ISO 27001 is the international standard that tells a company how to set up and run a system for keeping its information safe. That system is called an information security management system, or ISMS. Companies of any size can follow the standard, and an independent auditor can certify that they do.
In practice, ISO 27001 asks you to find your security risks, choose controls that reduce them, and prove those controls keep working. It is not a law. But many enterprise companies, especially in Europe and in regulated industries, ask suppliers for an ISO 27001 certificate before they sign a contract.
ISO 27001 at a Glance
| Item | Details |
|---|---|
| Full name | ISO/IEC 27001:2022, Information security management systems: Requirements |
| Published by | ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission) |
| Latest version | 2022 edition, plus a 2024 amendment on climate change |
| What it contains | Clauses 4 to 10 (how to run the ISMS) and Annex A (93 security controls) |
| Can you get certified? | Yes, by an accredited certification body |
| How long a certificate lasts | 3 years, with yearly surveillance audits |
| Legally required? | No, but often required by customers and contracts |
| How widely used | About 96,700 valid certificates covering nearly 180,000 sites worldwide (ISO Survey 2024) |
Sources: ISO/IEC 27001 and the ISO Survey
What Does ISO 27001 Mean?
ISO 27001 means the information security standard numbered 27001, published jointly by ISO and IEC. ISO and IEC are international bodies that write standards. The number 27001 places it in the ISO/IEC 27000 family, a group of standards about information security. So "ISO 27001" and "ISO/IEC 27001" are the same standard. The short name is just easier to say.
The standard was first published in 2005, based on the British standard BS 7799. The official text is only 19 pages long and is sold by ISO on its ISO/IEC 27001 page. Free "ISO 27001 PDF" downloads found online are usually old versions, summaries, or templates, not the official standard.
What Is an ISMS? The Core of ISO 27001
An ISMS is the set of policies, processes, people, and tools a company uses to manage information security risks in a planned way. ISO 27001 does not hand you a fixed list of rules. It tells you how to build this system for your own business, run it, and keep improving it.
The Three Goals: Confidentiality, Integrity, Availability
Every ISO 27001 decision comes back to three goals, often called the CIA triad:
- Confidentiality: only the right people can see the information. Think hackers draining bank accounts after stealing credentials.
- Integrity: information stays accurate and complete. Imagine stock exchange software losing two years of transactions.
- Availability: authorized people can reach information when they need it. Remember undersea cables getting damaged and cutting internet access?
What an ISMS Covers: The Four Ps
A real-world ISMS covers the four Ps:
- People: employees, contractors, and leadership teams
- Policies and processes: documented rules and workflows
- Products and technology: encryption, access management, monitoring tools
- Partners: vendors and third parties handling your data
Without an ISMS, security tends to become a patchwork of tools, each bought to fix one problem. ISO 27001 makes you look at the whole picture and manage it as one system.
How Is ISO 27001 Structured?
ISO 27001 has two parts: the main clauses, which describe how to run the ISMS, and Annex A, a list of 93 security controls. Clauses 0 to 3 cover the introduction, scope, references, and terms. Clauses 4 to 10 hold the requirements an auditor checks.
Clauses 4 to 10: The Mandatory Requirements
- Clause 4, Context: understand your business and who depends on your security, then set the ISMS scope.
- Clause 5, Leadership: top management approves the security policy and owns the ISMS.
- Clause 6, Planning: assess risks, decide how to treat them, and set security objectives.
- Clause 7, Support: provide people, skills, awareness, communication, and documents.
- Clause 8, Operation: carry out your plans, risk assessments, and risk treatment.
- Clause 9, Performance evaluation: monitor results, run internal audits, and hold management reviews.
- Clause 10, Improvement: fix problems (nonconformities) and keep improving.
Every one of these clauses is mandatory for certification. Unlike Annex A controls, you cannot leave any of them out.
Annex A: The 93 Security Controls
Annex A lists 93 controls grouped into four themes. You don't have to use all of them. You pick the ones your risk assessment shows you need, and you explain each choice, including exclusions, in a document called the Statement of Applicability.
| Theme | Number of controls | Examples |
|---|---|---|
| Organizational (5.x) | 37 | Information security policies (5.1), supplier relationships (5.19), cloud services security (5.23) |
| People (6.x) | 8 | Screening (6.1), security awareness and training (6.3), remote working (6.7) |
| Physical (7.x) | 14 | Physical entry (7.2), equipment maintenance (7.13), secure disposal (7.14) |
| Technological (8.x) | 34 | Malware protection (8.7), use of cryptography (8.24), secure coding (8.28) |
For every control explained, see our guide to ISO 27001 requirements and the 93 Annex A controls.
