Compliance › ISO 27001 › Requirements
ISO 27001 requirementsISO 27001 requirements: clauses 4 to 10, the mandatory documents and where Annex A fits
People mix up requirements and controls, and many guides disagree on which documents are mandatory. This page goes clause by clause through ISO/IEC 27001:2022, separates what the standard actually requires from what auditors commonly expect, and shows what changed from 2013.
Free for buyers · provider-funded introductions · Updated October 2026
The requirements at a glance
MandatoryClauses 4 to 10
Clauses 1 to 3Scope, references, terms. No requirements
Annex A93 controls, chosen through your risk assessment
DocumentsNamed in the clauses. Not every guide agrees
VersionISO/IEC 27001:2022, with a 2024 climate amendment
NumberingClause 10 order changed from 2013
The short answer
What are the requirements of ISO 27001?
The requirements of ISO 27001 are clauses 4 to 10 of the standard. You must meet every one of them to be certified. They cover understanding your context and scope, leadership, risk assessment and treatment, support, operation, performance evaluation and improvement. Annex A is separate: it lists 93 controls you select through your risk assessment, and you record your choices in the Statement of Applicability.
- Requirements are the clauses. They are mandatory. Controls are Annex A. They are chosen by risk.
- The clauses name the documented information you must keep. Many guides list more as mandatory than the standard does.
- The 2022 version changed some numbering. Guides that still use the 2013 order of clause 10 are out of date.
The structure
The seven mandatory clauses on one page
Read them as a cycle: set up, enable, run and check, improve.
Clauses 4 and 5
Clauses 4 and 5: context and leadership
Where the ISMS gets its boundaries and its mandate.
| Sub-clause | What it requires | What auditors look for |
|---|---|---|
| 4.1 Organization and its context | Determine the external and internal issues that matter to your purpose and affect the ISMS. The 2024 climate amendment adds deciding whether climate change is relevant | A record of the issues you considered |
| 4.2 Interested parties | Determine which parties matter, what they require, and which of those requirements the ISMS will address | A list of interested parties. No document is mandated, but it is the usual proof |
| 4.3 Scope | Set the boundaries and applicability of the ISMS, considering 4.1, 4.2 and interfaces with other organisations | The scope statement. This one is mandatory documented information |
| 4.4 The ISMS | Establish, implement, maintain and continually improve the ISMS, including the processes needed | The ISMS in operation |
| 5.1 Leadership and commitment | Top management aligns the ISMS with strategy, provides resources, communicates its importance and promotes improvement | Evidence leaders are involved, not delegated |
| 5.2 Policy | An information security policy that includes objectives or a framework for them, and commitments to meet requirements and improve | The policy. Mandatory documented information, communicated inside the organisation |
| 5.3 Roles and authorities | Assign and communicate responsibilities, including who reports ISMS performance to top management | Named roles. No document is mandated |
Clause summaries follow the structure in ISO/IEC 27001:2022 and certification body transition guidance, such as the ISO standard page. Read the standard for exact wording.
Clause 6
Clause 6: planning, where the risk work lives
The longest clause and the one that decides your control set.
| Sub-clause | What it requires | What auditors look for |
|---|---|---|
| 6.1.1 General | Consider the issues from 4.1 and the parties from 4.2 and decide the risks and opportunities to address | That planning follows from context |
| 6.1.2 Risk assessment | Define and apply a repeatable process: risk criteria, identify risks to confidentiality, integrity and availability, assign risk owners, analyse and evaluate | The process description and the results. Both are mandatory documented information |
| 6.1.3 Risk treatment | Choose treatment options, determine the controls needed, compare them with Annex A to check none is missed, produce the Statement of Applicability and a risk treatment plan, and get risk owners to approve the plan and accept residual risk | The Statement of Applicability, the plan and the owner approvals |
| 6.2 Objectives | Set measurable objectives where practicable, with who, what, when and how results are evaluated | Objectives with owners. Mandatory documented information |
| 6.3 Planning of changes | When the ISMS needs changing, make the change in a planned way. New in the 2022 version | Evidence that changes are planned, not ad hoc |
The Statement of Applicability must give, for the Annex A controls, which ones apply, why, whether they are implemented, and why any excluded control is excluded. It is the document auditors read first. See how it fits the audit in our certification process guide.
