ISO 27001 in One Page

Overview: What is ISO 27001?

ISO/IEC 27001 is the leading international standard for an Information Security Management System (ISMS). Rather than prescribing specific technical brands or firewall configurations, it establishes a repeatable management lifecycle: identify risks, establish controls, evaluate performance, and continually improve.

The current revision is ISO/IEC 27001:2022, which streamlined the Annex A controls from 114 down to 93 controls categorized into four logical themes.

Part 1: The Mandatory Management System Clauses (4 – 10)

You cannot get certified without fulfilling these seven foundational management clauses:

• Clause 4: Context of the Organization
  Identify internal and external issues, understand stakeholder security expectations, and define the exact scope boundaries of your ISMS.
• Clause 5: Leadership & Commitment
  Executive management must sign off on the Information Security Policy, assign security roles, and allocate adequate budget and resources.
• Clause 6: Planning & Risk Assessment
  Define a formal risk assessment methodology, produce a Statement of Applicability (SoA), and author a risk treatment plan.
• Clause 7: Support & Resources
  Provide necessary tools, verify employee competency, maintain tracked security awareness training, and manage documented information.
• Clause 8: Operation
  Execute your risk assessments and treatment plans on a defined, scheduled basis.
• Clause 9: Performance Evaluation
  Conduct structured internal audits, monitor control metrics, and run at least one formal annual Management Review meeting.
• Clause 10: Continual Improvement
  Investigate nonconformities, track corrective action plans, and refine ISMS efficiency over time.

Part 2: The Four Annex A Control Themes (2022 Revision)

The 93 controls are divided into four clear operational buckets:

1. Organizational Controls (37 controls)
   Policies, asset management, acceptable use, information classification, supplier security (A.5.19), and incident management (A.5.24).
2. People Controls (8 controls)
   Background screening, terms of employment, remote working agreements, and ongoing security awareness training.
3. Physical Controls (14 controls)
   Physical security perimeters, office access control, clear desk and clear screen policies, and secure equipment disposal.
4. Technological Controls (34 controls)
   User endpoint security, privileged access management (A.8.2), secure coding and DevSecOps (A.8.25), vulnerability management, and data leakage prevention.

Typical Audit Timeline for Startups & Scaleups

1. Months 1–2: Scoping & Gap Analysis — Map critical assets, cloud environments, and existing policies.
2. Months 3–4: Policy Drafting & Control Rollout — Enforce MFA everywhere, document change management, and run risk assessments.
3. Month 5: Internal Audit & Management Review — Test all controls and fix nonconformities.
4. Month 6: Stage 1 & Stage 2 External Audits — Stage 1 checks documentation readiness; Stage 2 tests operating evidence with an accredited certification body.