outsourced development, the managed SOC. They are outside the ISMS but inside your supplier controls ([A.5.19](https://support.icompaas.com/compliance/iso-27001-2022/a-5-19-information-security-in-supplier-relationships) to A.5.22). ### The scoping mistakes that cost the most - **Scoping to the security team.** Engineering runs the controls that matter. If engineers are "out of scope", the auditor cannot sample change management or secure coding, and your certificate says nothing a customer cares about. - **Carving out laptops.** Endpoints with production credentials are in scope whether or not you own the MDM. - **Everything in one go.** A 300-person company with five products and three offices does not need all of them in the first certificate. Start with the product under commercial pressure and extend scope at a surveillance audit. - **Legal entity confusion.** If the engineering subsidiary in another country does the work, it must be in scope, or the certificate must say the parent only. - **Forgetting shared services.** HR onboarding, finance's procurement of suppliers and corporate IT sit in the parent but deliver People and Supplier controls. Include the processes even if the departments are not "sites". ## Implementation roadmap: a phased plan The plan below assumes a 10–500-person company on AWS, Azure or GCP with a reasonable engineering culture but no formal ISMS. Compress it if you already hold a SOC 2 report; stretch it if logging and vulnerability management are starting from nothing. ### Weeks 0–2: mobilise - Name an executive sponsor and an ISMS owner. Agree a monthly 30-minute steering slot. Clause 5 is audited through what these people did, not what the policy says. - Draft the scope statement and the context document (4.1, 4.2), including the climate-change decision from Amd 1. - Run a gap assessment against clauses 4–10 and the 93 Annex A controls. Be honest about "not implemented". - Choose the risk methodology (asset-based or scenario-based, a 5x5 matrix is fine) and the risk acceptance criteria. - Shortlist accredited certification bodies and request quotes now; audit calendars often fill two to four months ahead. ### Weeks 2–6: govern and assess risk - Publish the information security policy and the topic policies you actually need ([A.5.1](https://support.icompaas.com/compliance/iso-27001-2022/a-5-1-policies-for-information-security)): acceptable use, access control, cryptography, secure development, supplier security, incident management, business continuity, logging. Each with an owner and a review date. - Assign roles ([A.5.2](https://support.icompaas.com/compliance/iso-27001-2022/a-5-2-information-security-roles-and-responsibilities)): who approves access, who owns risks, who signs off changes. - Build the asset inventory from the cloud, not a spreadsheet: export accounts, projects, data stores, repositories and SaaS tools, assign owners and classification ([A.5.9](https://support.icompaas.com/compliance/iso-27001-2022/a-5-9-inventory-of-information-and-other-associated-assets), [A.5.12](https://support.icompaas.com/compliance/iso-27001-2022/a-5-12-classification-of-information)). - Hold risk workshops with engineering, product and operations. Output: a risk register with owners, scores, treatment decisions and a risk treatment plan with dates. - Draft the SoA from the risk treatment plan. Every "applicable" control needs a justification that references a risk or a legal or contractual requirement. ### Weeks 6–14: implement the technical and people controls - Work the hard controls in the next section in priority order: logging and monitoring first (everything else produces evidence into it), then vulnerability and configuration management, cryptography, secure development and change management, then continuity testing. - People controls: screening ([A.6.1](https://support.icompaas.com/compliance/iso-27001-2022/a-6-1-screening)), contract clauses and NDAs, joiner-mover-leaver checklists, awareness training with completion tracking ([A.6.3](https://support.icompaas.com/compliance/iso-27001-2022/a-6-3-information-security-awareness-education-and-training)). - Supplier register with risk tiering, contract review for security clauses and the provider assurance evidence you collected for the cloud (A.5.19–A.5.23). - Incident management: a written process, severity levels, a tabletop exercise with minutes ([A.5.24](https://support.icompaas.com/compliance/iso-27001-2022/a-5-24-information-security-incident-management-planning-and-preparation)). ### Weeks 14–18: operate and prove - Let the system run. Quarterly access reviews, monthly vulnerability reports, change records and a restore test all need at least one cycle of real records before the audit. - Internal audit (9.2) covering every clause and a sample of Annex A controls, performed by someone independent of the work audited. Record findings as nonconformities with corrective actions. - Management review (9.3) with every required input (audit results, risk status, objectives, interested-party changes, feedback, nonconformities, improvement opportunities) and recorded decisions. ### Weeks 18–26: certification - Stage 1: documentation and readiness review. Close any gaps raised. - Stage 2: effectiveness audit. Close nonconformities; the certificate follows the certification decision. ### Ongoing Monthly control checks, quarterly access reviews, annual risk review, annual internal