ISO 27001 requirements in plain language

ISO 27001:2022 does not prescribe security products. It prescribes a management system, the ISMS, and a method: find your information security risks, decide how to treat them, and show that you do what you decided.

The standard has two parts. Clauses 4 to 10 describe the management system and apply to every organisation without exception. Annex A lists 93 controls in four themes: organisational, people, physical and technological. Which controls you implement follows from your risk assessment, and you record the reasoning in the Statement of Applicability.

A company with ten employees and a company with two hundred face the same clauses. What differs is the scope, the depth and the number of documents. The requirements usually reach you through a supplier questionnaire or a tender, where a purchasing department asks for proof that you manage information security in a structured way.

• ISO 27001 at a glance
• Compare the classic route with online certification

Clauses 1 to 3 cover scope, normative references and terms. The requirements start at clause 4. Each clause below is described in plain language, followed by what you typically document.

Clause 4, Context of the organisation

You determine which internal and external issues affect information security, which interested parties matter (customers, authorities, staff) and what they expect. You also draw the boundary of the ISMS. Typically documented: the scope statement and a list of interested parties with their requirements.

Clause 5, Leadership

Management takes responsibility. It approves the security policy, assigns roles and provides time and budget. Typically documented: the information security policy and the allocation of roles.

Clause 6, Planning

This is the core of the standard. You define how risks are assessed, assess them, decide on treatment and set security objectives. Typically documented: the risk method, the risk register, the risk treatment plan, the Statement of Applicability and the objectives.

Clause 7, Support

You make sure that people are competent and aware of their duties, that communication is defined and that documents are controlled. Typically documented: training records, proof of awareness measures and the rules for document control.

Clause 8, Operation

You carry out what you planned. Risk assessments are repeated at planned intervals and the treatment plan is put into practice. Typically documented: the results of each risk assessment and of the treatment.

Clause 9, Performance evaluation

You measure whether the ISMS works. This includes monitoring, an internal audit and a management review. Typically documented: the audit programme and report, monitoring results and the minutes of the management review.

Clause 10, Improvement

When something goes wrong or an audit finds a gap, you correct it, look for the cause and improve the system. Typically documented: a log of nonconformities and the corrective actions.

The standard names a limited set of documented information. Everything else is up to you and depends on the size of the company and the complexity of its processes. The table lists the items that are asked for explicitly.

Annex A is not a checklist you must complete. For each of the 93 controls you decide whether it applies, based on the risks you found. The Statement of Applicability lists every control, states whether it is implemented and gives a reason for each decision.

You may exclude a control if your risks do not call for it. A company that buys all its software and develops none can justify leaving out controls on secure development. A control that you merely find inconvenient cannot be excluded.

The 2022 edition revised the controls and covers cloud services, data protection and cyber risks among others. If your documents still refer to the 2013 structure, the Statement of Applicability is the first place to update.

The standard does not fix a sequence, but the clauses build on each other. This order works for most small and medium businesses.

1. 01

   Set the scope and the policy

   Decide what the ISMS covers and let management approve a short security policy with objectives.

2. 02

   Assess the risks

   List your information assets, name threats and weaknesses, and rate each risk with a method you can repeat.

3. 03

   Choose and implement controls

   Select Annex A controls for the risks you want to reduce and put them into practice.

4. 04

   Prepare the Statement of Applicability

   Record every control, its status and the reason for including or excluding it.

5. 05

   Train your employees

   Make sure staff know the policy, their duties and how to report an incident.

6. 06

   Manage incidents and review

   Log security incidents, learn from them, and check the system through an internal audit and a management review.

The Zertify self-assessment for ISO 27001 has 48 yes/no questions. Thirteen of them are mandatory requirements of the standard and must all be answered yes. Among the other 35 questions you need at least 24 yes answers to pass. The assessment is free and needs no registration.

After you pass and pay, you receive the certificate within 4 hours. It is issued by G6 Agency AG under licence from SICE, and SICE reviews every assessment before issue. There is no on-site audit. The price is CHF 849 (€849) in the first year, then CHF 569 (€569) per year including the yearly online re-audit. The certificate is valid for 3 years.

Every certificate can be checked publicly by its number or by the QR code on the PDF, so a customer or purchasing department can verify it in seconds. The yearly subscription can be cancelled at any time in your customer account, effective at the end of the paid year.

• ISO 27001 certificate
• Prices and discounts
• Start the free self-assessment