ISO 27001

ISO 27001: what it requires, how certification works and who should deliver it

A customer or tender has asked for ISO 27001. This guide explains what the standard requires, what changed in the 2022 version, how the certification path runs, what drives the price and how to choose the right people to help, before you request a single quote.

Tell Us What You Need See how certification works

Free for buyers · provider-funded introductions · Updated October 2026

ISO 27001 at a glance

What it isA standard for an information security management system (ISMS)

Certificate issued byAn accredited certification body, not ISO

Current versionISO/IEC 27001:2022

Mandatory partClauses 4 to 10

ControlsAnnex A, 93 controls in four themes

Certificate cycleThree years, with annual surveillance audits

Legally requiredNot by itself. Driven by customers, tenders and contracts

Start here

Where are you in the ISO 27001 process?

Pick the question you are stuck on and jump straight to it.

01 · Just asked

A customer asked for ISO 27001

Work out what is being requested and what a good-enough answer looks like.

What ISO 27001 is →02 · Which version

Which version applies today

The 2013 transition has ended. See what the 2022 version changed.

The 2022 version →03 · The route

How certification works

Seven steps from building the system to the certificate and beyond.

The certification path →04 · The content

What the standard requires

Clauses are mandatory. Annex A controls are chosen by risk.

Clauses and controls →05 · The bill

What drives the cost

The levers that move the price, with no invented figures.

Cost drivers →06 · The team

Who should deliver it

Certification body, consultant and platform: who does what.

Choosing help →

The basics

What ISO 27001 is, and what it is not

ISO/IEC 27001 is an international standard for an information security management system, or ISMS. It sets out how an organisation identifies information security risks, chooses controls to treat them and keeps improving. It is published by ISO and the IEC, and the current version is ISO/IEC 27001:2022.

Two points surprise first-time buyers. First, ISO does not issue certificates. An accredited certification body audits your ISMS and issues the certificate. Second, the standard is not a law. It becomes mandatory in practice when customers, tenders or contracts ask for it.

It suits any organisation that wants a structured, auditable way to manage information security, including SaaS and cloud providers, managed service providers, fintech and healthtech companies and outsourcers.

Signs you need it now

The questionnaire: a prospect asks for an ISO 27001 certificate.
The tender: a public or enterprise tender lists it as a requirement.
The market: you sell to buyers outside the US who expect it.
The contract: customer agreements name certification or an equivalent.
The structure: you want one auditable system for security governance.

Clauses and controls

What is inside ISO 27001: clauses 4 to 10 and Annex A

The standard has a mandatory core and a menu of controls you select by risk. For a clause-by-clause walk-through, read the ISO 27001 requirements guide. For all 93 controls, see the Annex A controls guide. To track your progress step by step, use the ISO 27001 checklist.

The mandatory clauses and the 93 Annex A controls, with the Statement of Applicability linking them.

ISO 27001 requirements versus controls compared
Term	What it means	Mandatory?	Where it sits
Requirement	A clause you must meet, such as risk assessment or internal audit	Yes	Clauses 4 to 10
Control	A safeguard chosen to treat a risk, such as access control or backup	Only if your risk assessment selects it	Annex A
Statement of Applicability	The record of which Annex A controls apply, and why	Yes	Required document
Certificate	The auditor's confirmation that your ISMS meets the standard	No, it is a business choice	Issued by a certification body

Many web pages use requirements and controls as if they meant the same thing. They do not. If you want to see how a related framework handles this, read SOC 2 vs ISO 27001.

Version

ISO 27001:2022: what changed and why 2013 no longer applies

If an older page tells you to transition from 2013, it is out of date.

ISO/IEC 27001:2013 compared with ISO/IEC 27001:2022
Item	2013 version	2022 version
Status	Transition ended on 31 October 2025	Current. All valid certificates now follow it
Annex A	114 controls in 14 groups	93 controls in 4 themes
Control description	Control objectives and controls	Each control has a purpose and attributes
Change in the guidance standard ISO/IEC 27002:2022	Not applicable	11 new controls, 24 merged and 58 updated
Mandatory clauses	Clauses 4 to 10	Clauses 4 to 10 remain

Certification bodies stopped auditing to the old standard for initial and recertification audits after 30 April 2024, and old certificates had to move by 31 October 2025. Amendments can add wording to clauses, so ask your certification body which text it audits against.