audit and management review, and the surveillance audit each year. Treat the surveillance audit as a deadline for the annual cycle, not an event in itself. ## The hardest Annex A controls for a cloud-native company Most of the 93 controls are paperwork plus a sensible process. These eight take real engineering time, and each is where auditors spend the longest. Links go to the control articles with full implementation notes. ### [A.5.7 Threat intelligence](https://support.icompaas.com/compliance/iso-27001-2022/a-5-7-threat-intelligence) You need a process that collects, analyses and acts on threat information, not a feed subscription. **AWS:** enable Amazon GuardDuty organisation-wide through a delegated administrator account in every region you use, route findings to Security Hub, and subscribe to AWS security bulletins. **Azure:** Microsoft Defender for Cloud plus threat analytics and intel profiles in the Defender portal for named-actor context (the standalone Microsoft Defender Threat Intelligence product reached end of life on 1 August 2026 and its capabilities now sit in the Defender portal). **GCP:** Security Command Center with Event Threat Detection; Google Threat Intelligence for the strategic layer. **Done looks like:** a documented list of sources, a monthly review note, and at least one ticket showing an advisory that changed a configuration or a patch priority. ### [A.5.23 Information security for use of cloud services](https://support.icompaas.com/compliance/iso-27001-2022/a-5-23-information-security-for-use-of-cloud-services) Auditors want a policy for acquiring, using, managing and exiting cloud services, a register of the services in use, and evidence you understand the shared-responsibility split. Download the providers' own ISO 27001, 27017 and 27018 certificates and SOC reports from AWS Artifact, the Microsoft Service Trust Portal and Google Cloud's Compliance Reports Manager, and file them against the supplier record. Enforce the boundary with organisation-level guardrails: AWS Organizations service control policies, Azure management groups with Azure Policy, GCP folders with Organization Policy constraints. **Done looks like:** each cloud service has an owner, a data classification, assurance evidence with a review date, and an exit plan. ### [A.5.30 ICT readiness for business continuity](https://support.icompaas.com/compliance/iso-27001-2022/a-5-30-ict-readiness-for-business-continuity) Start from a business impact analysis that sets RTO and RPO per service, then prove you can meet them. **AWS:** AWS Backup with cross-account and cross-region vaults, multi-AZ data stores, AWS Elastic Disaster Recovery for anything stateful on EC2. **Azure:** Azure Backup with geo-redundant vaults, Azure Site Recovery, zone-redundant SKUs. **GCP:** Backup and DR Service, regional or multi-regional storage, Cloud SQL high availability. **Done looks like:** an annual restore test record with measured recovery time against the target, and backups covered by [A.8.13](https://support.icompaas.com/compliance/iso-27001-2022/a-8-13-information-backup) that are immutable and tested from a different account. ### [A.8.8 Management of technical vulnerabilities](https://support.icompaas.com/compliance/iso-27001-2022/a-8-8-management-of-technical-vulnerabilities) The requirement is coverage, timeliness and accountability. **AWS:** Amazon Inspector for EC2, ECR images, Lambda functions and, [since June 2025](https://aws.amazon.com/about-aws/whats-new/2025/06/amazon-inspector-code-security-shift-security-development), connected code repositories; Systems Manager Patch Manager with patch baselines and compliance reporting. **Azure:** Microsoft Defender Vulnerability Management for VMs and container registries, Azure Update Manager for patch compliance. **GCP:** Security Command Center vulnerability findings, Artifact Analysis for images, VM Manager OS patch management. **Done looks like:** written remediation SLAs by severity, scanners covering every in-scope asset class, a monthly report showing SLA adherence, and documented risk acceptance for anything overdue. ### [A.8.9 Configuration management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-9-configuration-management) Define baselines, enforce them, detect drift. Keep infrastructure in code and treat the repository as the baseline. **AWS:** AWS Config rules and conformance packs, Security Hub CSPM standards (Foundational Security Best Practices, CIS), service control policies for the things that must never happen. **Azure:** Azure Policy in deny and deployIfNotExists modes, Machine Configuration for guest settings, and the [ISO/IEC 27001:2022 standard in Defender for Cloud](https://learn.microsoft.com/en-us/azure/defender-for-cloud/concept-regulatory-compliance-standards), which can also assess connected AWS and GCP accounts. **GCP:** Organization Policy constraints, Security Health Analytics in Security Command Center (whose detectors [map to ISO 27001:2022](https://docs.cloud.google.com/security-command-center/docs/compliance-management)), OS Config for VM baselines. **Done looks like:** documented baselines per platform, drift alerts routed to a queue someone owns, and an exceptions register. ### [A.8.15 Logging](https://support.icompaas.com/compliance/iso-27001-2022/a-8-15-logging) and [A.8.16 Monitoring activities](https://support.icompaas.com/compliance/iso-27001-2022/a-8-16-monitoring-activities) Logs