ISO 27001 · THE STANDARD ITSELF
The standard is shorter than the guides written about it. Most of what people call an ISO 27001 requirement comes from an auditor, a tool or a template. It does not come from the text. This guide separates the two.
TL;DR
ISO/IEC 27001 asks for two things. Clauses 4 to 10 define the system you build and run. Annex A lists 93 controls you check your own choices against. Only the clauses are binding. Annex A is a cross-check, not a shopping list.
Sources: ISO/IEC 27001:2022 · ISO Survey 2024
The ISO 27001 requirements sit in Clauses 4 to 10 #
Every binding rule lives there. Each one uses the word “shall”. If a clause says shall, an auditor will ask you to show it.
The clauses follow the same shape as ISO 9001 and ISO 42001. Learn the pattern once. You can then read any of them.
| Clause | What it asks for | What it makes you write down |
|---|---|---|
| 4 Context | Name your internal and external issues, your interested parties and what they need | The ISMS scope |
| 5 Leadership | Top management owns the system and assigns the roles | Information security policy |
| 6 Planning | Assess risk, treat it, set goals | Risk method, risk results, treatment plan, Statement of Applicability |
| 7 Support | Fund it, staff it, train it, control your documents | Skills and awareness records |
| 8 Operation | Run the processes and keep the receipts | Records of risk work |
| 9 Performance | Measure it, audit it, review it at the top | Audit plan, audit results, management review |
| 10 Improvement | Fix what breaks and stop it breaking again | Nonconformity and corrective action records |
That right-hand column answers the question teams ask first. What do we have to write down?
The standard names about a dozen pieces of documented information. Your scope. Your policy. Your risk method and its results. Your treatment plan. Your Statement of Applicability. Your goals. Your training records. Your audit plan and results. Your management review. Your corrective actions.
One clause does more work than the rest. Clause 6.1.3 is where risk turns into controls. You pick controls that treat the risks you found. Then you check that set against Annex A. Then you record both in the Statement of Applicability. Teams who start at Annex A and work backwards invert this, and the audit finds the seam.
Everything else in a policy library is your own choice. You also carry the cost of keeping it current. A 200 page policy set is not a higher grade of compliance. It is a bigger surface for practice to drift away from paper.
What the 93 Annex A controls cover #
Annex A sits at the back of the standard. It sorts 93 controls into four themes.
| Theme | Controls | What sits there |
|---|---|---|
| A.5 Organizational | 37 | Policies, threat intel, asset management, supplier terms, incident handling, continuity, legal duties |
| A.6 People | 8 | Screening, terms of employment, awareness training, discipline, duties after someone leaves |
| A.7 Physical | 14 | Perimeters, entry controls, secure areas, equipment, clear desk and clear screen |
| A.8 Technological | 34 | Access rights, log-in, malware, patching, logging, network security, secure coding |
What trips people up
Annex A is a reference catalogue. Clause 6.1.3 c) asks you to compare the controls you picked against Annex A. You confirm you missed nothing. You may drop any control if you write down why. You may also add controls that Annex A does not hold. Teams who read the 93 as a to-do list lose months on controls nobody asked for.
The Statement of Applicability is where that check lands. Our guide to the Statement of Applicability under Clause 6.1.3 d) covers what it must hold.
How to read a control number #
Control numbers look cryptic. They are not. The first digit is the theme. The second is the control inside it.
A.5.7 is the seventh control in the Organizational theme, which is threat intelligence. A.8.28 is the twenty-eighth in the Technological theme, which is secure coding. Annex A numbers ran to A.18 in the 2013 edition, so anything above A.8 you see quoted today comes from the old set.
Each control also carries four tags in the 2022 text. Control type. Security property. Cybersecurity concept. Operational capability. Few auditors ask about the tags. They help when you map one control set onto another framework.