Required Policies, Documents, and Records
The 2022 revision reduced mandatory documents. Core documents include the ISMS scope, information security policy, risk assessment and risk treatment results, Statement of Applicability, security objectives, internal audit results, and management review results. Proper documentation demonstrates compliance and ensures smooth audits.
ISO 27001 Risk Assessment in Brief
An ISO 27001 risk assessment is a repeatable way to find what could go wrong with your information and decide what to do about it. Clause 6.1.2 sets out how the process must work. Clause 8.2 requires you to run it at planned intervals and after major changes.
- List your assets in scope: customer data, source code, laptops, cloud accounts, key suppliers.
- Find threats and weaknesses, for example an unpatched server exploited by ransomware.
- Score each risk using a 5×5 likelihood-impact matrix, and compare it with how much risk the business accepts.
- Treat the risk: reduce it with controls, transfer it (insurance or contracts), accept it, or avoid it. Record each decision in a risk treatment plan with an owner and a date.
If your last assessment felt like a box-ticking exercise, read why risk assessments fail and how to fix them, and our guide to risk mitigation strategies.
Who Needs ISO 27001?
ISO 27001 is most useful for companies that handle other organizations' data and sell to customers who want proof of security. Typical cases include:
- B2B SaaS and cloud companies selling to enterprise companies, especially in Europe, the UK, and Asia
- Clients ask for it: it shows up in security questionnaires and vendor reviews
- Contracts require it: enterprise or government tenders list it as mandatory
- You handle sensitive info: financial, personal, or intellectual property data
- Market access matters: certain sectors won't work with uncertified vendors
If you're a startup weighing whether now is the right time to start, see our dedicated guide on ISO 27001 for startups for timing, cost, and how it compares to SOC 2.
Is ISO 27001 a Legal Requirement?
No, ISO 27001 is a voluntary standard and is not required by law in the US or most other countries. It becomes required in practice when a customer contract or a government tender asks for it. Some regulations point to ISO 27001 as a good way to show you protect data, but they rarely make the certificate itself mandatory.
What Is ISO 27001 Certification?
ISO 27001 certification means an accredited certification body has audited your ISMS and confirmed it meets every requirement of the standard. You receive a certificate that names your ISMS scope. It is valid for three years, as long as you pass a surveillance audit each year.
ISO 27001 Compliance vs Certification
ISO 27001 compliance means you follow the standard; certification means an independent auditor has checked and confirmed it. A company can be compliant without being certified, but customers can only verify a certificate.
Accreditation is a third layer. The certification body itself should be accredited by a national body, such as ANAB in the US or UKAS in the UK. Ask for proof before you sign. Certificates from unaccredited bodies carry little weight with enterprise customers.
How the ISO 27001 Certification Audit Works
- Build and run your ISMS: scope, risk assessment, Statement of Applicability, controls, and policies.
- Internal audit and management review: check the ISMS yourself before the auditor does.
- Stage 1 audit: the auditor reviews your documents and confirms you're ready.
- Stage 2 audit: the auditor tests whether the ISMS works in practice. Any major nonconformities must be fixed before the certificate is issued.
- Surveillance audits: a smaller audit in each of the next two years.
- Recertification: a full audit before the three years run out.
For a step-by-step walkthrough, see our ISO 27001 certification process guide. If you are comparing certification bodies, our BSI ISO 27001 guide shows what one large body offers.
Getting the Scope Right
Your ISMS scope shows up on your certificate, proof for customers of what you actually protect. It covers people, processes, technology, and locations. Smart scoping focuses resources where they matter and sets clear boundaries. Reality check: if your scope only covers a cupboard but customers use your SaaS, your certification counts for nothing. Align it with real services and products your customers rely on.
How Long Does ISO 27001 Certification Take?
Most companies take about 3 to 6 months to get their first ISO 27001 certificate. It can take 6 to 12 months if you start with weak security basics or a large, complex setup. The audits themselves take only days. Most of the time goes into building the ISMS and running it long enough to show evidence.