must exist for every in-scope system, be protected from tampering, be retained for a defined period and actually be looked at. **AWS:** an organisation trail in CloudTrail delivered to a dedicated log-archive account, S3 Object Lock and log-file validation on, CloudWatch alarms for the events that matter, GuardDuty for detection, Security Lake if you want OCSF-normalised retention. **Azure:** activity log and resource diagnostic settings sent to a central Log Analytics workspace, immutable storage for the archive tier, Microsoft Sentinel for analytics rules. **GCP:** Cloud Audit Logs with Data Access logs switched on (they are off by default for most services), an organisation-level Log Router sink into a locked Cloud Logging bucket, Security Command Center for detections. **Done looks like:** a log-source inventory with retention periods, evidence that admins cannot delete logs, alert rules with runbooks, and a weekly review record with at least one investigated alert. ### [A.8.24 Use of cryptography](https://support.icompaas.com/compliance/iso-27001-2022/a-8-24-use-of-cryptography) A cryptography policy that names approved algorithms and protocols, plus key management across the whole lifecycle. **AWS:** customer-managed KMS keys with rotation and restrictive key policies, encryption enforced on S3, EBS and RDS through Config rules, AWS Certificate Manager for TLS, CloudHSM only if a contract demands it. **Azure:** Key Vault or Managed HSM with customer-managed keys, minimum TLS 1.2 policies on storage and app services, encryption at host for VM disks (Azure Disk Encryption retires on 15 September 2028). **GCP:** Cloud KMS with customer-managed encryption keys on storage and databases, Cloud HSM for regulated workloads, Certificate Authority Service for internal PKI. **Done looks like:** a key inventory with owners and rotation evidence, and secret scanning in CI proving no plaintext credentials in repositories (see [A.5.17](https://support.icompaas.com/compliance/iso-27001-2022/a-5-17-authentication-information)). ### [A.8.28 Secure coding](https://support.icompaas.com/compliance/iso-27001-2022/a-8-28-secure-coding) and [A.8.32 Change management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-32-change-management) These two are audited together because the pull request is the change record. Write a short secure-coding standard, enforce branch protection with mandatory review, and run SAST, dependency and secret scanning in CI. **AWS:** Amazon Inspector code security for GitHub and GitLab repositories (Amazon CodeGuru Reviewer has not accepted new repository associations since 7 November 2025, so do not build on it). **Azure:** GitHub Advanced Security or Defender for Cloud DevOps security. **GCP:** Cloud Build with Artifact Analysis and Binary Authorization so only scanned, signed images deploy. Separate development, test and production accounts or subscriptions ([A.8.31](https://support.icompaas.com/compliance/iso-27001-2022/a-8-31-separation-of-development-test-and-production-environments)) and write an emergency change path with after-the-fact review. **Done looks like:** any sampled production change traces to a pull request, a pipeline run, a reviewer and a deployment record. ## Evidence the auditor will ask for Auditors sample. They pick a control, ask how it works, then ask for the record that proves it worked on a specific date. Organise evidence in four groups and you will not spend Stage 2 searching Slack. ### 1\. Mandatory documented information (clauses 4–10) - Scope statement (4.3) and context (4.1, 4.2, including the climate-change decision). - Information security policy (5.2) and objectives (6.2). - Risk assessment and risk treatment process descriptions (6.1.2, 6.1.3), the risk register and treatment plan, and the results of each assessment and treatment round (8.2, 8.3). - The Statement of Applicability. - Evidence of competence (7.2), operational planning records (8.1), monitoring and measurement results (9.1). - Internal audit programme and reports (9.2), management review minutes (9.3), nonconformities and corrective actions (10.2). ### 2\. Operational records - Quarterly access reviews with reviewer, date and the removals that resulted ([A.5.18](https://support.icompaas.com/compliance/iso-27001-2022/a-5-18-access-rights)). - Joiner, mover and leaver checklists; screening confirmations; signed terms and NDAs; training completion. - Supplier register, assessments and contract reviews; incident log and post-incident reviews; continuity test reports; risk review minutes. ### 3\. Technical exports - Logging configuration (CloudTrail, diagnostic settings, Audit Logs) and retention settings. - Compliance reports from AWS Config or Security Hub CSPM, Defender for Cloud, Security Command Center. - Vulnerability scan reports with ageing; patch compliance reports; key inventories; backup job history and restore test output; MFA enforcement reports from the identity provider; branch protection settings. ### 4\. Tickets Change tickets or pull requests, incident tickets, corrective action tickets, exception and risk acceptance records. Auditors like tickets because they carry timestamps and names. **Retention.