Clauses 7 and 8
Clauses 7 and 8: support and operation
The resources behind the ISMS, then the ISMS actually running.
| Sub-clause | What it requires | What auditors look for |
|---|---|---|
| 7.1 Resources | Determine and provide the resources the ISMS needs | Budget, people and tools matched to the scope |
| 7.2 Competence | Decide the competence needed, ensure people have it through education, training or experience, and act where gaps exist | Evidence of competence. Mandatory documented information |
| 7.3 Awareness | People know the policy, their contribution and the effect of not conforming | Staff who can explain it. Training records are the usual proof |
| 7.4 Communication | Decide what, when, with whom and how to communicate on the ISMS | A communication approach. No document is mandated |
| 7.5 Documented information | Include the documented information the standard requires plus what you decide you need, and control its creation, update, access and retention | Document control that works in practice |
| 8.1 Operational planning and control | Plan, implement and control the processes that meet requirements, manage planned and unintended changes, and control externally provided processes, products or services | Processes running as planned, with records to the extent needed for confidence |
| 8.2 Risk assessment | Run risk assessments at planned intervals or when significant change happens or is proposed | Dated results. Mandatory documented information |
| 8.3 Risk treatment | Implement the risk treatment plan | Results of treatment. Mandatory documented information |
Clause 7.5.1 is why the answer to how much documentation you need is not the same for every organisation: the extent depends on size, activities and complexity.
Clauses 9 and 10
Clauses 9 and 10: evaluation and improvement
How you prove the ISMS works and what you do when it does not.
| Sub-clause | What it requires | What auditors look for |
|---|---|---|
| 9.1 Monitoring and measurement | Decide what to monitor, how, when and who analyses it, then evaluate performance and effectiveness | Results. Mandatory documented information |
| 9.2 Internal audit | Audit at planned intervals against your own requirements and the standard, with a programme, defined criteria and scope, objective and impartial auditors, and reporting to management | The programme and the results. Both mandatory documented information |
| 9.3 Management review | Top management reviews the ISMS at planned intervals. Inputs include earlier actions, changes in issues and interested-party needs, performance trends, audit results, risk results and improvement opportunities. Outputs are decisions on improvement and change | Minutes or results of the review. Mandatory documented information |
| 10.1 Continual improvement | Continually improve the suitability, adequacy and effectiveness of the ISMS | Improvements that trace back to findings and reviews |
| 10.2 Nonconformity and corrective action | React to nonconformities, deal with causes, check the action worked and change the ISMS if needed | The nature of each nonconformity and the results of the action. Mandatory documented information |
In 2022, 10.1 is continual improvement and 10.2 is nonconformity and corrective action. In 2013 the order was the other way round, so older guides cite 10.1 for nonconformities.
Documentation
Which ISO 27001 documents are actually mandatory?
Only the clauses create mandatory documentation. Annex A controls add documents depending on your choices.
| Clause | Documented information required | Note |
|---|---|---|
| 4.3 | Scope of the ISMS | Mandatory |
| 5.2 | Information security policy | Mandatory |
| 6.1.2 | Risk assessment process | Mandatory |
| 6.1.3 | Risk treatment process and the Statement of Applicability | Mandatory. Keep the treatment plan and owner approvals with them |
| 6.2 | Information security objectives | Mandatory |
| 7.2 | Evidence of competence | Mandatory record |
| 8.2 and 8.3 | Results of risk assessment and risk treatment | Mandatory records |
| 9.1 | Monitoring and measurement results | Mandatory record |
| 9.2 | Internal audit programme and results | Mandatory records |
| 9.3 | Results of management reviews | Mandatory record |
| 10.2 | Nonconformities and the results of corrective action | Mandatory records |
| 7.5.1 | Anything else you decide the ISMS needs | Your decision |
Often listed as mandatory, but the clause asks for an activity, not a document
| Item | Clause | What the clause actually requires |
|---|---|---|
| Register of interested parties | 4.2 | Determine the parties and their requirements |
| Roles and responsibilities document | 5.3 | Assign and communicate responsibilities |
| Awareness records | 7.3 | People are aware. Evidence is still wise |
| Communication plan | 7.4 | Decide what, when, with whom and how |
| Context analysis | 4.1 | Determine the issues |
Auditors still expect you to show how you met these requirements, and a short record is the usual way. The distinction matters when you decide how much paperwork to create, and when a vendor quote bundles templates you may not need.
Annex A
Where Annex A fits: controls, not requirements
Annex A lists 93 controls. You select from it through risk, you do not tick every one.
| Theme | Controls | Typical territory |
|---|---|---|
| Organizational | 37 | Policies, asset management, access, suppliers, incident management, compliance |
| People | 8 | Screening, terms of employment, awareness, leaving the organisation |
| Physical | 14 | Secure areas, equipment, disposal |
| Technological | 34 | Networks, cryptography, secure development, change management |
- You must compare your selected controls with Annex A and justify every exclusion in the Statement of Applicability.
