Information security
ISO 27001: security you can prove to a client and a regulator
NIS2, GDPR and corporate customers all ask the same question: how do you manage information risk. ISO/IEC 27001 is the answer accepted without further explanation. We build an ISMS sized to your risk, not to someone else’s template.
93controls in Annex A
4 themesinstead of 14 sections
5–9 mo.typical implementation
3 yearscertificate validity
In short
What ISO 27001 is
Short answer
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It requires an organisation to define what it protects, what the risks to confidentiality, integrity and availability are, and to select justified controls — technological, organisational, physical and people-related.
The key word is justified. The standard does not impose the same control set on everyone. It requires a risk assessment and a documented decision on which of the 93 controls in Annex A apply and why the rest are not needed. That document is the Statement of Applicability, and it is the first thing an auditor opens.
A frequent question: no, ISO 27001 is not an IT project. Around two thirds of the controls are organisational, people-related and physical. Companies that hand it entirely to the IT department usually collect findings on supplier management, information classification and the disciplinary process.
The 2022 edition
What changed in ISO/IEC 27001:2022
The revision restructured Annex A and added new controls reflecting the cloud, remote work and recent threats.
| Theme | Controls | What it covers |
|---|---|---|
| Organisational | 37 | Policies, roles, supplier management, cloud services, continuity, compliance |
| People | 8 | Screening, awareness, disciplinary process, remote working |
| Physical | 14 | Zones, access, equipment, media, clear desk and clear screen |
| Technological | 34 | Access control, cryptography, logging, web filtering, secure development |
New controls include threat intelligence, security for cloud service use, ICT readiness for continuity, monitoring activities, web filtering and secure coding. More on the standard itself is in what ISO 27001 is and why information security is mandatory.
Regulatory context
The link with NIS2, GDPR and the CRA
The three regimes require different things but rest on the same foundation — managing information risk.
NIS2
Requires cyber risk management measures and incident reporting from entities in defined sectors. An ISMS covers much of the measures but does not replace registration and reporting duties. Detailed comparison.
GDPR
Requires appropriate technical and organisational measures for personal data. ISO 27001 evidences that such measures exist and are maintained; ISO 27701 adds the controller and processor roles. How it works.
CRA
The Cyber Resilience Act sets requirements for products with digital elements. The system provides the process foundation, but the product layer is separate. What already applies.
An important distinction: none of these regimes is satisfied automatically by a certificate. ISO 27001 covers the process side and is the shortest route to demonstrability, but obligations to register, to report within deadlines and to meet specific product requirements remain separate.
Applicability
Who the standard suits
Software and IT services
The most common case — clients require a certificate before entrusting data or system access.
Entities under NIS2
Energy, transport, health, water, public administration, digital infrastructure and their suppliers.
Finance and accounting
Organisations processing third-party financial and personal data under contract.
Manufacturing
Where production systems are networked and downtime costs more than data loss.
How we work
The route to the certificate
Timelines depend heavily on scope. One service and one team is quick; a whole organisation across several sites is not.
- 1
Scope and gap analysis
We define exactly what the system covers — services, sites, assets — and compare current practice with the requirements.
1–2 weeks - 2
Asset inventory and risk assessment
We build the information asset register and the risk assessment method with clear acceptance criteria.
3–5 weeks - 3
Statement of Applicability and treatment plan
We decide which of the 93 controls apply, justify the exclusions and plan implementation of the missing ones.
2–3 weeks - 4
Implementing the controls
Policies, access management, logging, encryption, supplier management, physical security, training and awareness.
6–12 weeks - 5
Incidents, continuity and testing
An incident management process, a continuity plan and an actual test of recovery.
2–4 weeks - 6
Internal audit and certification audit
A full internal audit, management review and preparation for the certification body’s two-stage audit.
6–10 weeks to certificate
Questions and answers
Frequently asked questions
Who needs ISO 27001 certification?
Certification is voluntary but practically necessary for software and IT companies whose clients require demonstrated security, for organisations within the scope of NIS2 and their suppliers, and for anyone processing third-party data under contract. Increasingly it is a condition for bidding or for signing a framework agreement.
What is a Statement of Applicability?
The Statement of Applicability is a mandatory document in which the organisation records which Annex A controls it applies, how it applies them, and justifies the exclusion of those it does not. It connects the risk assessment to the specific controls and is the first document a certification auditor reviews.
What changed in the 2022 version?
Annex A was restructured from 114 controls in 14 sections to 93 controls in four themes — organisational, people, physical and technological. New controls were added for threat intelligence, cloud service security, ICT readiness for continuity, monitoring activities, web filtering, configuration management, data deletion and masking, and secure coding.
How long does implementation take?
For an organisation with a clearly bounded scope the typical timeline is five to nine months. The longest part is implementing the missing controls, which often requires technical change and budget. Scope is decisive: one service with one team certifies considerably faster than a whole organisation across several sites.
Is the standard only for the IT department?
No. Around two thirds of the controls are organisational, people-related and physical — supplier management, information classification, screening at hiring, awareness, physical access control. Projects delegated entirely to IT usually fail in precisely those areas.
Does ISO 27001 cover NIS2 requirements?
It covers a large part of the risk management measures the directive requires and is the shortest route to demonstrability. It does not replace the obligations to register as an entity, to report incidents within the set deadlines, or the management accountability that flows directly from national legislation.
Can we combine it with ISO 9001?
Yes. The two standards share the ten-clause structure, so context, leadership, competence, documented information, internal audit and management review are built once. This is also the most common way organisations add security to an existing quality management system.
What does the auditor check on site?
The auditor checks whether the risk assessment is real and current, whether the Statement of Applicability matches it, whether controls work in practice — by inspecting access rights, logs, training records and supplier contracts — and whether incidents are recorded and investigated. Physical security on site is checked as well.
Start with the scope
Scope determines the price, the timeline and the weight of the audit. One conversation is usually enough to judge whether to begin with a single service or the whole organisation.