** The standard does not set a period; you do, under 7.5 and [A.5.33](https://support.icompaas.com/compliance/iso-27001-2022/a-5-33-protection-of-records), taking legal and contractual requirements into account. In practice keep ISMS records for at least one full three-year certification cycle, because the recertification audit can reach back to the start of it, and keep security logs for the period in your logging policy (twelve months online is a common customer contract term; check yours). ## How certification actually runs ### Who audits you A certification body (CB) that is accredited to ISO/IEC 17021-1 and [ISO/IEC 27006-1:2024](https://www.iso.org/standard/82908.html) by a national accreditation body such as UKAS, ANAB or DAkkS. Those accreditation bodies are signatories to a multilateral arrangement that makes a certificate issued in one country recognised everywhere. Since [1 January 2026](https://www.ukas.com/resources/latest-news/global-accreditation-cooperation-incorporated-launches-as-global-aci-strengthening-global-alignment-in-accreditation/) that arrangement is the Global ACI MRA, which replaced the IAF MLA and ILAC MRA; existing accreditations and certificates remain recognised, and the IAF MLA mark stays on certificates during a transition period. Verify both the CB's accreditation and, later, your own certificate on the public IAF CertSearch database. Unaccredited certificates are cheaper and faster; they also carry no international recognition and are increasingly rejected by procurement teams who check the register. ### The stages 1. **Application and quote.** Audit time is calculated by the CB from the number of people doing work under the ISMS, the number of sites and the complexity of the environment, following ISO/IEC 27006-1 and the accreditation rules. Headcount in scope is the biggest cost driver. 2. **Stage 1.** Documentation and readiness review, often remote. The auditor confirms scope, reviews the SoA, risk assessment, internal audit and management review, and reports areas of concern that would become nonconformities at Stage 2. 3. **Stage 2.** The effectiveness audit, on site or remote, typically a few weeks after Stage 1. Interviews with management, engineers, support and HR; sampling of Annex A controls against records; walkthroughs of the cloud consoles. 4. **Findings.** A major nonconformity (one that affects the ISMS's ability to achieve its intended results, such as a required process missing or a control not operating) blocks the certificate until closed and verified. Minor nonconformities need an accepted corrective action plan. Observations and opportunities for improvement are advisory. 5. **Decision and certificate.** An independent reviewer at the CB makes the decision. The certificate is valid for three years and shows the scope statement. 6. **Surveillance.** At least once a year, the first within twelve months of the certification decision, shorter than Stage 2 and focused on the mandatory clauses plus a rotating sample of controls. 7. **Recertification.** Before the three-year expiry, a full audit comparable to Stage 2. If the certificate lapses, ISO/IEC 17021-1 lets the CB restore it within six months of expiry once the outstanding recertification work is complete; after that you need at least a new Stage 2 audit. **Duration.** From Stage 1 to certificate, six to twelve weeks is typical in our experience, dominated by how long nonconformities take to close. **Cost drivers** beyond headcount: additional sites, adding ISO/IEC 27017, 27018 or 27701 to the same audit, auditor travel, and scope extensions between cycles. ## Common mistakes in readiness reviews, and the fix 1. **Treating Annex A as the checklist.** Controls that do not trace to a risk or an obligation get "applicable" with no justification. _Fix:_ build the SoA from the risk treatment plan; every applicable control cites the risk or requirement that needs it. 2. **An SoA that says "implemented" everywhere.** Stage 2 finds three controls that are not. _Fix:_ mark them "partially implemented" or "planned" with a date; auditors accept honest plans and penalise false claims. 3. **The internal audit is done by the person who built the ISMS.** _Fix:_ clause 9.2 requires objectivity and impartiality. Use someone from another team with a short training, or an external auditor, and keep the audit report separate from the gap assessment. 4. **Management review by email.** _Fix:_ a meeting with minutes that show each 9.3 input, the decisions and who owns them. Top management must be in the room. 5. **No operating history.** Every policy is dated the fortnight before Stage 1 and there are no records. _Fix:_ run at least one full cycle of access reviews, vulnerability reporting, change records and a restore test before the audit. 6. **Logging gaps that only show up at Stage 2.** A single-region CloudTrail, Azure resources without diagnostic settings, GCP Data Access logs never enabled. _Fix:_ set logging at the organisation level with policy enforcement, and export a configuration report as evidence. 7. **People controls left to HR without records.** Screening happened but nobody can show it; leavers' access removal is undocumented ([A.6.5](https://support.icompaas.com/compliance/iso-27001-2022/a-6-5-responsibilities-after-termination-or-change-of-employment)). _Fix:_ checklists in the ticketing system, with the identity provider's deprovisioning log as the proof. 8. **Supplier controls stop at a spreadsheet.** _Fix:_ tier suppliers by access to data, collect assurance evidence for the top tier, and review it annually ([A.5.22](https://support.icompaas.com/compliance/iso-27001-2022/a-5-22-monitoring-review-and-change-management-of-supplier-services)). 