How Much Does ISO 27001 Cost?
ISO 27001 has no fixed price; the cost depends on your size, your scope, and how much of the work you do in house. The main costs are certification body audit fees, staff time, tools, outside help, and fixing the gaps you find. Our ISO 27001 for startups guide estimates a typical all-in range of $30,000 to $150,000 for startups. Treat that as an estimate, not a quote.
How Hard Is It to Get ISO 27001 Certified?
ISO 27001 is moderately hard to get, mostly because of the steady effort it needs, not the technical controls. The usual sticking points are getting leadership time, drawing the scope, keeping evidence up to date, and finishing the internal audit before Stage 2.
Example: A 90-Day ISO 27001 Plan for a Small, Ready Team
This is an example plan for a small company that already has basic security in place and one person who owns the project. Most companies need longer. First, get executives on board and secure the budget.
- Day 30: Security policy approved, scope defined, context documented, gap assessment complete
- Day 60: Full risk assessment done, Statement of Applicability approved, core procedures written
- Day 90: ISMS fully operational, internal audit complete, Stage 1 audit scheduled
Your risk assessment and Statement of Applicability are make-or-break. Spend the most time on those two documents. Auditors read them first.
Benefits of ISO 27001
The main benefit of ISO 27001 is proof: customers can see that your security is managed and independently checked, not just claimed.
- Close deals faster: enterprise clients trust certified suppliers, reducing time spent on security questionnaires
- Open doors: many contracts require ISO 27001, especially in regulated industries
- Fewer surprises: risks are found and treated before they turn into incidents
- Clear ownership: roles, policies, and evidence live in one place
- Recognized worldwide: one certificate is understood by customers in most countries
Is ISO 27001 Worth It?
ISO 27001 is worth it when customers ask for it or when it would shorten your sales cycle. It is less urgent if your buyers are mainly US companies that only ask for SOC 2. Remember it is not a one-time project: the certificate needs a surveillance audit every year.
Is ISO 27001 Still Relevant?
Yes, ISO 27001 is still the world's best-known information security standard. It was updated in 2022, amended in 2024, and the number of certificates keeps growing.
ISO 27001 Versions: 2005, 2013, and 2022
The current version is ISO/IEC 27001:2022, with a 2024 amendment about climate change.
- 2005: first edition, based on BS 7799-2
- 2013: second edition, with 114 controls in 14 domains
- 2022: third edition, published in October 2022. It cut the controls to 93 in four themes and added 11 new ones, such as threat intelligence (5.7) and data masking (8.11).
- 2024 Amendment 1: asks organizations to consider whether climate change is a relevant issue for their ISMS
Certificates issued against the 2013 version had to move to the 2022 version by October 31, 2025. A 2013 certificate is no longer valid.
ISO 27001 vs Other Standards and Frameworks
ISO 27001 vs ISO 27002
One builds the ISMS framework and is certifiable; the other guides control implementation in detail. Here's the breakdown:
| Aspect | ISO 27001 | ISO 27002 |
|---|---|---|
| Purpose | Defines ISMS requirements and certifiable framework | Provides detailed guidance on implementing security controls |
| Certification | Can be certified | Cannot be certified |
| Risk Focus | Requires risk assessment to determine needed controls | Lists controls without assessing organizational risk |
| Level of Detail | High-level; one or two sentences per control in Annex A | In-depth; entire page per control with implementation advice |
| Role | Skeleton of your ISMS | Muscle showing how to put controls into practice |
Start with ISO 27001 to set up your ISMS framework. Then use ISO 27002 as your practical guide to implement the controls.
ISO 27001 vs SOC 2, NIST, ISO 9001, and Cyber Essentials
| Framework | What it is | Certificate? | Best fit |
|---|---|---|---|
| ISO 27001 | International standard for running an ISMS | Yes | Proving security to customers worldwide |
| SOC 2 | Audit report from a CPA firm against the AICPA Trust Services Criteria | No, it's an attestation report | Selling to US companies |
| NIST CSF | Voluntary US cybersecurity framework | No | Structuring a security program |
| NIST SP 800-53 | Detailed control catalogue for US federal systems | No, systems are assessed, not certified | US government and its contractors |
| ISO 9001 | Quality management standard | Yes | Product and service quality, not security |
| Cyber Essentials | UK government-backed scheme covering five basic technical controls | Yes (UK scheme) | UK companies and UK public sector contracts |
Which is better, ISO 27001 or NIST? ISO 27001 is better when you need a certificate customers recognize; NIST is better as a free, detailed guide for designing controls. Many companies use both: NIST to shape the controls, ISO 27001 to certify the program. For the SOC 2 decision, see SOC 2 or ISO 27001: which to choose.
