What is it?
ISO/IEC 27001:2022 is the international standard for an Information Security Management System (ISMS). Unlike point-in-time security checklists, it certifies how you manage information security risk: scope, leadership, planning, evaluation and continual improvement (clauses 4–10), backed by 93 Annex A controls grouped into Organisational (37), People (8), Physical (14) and Technological (34).
Who needs it?
Enterprises that sell to other enterprises almost always require their suppliers to be certified. ISO 27001 is also a prerequisite (or strong accelerator) for ISO 27701 (privacy), ISO 27017 (cloud) and ISO 42001 (AI).
How is it structured?
- Clauses 4–10 — the ISMS itself. Mandatory.
- Annex A — a control reference (93 controls). The Statement of Applicability records which apply, which you've implemented, and why any are excluded.
The 2022 update — what changed from 2013?
The control set was rationalised from 114 to 93, reorganised into 4 themes, with 11 new controls reflecting modern stacks: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
Certification path
A certification cycle is three years: Stage 1 (documentation review) and Stage 2 (implementation audit) for the initial certificate, then annual surveillance audits, with a full re-certification at year 3. Initial audits typically take 8–12 weeks of preparation for a mid-market SaaS.
How iCompaas helps
iCompaas ships an ISO 27001:2022 ISMS template: scope statement, risk register, treatment plan, SoA, internal audit schedule and Mgmt review minutes. Annex A technical controls (A.5.7 Threat intelligence, A.5.23 Use of cloud services, A.8.16 Monitoring activities, A.8.28 Secure coding…) are continuously evaluated.