9. **Skipping the 2024 amendment.** _Fix:_ one documented sentence deciding whether climate change is a relevant issue for the ISMS, and a note in the interested-parties table. 10. **Choosing a certification body on price alone.** _Fix:_ confirm accreditation for ISO/IEC 27001 on the accreditation body's register before signing, and ask who the lead auditor will be. ## How iCompaas helps with ISO 27001 iCompaas ships an ISO/IEC 27001:2022 ISMS template covering the documents the auditor asks for first: the scope statement, risk register, risk treatment plan, Statement of Applicability, internal audit schedule and management review minutes. Policy templates come with named owners and review cadences, so clause 7.5 document control and the annual policy review happen on a schedule rather than the week before the audit. For the technical Annex A controls, iCompaas runs continuous checks across your connected cloud accounts on AWS, Azure, GCP and other providers, so controls such as A.5.7 threat intelligence, A.5.23 use of cloud services, A.8.16 monitoring activities and A.8.28 secure coding are evaluated against the live environment rather than a point-in-time screenshot. Findings are collected as evidence and can be exported for Stage 2 and surveillance audits. The control library on this site documents every one of the 93 Annex A controls with implementation and evidence notes, and for most of them shows the mapping to the other frameworks you may hold. ## Frequently asked questions ### Is ISO 27001 certification legally required? No. ISO/IEC 27001 is a voluntary international standard, and no major jurisdiction mandates certification by law. The requirement is commercial: enterprise customers, public-sector buyers and partners write it into procurement and contract terms, and controllers under GDPR use it as evidence that a processor has appropriate technical and organisational measures. Some regulators reference it in guidance as a recognised baseline, but the obligation they impose is to manage risk appropriately, not to hold the certificate. ### How long does ISO 27001 certification take? For a cloud-native company of 10 to 500 people with no existing management system, plan on four to eight months from kick-off to the Stage 2 audit, then six to twelve weeks from Stage 1 to the certificate. The variable parts are how much technical work logging, vulnerability management and configuration baselines need, and how quickly you can accumulate operating records: auditors want to see at least one cycle of access reviews, internal audit and management review before Stage 2. Holding a current SOC 2 report usually shortens the technical phase substantially. ### Is my ISO 27001:2013 certificate still valid? No. The transition set by IAF MD 26 ended on 31 October 2025, and all certificates to the 2013 edition expired or were withdrawn on that date. Certification bodies were only allowed to issue or renew against the 2022 edition from 30 April 2024. If you still hold a 2013 certificate you are effectively uncertified and should expect a new initial certification audit against ISO/IEC 27001:2022 with Amendment 1:2024. If a supplier shows you a 2013 certificate, treat it as expired. ### Do I need both ISO 27001 and SOC 2? Often, if you sell in both North America and the rest of the world. SOC 2 is an attestation report on controls over a period, written for customers' auditors and most asked for in the United States; ISO 27001 is a certificate that your management system meets a standard, and is the default ask in Europe, the UK, the Middle East and Asia-Pacific. The two overlap heavily at the control level, so the second one is incremental work rather than a second project. See the [SOC 2 guide](https://support.icompaas.com/compliance/soc-2-trust-services-criteria) for the differences in evidence and audit style. ### Do I have to implement all 93 Annex A controls? No. Annex A is a reference set. Clause 6.1.3 requires you to determine the controls your risk treatment needs, compare them with Annex A so nothing necessary is missed, and record every control in the Statement of Applicability with a justification for including or excluding it. A cloud-native company commonly excludes some physical controls, for example cabling security, if it has no data centre and its offices hold no systems. The auditor tests that your exclusions are justified by your scope and risks, not that the count is 93. ### How often are ISO 27001 audits after certification? Every year. A certificate is valid for three years. In years one and two the certification body performs a surveillance audit, the first within twelve months of the certification decision, which is shorter than the initial audit and focuses on the mandatory clauses plus a sample of Annex A controls. Before the certificate expires in year three, a recertification audit comparable to Stage 2 renews it for another three years. Between visits you still owe the standard an annual internal audit, a management review and a risk review, and the surveillance auditor will ask for all three. ## Automate ISO 27001 with iCompaas iCompaas connects to your cloud accounts, identity provider and version control, maps the evidence to every ISO 27001 requirement, runs the technical checks continuously, and keeps policies and reviews on schedule. - [Get started](https://app.icompaas.com/signin?