Getting Started with ISO 27001
If customers are asking for ISO 27001, start with three steps. Agree the scope with the people who sell and run your product. Name one leader who owns the ISMS. Then run a gap assessment against clauses 4 to 10 and Annex A, so you know how far you are from Stage 1. The ISO 27001 framework guide pulls all our ISO 27001 resources into one place.
UprootSecurity helps companies get ISO 27001 certified without hiring a full-time compliance team. Our platform keeps your policies, risk register, and evidence in one place and tracks control health between audits, so a surveillance audit isn't a scramble. Our security team supports the risk assessment and runs the penetration testing auditors often ask to see. Because ISO 27001 controls overlap heavily with SOC 2 and HIPAA, the same work can support those audits too. If an enterprise deal is waiting on your certificate, we can help you plan the fastest realistic route.
Frequently Asked Questions
ISO 27001 is a rulebook for running information security as a managed system. You find out what information you hold, what could go wrong with it, and which safeguards reduce those risks. Then you write it down, keep it running, and check it regularly. An independent auditor can confirm you do all this and issue a certificate.
Yes, they are the same standard. ISO/IEC 27001 is the full name, because ISO and the International Electrotechnical Commission (IEC) publish it together. ISO 27001 is simply the short version people use in conversation, on websites, and in sales questionnaires. The current edition is ISO/IEC 27001:2022.
No, ISO 27001 is voluntary and not required by law in the US or most countries. It often becomes required in practice, because enterprise customers, government tenders, and regulated industries ask suppliers for a certificate before they sign. Some laws point to it as a good way to show data is protected.
ISO 27001:2022 has 93 controls in Annex A, grouped into four themes: 37 organizational, 8 people, 14 physical, and 34 technological. The older 2013 version had 114 controls. You only apply the controls your risk assessment shows you need, and you explain each choice in your Statement of Applicability.
An ISO 27001 certificate is valid for three years. During that time you must pass a surveillance audit each year to keep it. Before the three years end, you go through a full recertification audit. If you miss it, the certificate lapses and you have to start the certification process again.
Most companies take about 3 to 6 months to get their first ISO 27001 certificate. Larger companies, or those starting with weak security basics, often need 6 to 12 months. The audits take only days. Most of the time goes into building the ISMS and running it long enough to produce evidence.
ISO 27001 has no fixed price. Costs depend on company size, scope, and how much work you do yourself. They include audit fees, staff time, tools, outside help, and fixing gaps. For startups, a typical all-in estimate is $30,000 to $150,000. Get quotes from accredited certification bodies for your real number.
ISO 27001 is moderately hard, mainly because it needs steady effort over months rather than deep technical skill. The hardest parts are usually getting leadership time, setting a sensible scope, keeping evidence current, and finishing internal audits before Stage 2. Companies with a clear owner and good tooling find it much easier.
ISO 27001 is worth it if customers ask for it or if it would shorten your sales cycle, especially with buyers in Europe, the UK, or regulated industries. It is less urgent if your buyers only ask for SOC 2. Budget for ongoing effort, because the certificate needs a surveillance audit every year.
Neither is better overall; they do different jobs. ISO 27001 gives you a certificate that customers worldwide recognize. NIST frameworks are free, detailed guides for designing controls and are common in US government work, but you cannot be certified against them. Many companies use NIST to shape controls and ISO 27001 to certify them.
Usually not, unless a UK customer or UK government contract asks for Cyber Essentials by name. ISO 27001 covers far more ground. Cyber Essentials is a UK scheme that checks five basic technical controls, such as firewalls and security updates. Some UK companies hold both, because certain tenders require Cyber Essentials specifically.
ISO 27001 does not name penetration testing as a mandatory requirement. However, controls such as management of technical vulnerabilities (8.8) and security testing (8.29) expect you to find and fix weaknesses. A penetration test is the most common way to show auditors you do this, so many auditors expect one.