The route

How ISO 27001 certification works: 7 steps from build to certificate

You do the first three. The certification body does the rest.

The seven-step path, with who does each step.

ISO 27001 certification path: stage, what happens and who does it
Step	What happens	Who
1. Build the ISMS	Define scope, assess risks, write policies, choose controls and record them in the Statement of Applicability	You
2. Internal audit	Check your own ISMS against the standard. The standard requires it	You
3. Management review	Top management reviews how the ISMS is performing. The standard requires it	You
4. Stage 1 audit	The auditor reviews documentation and readiness	Certification body
5. Stage 2 audit	The auditor tests whether the ISMS is implemented and effective. Nonconformities must be corrected, and major ones before a certificate is issued	Certification body
6. Certificate	Issued after a successful audit and valid for three years, subject to later audits	Certification body
7. Surveillance audits	Annual checks during the certificate cycle	Certification body
8. Recertification	A full audit before the three-year certificate ends	Certification body

We give no durations here because they depend on scope, how mature your controls are and the certification body schedule. For what drives the price, see the cost section below. For each step in detail, read the ISO 27001 certification process guide.

Annex A

Annex A controls: 93 controls in four themes

Controls are the menu. The risk assessment decides what you order.

The four Annex A themes with control counts and examples
Theme	Controls	What it covers	Example controls
Organizational	37	Policies, roles, assets, access policy, suppliers, incidents, continuity and compliance	Information security policies, supplier relationships, incident management
People	8	Screening, terms of employment, awareness and remote working	Screening, security awareness training
Physical	14	Premises, equipment and secure areas	Physical entry controls, secure disposal of equipment
Technological	34	Endpoints, access, malware, backup, logging, networks, coding and cryptography	Secure authentication, backup, logging and monitoring

The 93 controls total 37 plus 8 plus 14 plus 34. You select from them through your risk assessment, and the Statement of Applicability records what you chose and why. Excluding a control needs a recorded reason.

Certification body

Accredited vs unaccredited ISO 27001 certification bodies

The certificate is only as useful as your customers think it is.

Accredited and unaccredited ISO 27001 certification bodies compared
Factor	Accredited body	Unaccredited body
Oversight	Assessed by an accreditation body	No external accreditation
Certificate	Carries the accreditation mark	May not be accepted by customers who require accredited certificates
How to check	Search the accreditation body directory	Ask what customers accept before you commit
Best when	Customers or tenders require recognised certificates	You have confirmed in writing that your buyers accept it

Accreditation is what separates certification bodies. In the US, ANAB accredits management-system certification bodies, including for ISO/IEC 27001, against ISO/IEC 17021-1, and publishes a directory you can search. Elsewhere, use the national accreditation body. Some customers accept only accredited certificates, so ask yours first. Under accreditation rules a certification body must stay impartial, so the firm that helps build your ISMS should not also certify it. Ask who does what.

Cost

What drives the cost of ISO 27001 certification

Six levers, in the order they usually matter.

Scope: how many sites, systems, teams and data flows the ISMS covers.
Maturity: how many controls and documents you already have in place.
Help model: building it internally, with a consultant or with a platform.
Audit effort: scope and size drive the certification body time.
The full cycle: surveillance audits every year and recertification after three years.
Extras: security testing, training, tooling and your own staff time.

Published ISO 27001 cost ranges are mostly unsourced and vary widely, so we do not repeat them. For a regional view, see the ISO 27001 cost guide for India. To compare quotes, ask each provider for the same scope and a full-cycle price.

For the six parts of the bill, how audit days are set and a calculator that uses your own quote, read the ISO 27001 certification cost guide.

Who does what

Certification body, consultant or platform: who does what in ISO 27001

Three roles that vendor content blurs together.