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=iso-27001-2022&utm_term=get-started) - [Book a product tour](https://calendly.com/icompaas/product-tour?utm_source=support.icompaas.com&utm_medium=referral&utm_campaign=compliance-guides&utm_content=iso-27001-2022&utm_term=product-tour) ## Related compliance guides - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Most companies that hold ISO 27001 also need a SOC 2 report for North American customers, and the two share most of their technical controls. - [ISO/IEC 27701:2025 PIMS Controls — control library](https://support.icompaas.com/compliance/iso-27701-2025): The privacy management standard rebuilt in 2025 on the same clause structure; the natural next step if you process personal data for EU or UK customers. - [ISO/IEC 42001:2023 (AI Management System) Annex A Controls — control library](https://support.icompaas.com/compliance/iso-42001-2023): The AI management system standard reuses the ISO 27001 clause skeleton, so an existing ISMS gives you most of its governance layer. ## ISO/IEC 27001:2022 Annex A Controls: control library 93 controls in 4 sections. Each control page has implementation guidance and the evidence to collect; append `.md` to any link for Markdown. ### Organizational controls ISO/IEC 27001:2022 Annex A Controls - [ISO/IEC 27001:2022 A.5.1 — Policies for information security](https://support.icompaas.com/compliance/iso-27001-2022/a-5-1-policies-for-information-security) - [ISO/IEC 27001:2022 A.5.2 — Information security roles and responsibilities](https://support.icompaas.com/compliance/iso-27001-2022/a-5-2-information-security-roles-and-responsibilities) - [ISO/IEC 27001:2022 A.5.3 — Segregation of duties](https://support.icompaas.com/compliance/iso-27001-2022/a-5-3-segregation-of-duties) - [ISO/IEC 27001:2022 A.5.4 — Management responsibilities](https://support.icompaas.com/compliance/iso-27001-2022/a-5-4-management-responsibilities) - [ISO/IEC 27001:2022 A.5.5 — Contact with authorities](https://support.icompaas.com/compliance/iso-27001-2022/a-5-5-contact-with-authorities) - [ISO/IEC 27001:2022 A.5.6 — Contact with special interest groups](https://support.icompaas.com/compliance/iso-27001-2022/a-5-6-contact-with-special-interest-groups) - [ISO/IEC 27001:2022 A.5.7 — Threat intelligence](https://support.icompaas.com/compliance/iso-27001-2022/a-5-7-threat-intelligence) - [ISO/IEC 27001:2022 A.5.8 — Information security in project management](https://support.icompaas.com/compliance/iso-27001-2022/a-5-8-information-security-in-project-management) - [ISO/IEC 27001:2022 A.5.9 — Inventory of information and other associated assets](https://support.icompaas.com/compliance/iso-27001-2022/a-5-9-inventory-of-information-and-other-associated-assets) - [ISO/IEC 27001:2022 A.5.10 — Acceptable use of information and other associated assets](https://support.icompaas.com/compliance/iso-27001-2022/a-5-10-acceptable-use-of-information-and-other-associated-assets) - [ISO/IEC 27001:2022 A.5.11 — Return of assets](https://support.icompaas.com/compliance/iso-27001-2022/a-5-11-return-of-assets) - [ISO/IEC 27001:2022 A.5.12 — Classification of information](https://support.icompaas.com/compliance/iso-27001-2022/a-5-12-classification-of-information) - [ISO/IEC 27001:2022 A.5.13 — Labelling of information](https://support.icompaas.com/compliance/iso-27001-2022/a-5-13-labelling-of-information) - [ISO/IEC 27001:2022 A.5.14 — Information transfer](https://support.icompaas.com/compliance/iso-27001-2022/a-5-14-information-transfer) - [ISO/IEC 27001:2022 A.5.15 — Access control](https://support.icompaas.com/compliance/iso-27001-2022/a-5-15-access-control) - [ISO/IEC 27001:2022 A.5.16 — Identity management](https://support.icompaas.com/compliance/iso-27001-2022/a-5-16-identity-management) - [ISO/IEC 27001:2022 A.5.17 — Authentication information](https://support.icompaas.com/compliance/iso-27001-2022/a-5-17-authentication-information) - [ISO/IEC 27001:2022 A.5.18 — Access rights](https://support.icompaas.com/compliance/iso-27001-2022/a-5-18-access-rights) - [ISO/IEC 27001:2022 A.5.19 — Information security in supplier relationships](https://support.icompaas.com/compliance/iso-27001-2022/a-5-19-information-security-in-supplier-relationships) - [ISO/IEC 27001:2022 A.5.20 — Addressing information security within supplier agreements](https://support.icompaas.com/compliance/iso-27001-2022/a-5-20-addressing-information-security-within-supplier-agreements) - [ISO/IEC 27001:2022 A.5.21 — Managing information security in the ICT supply chain](https://support.icompaas.com/compliance/iso-27001-2022/a-5-21-managing-information-security-in-the-ict-supply-chain) - [ISO/IEC 27001:2022 A.5.22 — Monitoring, review and change management of supplier services](https://support.icompaas.com/compliance/iso-27001-2022/a-5-22-monitoring-review-and-change-management-of-supplier-services) - [ISO/IEC 27001:2022 A.5.23 — Information security for use of cloud services](https://support.icompaas.com/compliance/iso-27001-2022/a-5-23-information-security-for-use-of-cloud-services) - [ISO/IEC 27001:2022 A.5.24 — Information security incident management planning and preparation](https://support.icompaas.com/compliance/iso-27001-2022/a-5-24-information-security-incident-management-planning-and-preparation) - [ISO/IEC 27001:2022 A.5.25 — Assessment and decision on information security