What changed in 2022, and the amendment most guides miss #
The 2022 edition cut the count from 114 to 93. That looks like removal. It was a merge. The standard folded 57 controls into 24, moved the rest, and added 11 that did not exist before.
The new 11 are threat intelligence (A.5.7), cloud services (A.5.23) and ICT readiness for continuity (A.5.30). Then physical security monitoring (A.7.4). Then configuration management (A.8.9), information deletion (A.8.10), data masking (A.8.11) and data leakage prevention (A.8.12). Then monitoring (A.8.16), web filtering (A.8.23) and secure coding (A.8.28).
The 14 old domains became 4 themes. Each control now carries tags for control type, security property and capability. You can filter the catalogue in more than one direction.
Amendment 1 added a climate rule in 2024 #
ISO published ISO/IEC 27001:2022/Amd 1:2024 on 23 February 2024. It changed two sentences across about 30 standards at once.
Clause 4.1 now ends with a rule. The organization shall determine whether climate change is a relevant issue. Clause 4.2 adds that interested parties can have needs tied to climate change.
The word shall matters here. You do not have to decide that climate change affects your ISMS. You do have to show that you weighed it. One paragraph in your context record is enough. Leave it out and you hand an auditor a finding.
The 2013 edition expired on 31 October 2025 #
The transition window closed on 31 October 2025. Certificates issued against ISO/IEC 27001:2013 are no longer valid. If a supplier hands you a 2013 certificate today, it proves nothing about where they stand now.
Check the edition on any certificate you receive. Check the accreditation mark too. Both take seconds. Both get skipped.
How the certificate cycle works #
Certification runs on a three year cycle. An accredited body audits you in two stages, then returns each year.
The readiness audit #
Goal: prove the system exists on paper.
The auditor reads your scope, your policy, your risk work and your Statement of Applicability. They look for gaps before the real test. Most teams get findings here. That is what this stage is for.
The certification audit #
Goal: prove the system runs.
The auditor now samples evidence. They want proof that controls ran over time, not that a document exists. Access reviews. Training records. Incident tickets. Board minutes.
What goes wrong: a team writes the policy set in month one and starts collecting evidence in month five. The auditor asks for six months of records and the gap shows.
After Stage 2 the body issues a certificate valid for three years. Surveillance audits follow in year one and year two. A full recertification audit falls in year three. Your certificate stays live only while you keep passing them.
One detail catches teams out. The certificate carries your scope statement, and a buyer will read it. Write a scope that names the product and the systems behind it, not one that names a floor of a building. Our guide to defining the ISMS scope under Clause 4.3 works through the wording.
Timelines vary too much for a single number. A small team with one product and cloud infrastructure moves faster than a firm with six offices and a data centre. What sets the floor is evidence. Controls have to run long enough to leave a record an auditor can sample.
Four things the standard does not say #
These four gaps cause most of the wasted effort we see.
- It does not require the PDCA cycle. The 2005 edition put Plan Do Check Act in its opening. The 2013 and 2022 editions never name it. The clause order still follows that logic. So the model is a fair way to teach the system. No auditor will ask you for a PDCA diagram.
- It does not mandate a risk method. Clause 6.1.2 asks you to define one and write it down. You then apply it the same way each time, so results line up. ISO/IEC 27005:2022 offers guidance. Guidance is not a rule. A five by five matrix passes. So does a scenario based method.
- It does not require a tool. Spreadsheets certify. What a platform buys you is the evidence trail and the hours back. That case stands on its own. It does not need the standard to ask for one.
- It does not say where your data lives. Annex A holds no residency control. Residency reaches your ISMS through A.5.31, which covers legal and contract duties. A certificate on its own tells a buyer nothing about which country holds their records.
That last gap surprises most buyers. We cover the same blind spot from the other side in what a SOC 2 report does and does not prove.
Who accredits the certificate #
A certificate is worth the accreditation behind it. A body must meet ISO/IEC 17021-1 first, then earn accreditation. In Canada that comes from the Standards Council of Canada. In the United States it comes from ANAB.