- Annex A is a reference list, not a ceiling. You can add controls the list does not contain.
- The documents your selected controls imply, such as acceptable use rules or an incident procedure, depend on your own list.
The control themes and the count are covered on the ISO 27001 hub. For every control, read the Annex A controls guide.
2022 changes
What changed in the requirements from 2013 to 2022
Mostly clarification, with a few real additions.
| What changed | Where | Effect |
|---|---|---|
| Clause 10 order swapped | 10.1 and 10.2 | Continual improvement is now 10.1, nonconformity is 10.2. Requirements unchanged |
| Planning of changes added | 6.3 | New requirement to carry out ISMS changes in a planned way |
| Interested-party requirements | 4.2 | You must also decide which of their requirements the ISMS addresses |
| Internal audit and review split into subclauses | 9.2 and 9.3 | Clarifies inputs and results. Adds no new requirements per transition guidance |
| Externally provided processes | 8.1 | Wording moves from outsourced processes to externally provided processes, products or services |
| Annex A restructured | Annex A | From 114 controls in 14 groups to 93 controls in four themes |
| Climate amendment, 2024 | 4.1 and 4.2 | Decide whether climate change is relevant and whether interested parties have climate requirements. Per practitioner summaries, no new recertification is needed. Check the amendment text |
Clause changes follow certification body transition guidance, such as the Cloud Security Alliance overview and SGS transition material. The 2013 transition ended 31 October 2025, so 2022 is the only version you can certify against.
FAQ
ISO 27001 requirements: common questions
What are the requirements of ISO 27001?
Clauses 4 to 10 of ISO/IEC 27001:2022: context of the organization, leadership, planning, support, operation, performance evaluation and improvement. All are mandatory for certification. Clauses 1 to 3 hold no requirements. Annex A is a separate list of 93 controls selected through risk.
What is the difference between ISO 27001 requirements and controls?
Requirements are the clauses 4 to 10 and are mandatory. Controls are the 93 items in Annex A. You select controls through your risk assessment, record the choice in the Statement of Applicability and justify any exclusion.
Which ISO 27001 documents are mandatory?
The clauses require documented information for the ISMS scope (4.3), information security policy (5.2), risk assessment process (6.1.2), risk treatment process and Statement of Applicability (6.1.3), objectives (6.2), evidence of competence (7.2), risk assessment and treatment results (8.2, 8.3), monitoring results (9.1), internal audit programme and results (9.2), management review results (9.3) and nonconformities and corrective actions (10.2), plus anything else you decide the ISMS needs under 7.5.1.
Is a risk register mandatory?
The standard requires documented information on the risk assessment process and the results of risk assessments. It does not name a risk register, but a register is the usual way to hold the results.
Is the Statement of Applicability mandatory?
Yes. Clause 6.1.3 requires a Statement of Applicability that lists the necessary controls, why they are included, whether they are implemented and why any Annex A control is excluded.
Are all 93 Annex A controls mandatory?
No. You compare your risks with Annex A and select the controls you need. You must justify every exclusion in the Statement of Applicability, and you can add controls the list does not contain.
Is a communication plan or a register of interested parties mandatory?
The clauses (7.4 and 4.2) require you to determine and act, not to hold a named document. Auditors still expect to see how you did it, and a short record is the usual proof.
Do I need to document everything?
No. Clause 7.5.1 says the extent of documented information depends on the size of the organisation, its activities and the complexity of its processes. Document what the standard requires and what you need for the ISMS to work.
What changed in the ISO 27001:2022 requirements?
Clause 10 swapped order so 10.1 is continual improvement and 10.2 is nonconformity, clause 6.3 on planning of changes was added, 4.2 now asks which interested-party requirements the ISMS addresses, 9.2 and 9.3 gained subclauses, and Annex A moved from 114 controls to 93 in four themes.
Is there a 2024 amendment to ISO 27001?
Yes, a climate action amendment published in 2024 that adds climate change to the considerations in clauses 4.1 and 4.2. Practitioner summaries say it does not require recertification. Check the amendment text for your case.
Which version of ISO 27001 do I certify against?
ISO/IEC 27001:2022. The transition from the 2013 version ended on 31 October 2025.
Who checks that I meet the requirements?
An accredited certification body, through the audits described in the certification process guide. ISO itself does not audit or certify.
Start here
Know the requirements? Now get matched with the right provider.
Requirement→Scope→Price→Matched provider
Tell Us What You NeedFree for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team