events](https://support.icompaas.com/compliance/iso-27001-2022/a-5-25-assessment-and-decision-on-information-security-events) - [ISO/IEC 27001:2022 A.5.26 — Response to information security incidents](https://support.icompaas.com/compliance/iso-27001-2022/a-5-26-response-to-information-security-incidents) - [ISO/IEC 27001:2022 A.5.27 — Learning from information security incidents](https://support.icompaas.com/compliance/iso-27001-2022/a-5-27-learning-from-information-security-incidents) - [ISO/IEC 27001:2022 A.5.28 — Collection of evidence](https://support.icompaas.com/compliance/iso-27001-2022/a-5-28-collection-of-evidence) - [ISO/IEC 27001:2022 A.5.29 — Information security during disruption](https://support.icompaas.com/compliance/iso-27001-2022/a-5-29-information-security-during-disruption) - [ISO/IEC 27001:2022 A.5.30 — ICT readiness for business continuity](https://support.icompaas.com/compliance/iso-27001-2022/a-5-30-ict-readiness-for-business-continuity) - [ISO/IEC 27001:2022 A.5.31 — Legal, statutory, regulatory and contractual requirements](https://support.icompaas.com/compliance/iso-27001-2022/a-5-31-legal-statutory-regulatory-and-contractual-requirements) - [ISO/IEC 27001:2022 A.5.32 — Intellectual property rights](https://support.icompaas.com/compliance/iso-27001-2022/a-5-32-intellectual-property-rights) - [ISO/IEC 27001:2022 A.5.33 — Protection of records](https://support.icompaas.com/compliance/iso-27001-2022/a-5-33-protection-of-records) - [ISO/IEC 27001:2022 A.5.34 — Privacy and protection of personal identifiable information (PII)](https://support.icompaas.com/compliance/iso-27001-2022/a-5-34-privacy-and-protection-of-personal-identifiable-information-pii) - [ISO/IEC 27001:2022 A.5.35 — Independent review of information security](https://support.icompaas.com/compliance/iso-27001-2022/a-5-35-independent-review-of-information-security) - [ISO/IEC 27001:2022 A.5.36 — Compliance with policies, rules and standards for information security](https://support.icompaas.com/compliance/iso-27001-2022/a-5-36-compliance-with-policies-rules-and-standards-for-information-security) - [ISO/IEC 27001:2022 A.5.37 — Documented operating procedures](https://support.icompaas.com/compliance/iso-27001-2022/a-5-37-documented-operating-procedures) ### People controls ISO/IEC 27001:2022 Annex A Controls - [ISO/IEC 27001:2022 A.6.1 — Screening](https://support.icompaas.com/compliance/iso-27001-2022/a-6-1-screening) - [ISO/IEC 27001:2022 A.6.2 — Terms and conditions of employment](https://support.icompaas.com/compliance/iso-27001-2022/a-6-2-terms-and-conditions-of-employment) - [ISO/IEC 27001:2022 A.6.3 — Information security awareness, education and training](https://support.icompaas.com/compliance/iso-27001-2022/a-6-3-information-security-awareness-education-and-training) - [ISO/IEC 27001:2022 A.6.4 — Disciplinary process](https://support.icompaas.com/compliance/iso-27001-2022/a-6-4-disciplinary-process) - [ISO/IEC 27001:2022 A.6.5 — Responsibilities after termination or change of employment](https://support.icompaas.com/compliance/iso-27001-2022/a-6-5-responsibilities-after-termination-or-change-of-employment) - [ISO/IEC 27001:2022 A.6.6 — Confidentiality or non-disclosure agreements](https://support.icompaas.com/compliance/iso-27001-2022/a-6-6-confidentiality-or-non-disclosure-agreements) - [ISO/IEC 27001:2022 A.6.7 — Remote working](https://support.icompaas.com/compliance/iso-27001-2022/a-6-7-remote-working) - [ISO/IEC 27001:2022 A.6.8 — Information security event reporting](https://support.icompaas.com/compliance/iso-27001-2022/a-6-8-information-security-event-reporting) ### Physical controls ISO/IEC 27001:2022 Annex A Controls - [ISO/IEC 27001:2022 A.7.1 — Physical security perimeters](https://support.icompaas.com/compliance/iso-27001-2022/a-7-1-physical-security-perimeters) - [ISO/IEC 27001:2022 A.7.2 — Physical entry](https://support.icompaas.com/compliance/iso-27001-2022/a-7-2-physical-entry) - [ISO/IEC 27001:2022 A.7.3 — Securing offices, rooms and facilities](https://support.icompaas.com/compliance/iso-27001-2022/a-7-3-securing-offices-rooms-and-facilities) - [ISO/IEC 27001:2022 A.7.4 — Physical security monitoring](https://support.icompaas.com/compliance/iso-27001-2022/a-7-4-physical-security-monitoring) - [ISO/IEC 27001:2022 A.7.5 — Protecting against physical and environmental threats](https://support.icompaas.com/compliance/iso-27001-2022/a-7-5-protecting-against-physical-and-environmental-threats) - [ISO/IEC 27001:2022 A.7.6 — Working in secure areas](https://support.icompaas.com/compliance/iso-27001-2022/a-7-6-working-in-secure-areas) - [ISO/IEC 27001:2022 A.7.7 — Clear desk and clear screen](https://support.icompaas.com/compliance/iso-27001-2022/a-7-7-clear-desk-and-clear-screen) - [ISO/IEC 27001:2022 A.7.8 — Equipment siting and protection](https://support.icompaas.com/compliance/iso-27001-2022/a-7-8-equipment-siting-and-protection) - [ISO/IEC 27001:2022 A.7.9 — Security of assets off-premises](https://support.icompaas.com/compliance/iso-27001-2022/a-7-9-security-of-assets-off-premises) - [ISO/IEC 27001:2022 A.7.10 — Storage media](https://support.icompaas.com/compliance/iso-27001-2022/a-7-10-storage-media) - [ISO/IEC 27001:2022 A.7.11 — Supporting utilities](https://support.icompaas.com/compliance/iso-27001-2022/a-7-11-supporting-utilities) - [ISO/IEC 27001:2022 A.7.12 — Cabling security](https://support.icompaas.com/compliance/iso-27001-2022/a-7-12-cabling-security) - [ISO/IEC 27001:2022 