ISO 27001

ISO 27001 is the leading international standard for managing information security. It is increasingly a condition of doing business: it appears routinely in tenders, procurement questionnaires and supplier due diligence, particularly where a customer is entrusting you with their data.

The standard is risk-based rather than prescriptive. It does not hand you a list of security measures to install. It requires you to identify the risks to the confidentiality, integrity and availability of your information, decide what to do about each, and be able to justify those decisions.

That distinction matters. Two certified organisations can have very different controls, because they have different risks. What they have in common is that both can explain why.

The information security management system

The system covers considerably more than IT. Information security in the standard's sense includes paper records, physical access to premises, what staff do with laptops on trains, who has keys, how you vet people before employing them, and what happens to information held by your suppliers.

Organisations that treat ISO 27001 as an IT project generally struggle at audit, because roughly half of the standard is about people, process and physical arrangements rather than technology.

Annex A and the Statement of Applicability

ISO 27001 comes with Annex A, a reference set of 93 controls grouped into four themes: organisational, people, physical and technological.

You are not required to implement all of them. You are required to compare your risk treatment decisions against the full list, decide which controls apply, and produce a Statement of Applicability recording which you have included, which you have excluded, and why.

The Statement of Applicability is the document auditors reach for first. It is also the one most likely to be wrong, usually because it has been copied from a template and never genuinely reconciled with the organisation's actual risk assessment.

The 2022 revision

ISO 27001 was revised in 2022. Annex A was restructured from 114 controls in 14 domains to 93 controls in 4 themes, with 11 new controls added covering areas such as threat intelligence, cloud services, secure coding and data leakage prevention.

The transition period for organisations certified to the 2013 version ended on 31 October 2025, so all valid certificates should now be against ISO/IEC 27001:2022. If you hold a certificate that still references the 2013 version, that is worth checking urgently.

The 2024 climate change amendment

In February 2024, ISO amended 31 management system standards including ISO 27001, requiring organisations to determine whether climate change is a relevant issue when considering their context, and noting that interested parties may have climate-related requirements. It is a short addition to the context review, but certification bodies will expect to see it addressed.

ISO 27001 and Cyber Essentials

These are frequently confused and they are not alternatives.

Cyber Essentials is a UK government-backed scheme covering five technical controls. It is inexpensive, quick, and often mandatory for central government contracts. It assesses technical configuration at a point in time.

ISO 27001 is an internationally recognised management system standard. It covers governance, risk, people, physical security and suppliers as well as technology, and it certifies an ongoing system rather than a snapshot.

Many organisations hold both, because they answer different questions and different customers ask for different things. If a tender specifies one, do not assume the other will satisfy it.

ISO 27001 and UK GDPR

Certification does not make you compliant with data protection law, and it is important not to claim otherwise. ISO 27001 addresses information security risk, which supports data protection substantially, but UK GDPR imposes obligations around lawful basis, transparency and individual rights that sit outside an information security management system.

The two work well together. The asset inventory, risk assessment and supplier controls built for ISO 27001 do a great deal of the groundwork for data protection compliance.

What certification involves

Certification is issued by a certification body accredited by UKAS, not by a consultancy. Assessment runs in two stages: Stage 1 reviews your documentation, scope and readiness, and Stage 2 tests whether the system is genuinely implemented and effective.

Before either, you need a completed internal audit covering the whole system and a documented management review. If a customer or tender is what brought you here, what to do when a customer asks for ISO 27001 covers scope and timelines. For ISO 27001 the internal audit is more demanding than for other standards, because the auditor needs enough technical understanding to assess whether the controls in your Statement of Applicability are actually operating.

Scope, and getting it right

Scope is the decision that shapes everything else on this standard. A narrow scope, covering one product or one location, is faster and cheaper to certify. A broad scope is more work but far more useful commercially, because a customer reading your certificate will check whether the service they are buying falls inside it.

A certificate with a scope narrower than the work being tendered for is a common and expensive mistake.

Delivering IT Services to Clients?

If you provide managed, cloud or outsourced IT services, ISO 20000-1 complements ISO 27001 by covering how those services are planned, delivered and supported. The two standards share the same structure and run well as one integrated system.