Both sign the IAF Multilateral Recognition Arrangement. That is what makes a certificate from either one count with a buyer in Frankfurt or Chicago.
“Certification to ISO/IEC 27001 by SCC-accredited certification bodies is widely accepted internationally.”
Standards Council of CanadaOn ISMS accreditation
A certificate is not proof that you meet privacy law. In Canada that means PIPEDA, Quebec Law 25 and Ontario’s PHIPA. In the United States it means HIPAA and the state privacy statutes. Each sets duties the standard never mentions. Breach reporting clocks. Rules on moving data across borders. Consent.
Your ISMS is where you track those duties, under A.5.31. The certificate does not discharge them. A team selling across the border needs the certificate and an answer on the law that applies. The two come from different places.
Sector rules stack on top. A federally regulated bank or insurer in Canada answers to OSFI Guideline B-13 on technology risk and B-10 on third party risk. A US health provider or its vendors answer to the HIPAA Security Rule. None of them accepts an ISO 27001 certificate in place of its own requirements. What the certificate buys you there is a shorter conversation, because the evidence already exists.
Plan for the questionnaire either way. Most buyers still send one. A certificate answers perhaps half of it. The rest asks where data sits, who can reach it, and what happens on a breach.
Frequently asked questions #
Are the 93 Annex A controls mandatory?
No. Clauses 4 to 10 are binding. Annex A is a reference catalogue you compare your chosen controls against, under Clause 6.1.3 c). You may drop any control if you write down why. You may also add controls Annex A does not list.
What documents does ISO 27001 require?
About a dozen. The scope. The information security policy. The risk method and its results. The treatment plan. The Statement of Applicability. Security goals. Training records. Monitoring results. The audit plan and its results. Management review records. Nonconformity and corrective action records.
Did ISO 27001 remove the PDCA cycle?
The 2005 edition named Plan Do Check Act in its opening. The 2013 and 2022 editions do not name it. The clause structure still follows the same logic, so PDCA remains a fair teaching model. It is not a rule and no auditor will ask to see it.
What happened to ISO 27001:2013 certificates?
They expired. The transition window closed on 31 October 2025, so certificates issued against the 2013 edition are no longer valid. Any certificate you see today should cite ISO/IEC 27001:2022 and carry an accreditation mark.
Does ISO 27001 require data residency?
No. Annex A holds no residency control. Residency reaches your ISMS through A.5.31, which covers legal, regulatory and contract duties. If a law or a contract requires hosting in a particular country, you record it there and control against it. The certificate alone proves nothing about location.
What does the 2024 climate amendment change?
Amendment 1, published on 23 February 2024, adds two sentences. Clause 4.1 requires you to determine whether climate change is a relevant issue. Clause 4.2 notes that interested parties can have climate related needs. You may decide it is not relevant. You must show that you weighed it.
How long does an ISO 27001 certificate last?
Three years. Surveillance audits fall in year one and year two. A full recertification audit falls in year three. The certificate stays live only while you keep passing them.
Key takeaways #
- Clauses 4 to 10 are the ISO 27001 requirements. Annex A is the cross-check.
- The 2022 edition holds 93 controls in 4 themes, and 11 of them are new.
- Amendment 1:2024 makes you weigh climate change under Clause 4.1.
- ISO 27001:2013 certificates expired on 31 October 2025.
- The standard names no risk method, no tool and no PDCA rule.
- Nothing in ISO 27001 governs where your data sits. Law and contract do, through A.5.31.
- SCC in Canada and ANAB in the United States accredit the bodies, and the IAF arrangement makes the certificate travel.
Read the standard once, then get the scope right #
Nank.ai runs ISO 27001 programmes for teams in Canada and the United States. A compliance manager owns the work, backed by AI agents that keep the evidence current. Start with a free gap analysis.