A.7.13 — Equipment maintenance](https://support.icompaas.com/compliance/iso-27001-2022/a-7-13-equipment-maintenance) - [ISO/IEC 27001:2022 A.7.14 — Secure disposal or re-use of equipment](https://support.icompaas.com/compliance/iso-27001-2022/a-7-14-secure-disposal-or-re-use-of-equipment) ### Technological controls ISO/IEC 27001:2022 Annex A Controls - [ISO/IEC 27001:2022 A.8.1 — User end point devices](https://support.icompaas.com/compliance/iso-27001-2022/a-8-1-user-end-point-devices) - [ISO/IEC 27001:2022 A.8.2 — Privileged access rights](https://support.icompaas.com/compliance/iso-27001-2022/a-8-2-privileged-access-rights) - [ISO/IEC 27001:2022 A.8.3 — Information access restriction](https://support.icompaas.com/compliance/iso-27001-2022/a-8-3-information-access-restriction) - [ISO/IEC 27001:2022 A.8.4 — Access to source code](https://support.icompaas.com/compliance/iso-27001-2022/a-8-4-access-to-source-code) - [ISO/IEC 27001:2022 A.8.5 — Secure authentication](https://support.icompaas.com/compliance/iso-27001-2022/a-8-5-secure-authentication) - [ISO/IEC 27001:2022 A.8.6 — Capacity management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-6-capacity-management) - [ISO/IEC 27001:2022 A.8.7 — Protection against malware](https://support.icompaas.com/compliance/iso-27001-2022/a-8-7-protection-against-malware) - [ISO/IEC 27001:2022 A.8.8 — Management of technical vulnerabilities](https://support.icompaas.com/compliance/iso-27001-2022/a-8-8-management-of-technical-vulnerabilities) - [ISO/IEC 27001:2022 A.8.9 — Configuration management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-9-configuration-management) - [ISO/IEC 27001:2022 A.8.10 — Information deletion](https://support.icompaas.com/compliance/iso-27001-2022/a-8-10-information-deletion) - [ISO/IEC 27001:2022 A.8.11 — Data masking](https://support.icompaas.com/compliance/iso-27001-2022/a-8-11-data-masking) - [ISO/IEC 27001:2022 A.8.12 — Data leakage prevention](https://support.icompaas.com/compliance/iso-27001-2022/a-8-12-data-leakage-prevention) - [ISO/IEC 27001:2022 A.8.13 — Information backup](https://support.icompaas.com/compliance/iso-27001-2022/a-8-13-information-backup) - [ISO/IEC 27001:2022 A.8.14 — Redundancy of information processing facilities](https://support.icompaas.com/compliance/iso-27001-2022/a-8-14-redundancy-of-information-processing-facilities) - [ISO/IEC 27001:2022 A.8.15 — Logging](https://support.icompaas.com/compliance/iso-27001-2022/a-8-15-logging) - [ISO/IEC 27001:2022 A.8.16 — Monitoring activities](https://support.icompaas.com/compliance/iso-27001-2022/a-8-16-monitoring-activities) - [ISO/IEC 27001:2022 A.8.17 — Clock synchronization](https://support.icompaas.com/compliance/iso-27001-2022/a-8-17-clock-synchronization) - [ISO/IEC 27001:2022 A.8.18 — Use of privileged utility programs](https://support.icompaas.com/compliance/iso-27001-2022/a-8-18-use-of-privileged-utility-programs) - [ISO/IEC 27001:2022 A.8.19 — Installation of software on operational systems](https://support.icompaas.com/compliance/iso-27001-2022/a-8-19-installation-of-software-on-operational-systems) - [ISO/IEC 27001:2022 A.8.20 — Networks security](https://support.icompaas.com/compliance/iso-27001-2022/a-8-20-networks-security) - [ISO/IEC 27001:2022 A.8.21 — Security of network services](https://support.icompaas.com/compliance/iso-27001-2022/a-8-21-security-of-network-services) - [ISO/IEC 27001:2022 A.8.22 — Segregation of networks](https://support.icompaas.com/compliance/iso-27001-2022/a-8-22-segregation-of-networks) - [ISO/IEC 27001:2022 A.8.23 — Web filtering](https://support.icompaas.com/compliance/iso-27001-2022/a-8-23-web-filtering) - [ISO/IEC 27001:2022 A.8.24 — Use of cryptography](https://support.icompaas.com/compliance/iso-27001-2022/a-8-24-use-of-cryptography) - [ISO/IEC 27001:2022 A.8.25 — Secure development life cycle](https://support.icompaas.com/compliance/iso-27001-2022/a-8-25-secure-development-life-cycle) - [ISO/IEC 27001:2022 A.8.26 — Application security requirements](https://support.icompaas.com/compliance/iso-27001-2022/a-8-26-application-security-requirements) - [ISO/IEC 27001:2022 A.8.27 — Secure system architecture and engineering principles](https://support.icompaas.com/compliance/iso-27001-2022/a-8-27-secure-system-architecture-and-engineering-principles) - [ISO/IEC 27001:2022 A.8.28 — Secure coding](https://support.icompaas.com/compliance/iso-27001-2022/a-8-28-secure-coding) - [ISO/IEC 27001:2022 A.8.29 — Security testing in development and acceptance](https://support.icompaas.com/compliance/iso-27001-2022/a-8-29-security-testing-in-development-and-acceptance) - [ISO/IEC 27001:2022 A.8.30 — Outsourced development](https://support.icompaas.com/compliance/iso-27001-2022/a-8-30-outsourced-development) - [ISO/IEC 27001:2022 A.8.31 — Separation of development, test and production environments](https://support.icompaas.com/compliance/iso-27001-2022/a-8-31-separation-of-development-test-and-production-environments) - [ISO/IEC 27001:2022 A.8.32 — Change management](https://support.icompaas.com/compliance/iso-27001-2022/a-8-32-change-management) - [ISO/IEC 27001:2022 A.8.33 — Test information](https://support.icompaas.com/compliance/iso-27001-2022/a-8-33-test-information) - [ISO/IEC 27001:2022 A.8.34 — Protection of information systems during audit testing](https://support.icompaas.com/compliance/iso-27001-2022/a-8-34-protection-of-information-systems-during-audit-testing)