ISO 27001 certification body, consultant and platform compared
Role	What it does	Can it issue the certificate?	When it is used
Certification body	Audits your ISMS and issues the certificate	Yes, if accredited and the audit is passed	Stage 1, Stage 2, surveillance and recertification
Consultant	Builds the ISMS, runs gap analysis and prepares you for audit	No	Before and between audits
Compliance platform	Tracks evidence, policies and tasks	No	Throughout, if you choose software

Some providers bundle roles. That is fine if the certification body stays separate from the firm that built your ISMS. Browse providers on our pages for ISO 27001 consultants, India and Dubai.

Every ISO 27001 guide in one place

ISO 27001 guides and provider pages

More guides are added here as they are published.

Providers

How to choose a certification body or consultant

Cost

ISO 27001 certification cost: what drives the price

Checklist

ISO 27001 checklist: 39 steps, free tracker

Controls

ISO 27001 Annex A controls: all 93 listed

Requirements

ISO 27001 requirements: clauses 4 to 10 explained

Process

ISO 27001 certification process: step by step

Compare

SOC 2 vs ISO 27001: which one do you need

Cost

ISO 27001 certification cost in India

Providers

ISO 27001 consultants

Providers

ISO 27001 consulting in India

Providers

ISO 27001 certification in Dubai

Related hub

SOC 2 compliance: the full guide

FAQ

ISO 27001 questions buyers ask us

Short answers to the questions buyers ask before they start.

What is ISO 27001?

An international standard for an information security management system (ISMS). It sets out how to identify information security risks, choose controls to treat them and keep improving. The current version is ISO/IEC 27001:2022.

Is ISO 27001 mandatory?

Not by itself. No general law requires it, but customers, tenders, contracts and some sector rules can require certification or an equivalent.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 sets the requirements for an ISMS and is the standard you certify against. ISO 27002 is guidance on the controls. The Annex A list in ISO 27001 refers to the controls in ISO 27002.

Who issues the ISO 27001 certificate?

An accredited certification body, after a successful audit. ISO itself does not issue certificates. In the US, ANAB accredits certification bodies for ISO/IEC 27001.

How long is an ISO 27001 certificate valid?

Three years, subject to annual surveillance audits. Before the three years end, a recertification audit repeats the full audit.

How many controls are in ISO 27001 Annex A?

93 in the 2022 version, in four themes: 37 organizational, 8 people, 14 physical and 34 technological. You select the ones that apply through your risk assessment.

What changed in ISO 27001:2022?

Annex A moved from 114 controls in 14 groups to 93 controls in four themes. Each control now has a purpose and attributes. The guidance standard ISO/IEC 27002:2022 has 11 new controls, 24 merged and 58 updated.

Does the 2013 version still apply?

No. The transition from ISO 27001:2013 ended on 31 October 2025, so valid certificates now follow the 2022 version.

What documents does ISO 27001 require?

Documented information includes the ISMS scope, the information security policy, risk assessment and treatment records, the Statement of Applicability, objectives, internal audit results and management review results.

Is ISO 27001 compliance the same as certification?

No. You can follow the standard without an audit. Certification means an accredited body has independently audited your ISMS and issued a certificate.

Does ISO 27001 certify the whole company?

It certifies the ISMS within a defined scope, which can cover part of the organisation. The scope is set by you and stated on the certificate.

How do I choose an ISO 27001 certification body?

Check its accreditation in the directory of the accreditation body, ask whether your customers accept it and confirm that it is separate from whoever built your ISMS. See our ISO 27001 provider pages.

How much does ISO 27001 certification cost?

It depends on scope, maturity, the help model, audit effort and the three-year cycle. We quote no figures. See the India cost guide and compare full-cycle quotes.

Is SOC 2 the same as ISO 27001?

No. SOC 2 is a report from a CPA firm and ISO 27001 is a certificate from a certification body. See SOC 2 vs ISO 27001.

Start here

Start with the requirement, not the certification body.

Requirement→Scope→Price→Matched provider

Tell Us What You Need

Free for buyers · provider-funded introductions · Reviewed October 2026 by the ZCyberSecurity compliance team