Clause 4
Context and scope
The internal and external issues that matter, interested parties and their requirements, and the scope of the ISMS — the boundary the certificate will name.
ISO/IEC 27001:2022
ISO 27001 certification
What the standard asks of an information security management system, how the certification audits run, what drives the cost, and how long it realistically takes.
ISO/IEC 27001:2022 is the international standard for an information security management system (ISMS): the governed, risk-driven way an organisation decides, runs and improves its security. Clauses 4 to 10 are mandatory — context, leadership, planning, support, operation, performance evaluation and improvement — and Annex A lists 93 reference controls in four themes, selected through risk assessment and justified in a Statement of Applicability. An accredited certification body audits the ISMS in two stages and issues a certificate valid for three years, with surveillance audits in the years between. Certification is voluntary, but it is the security credential European enterprise buyers ask suppliers for most often.
Key takeaways
- ISO 27001 certifies a management system, not a product: auditors test how you govern security, not whether you ticked every control.
- Clauses 4 to 10 are mandatory; the 93 Annex A controls are selected by risk and justified in the Statement of Applicability.
- The 2022 edition groups Annex A into four themes — organisational (37), people (8), physical (14) and technological (34) — and the transition from the 2013 edition ended on 31 October 2025.
- Certification is a stage 1 and stage 2 audit by an accredited body, then surveillance audits in years one and two and a recertification audit in year three.
- Cost is driven by scope — people, sites and services, which set the audit days — the gap to close, and the internal time it takes to run the ISMS once it exists.
Scope
Who ISO 27001 applies to
ISO 27001 has no legal scope: you adopt it, and you draw the boundary of what it covers.
- Software and technology companies whose enterprise customers ask for a certificate in procurement and security questionnaires — in Europe, more often than for any other security credential.
- Suppliers to regulated sectors, where NIS2 supply chain duties and DORA contract terms push security requirements down to vendors, and an ISMS is the most recognised way to meet them.
- Organisations that want one management system to build on: ISO 27017 and ISO 27018 extend its controls for cloud services and personal data in the cloud, and ISO 22301 and ISO 42001 share its clause structure.
- You define the ISMS scope — which organisational units, locations, systems and services it covers. The certificate states that scope, and careful buyers read it.
- Size does not exempt or exclude anyone. The standard scales through risk assessment, and audit duration scales with the number of people and the complexity of the scope.
Requirements
What ISO 27001 requires
The clauses are mandatory for certification; Annex A controls are selected through risk treatment. Each card links to the guide that covers it in depth.
Clause 5
Leadership
Top management commitment, an information security policy, and assigned roles, responsibilities and authorities.
Clause 6.1
Risk assessment and treatment
A defined, repeatable risk assessment, a risk treatment plan, and a Statement of Applicability recording each Annex A control as included or excluded, with the reason.
Clauses 7–8
Support and operation
Resources, competence, awareness, communication and documented information; then running the risk treatment plan and controlling changes.
Clauses 9–10
Performance evaluation and improvement
Monitoring and measurement, an internal audit programme, management review at planned intervals, and corrective action for nonconformities.
Annex A
93 reference controls in four themes
Organisational (A.5, 37 controls), people (A.6, 8), physical (A.7, 14) and technological (A.8, 34). ISO/IEC 27002:2022 gives the guidance behind each one.
ISO 27001 Controls: Complete Guide to Annex A Implementation
Timeline
Milestones and the certification cycle
ISO 27001 has no statutory deadlines. The dates that matter are the edition you certify against and the cycle your certificate runs on.
- Oct 2022ISO/IEC 27001:2022 published
- Feb 2024Amendment 1 adds climate change to the issues and interested-party requirements in clauses 4.1 and 4.2
- 31 Oct 2025End of the transition: certificates to the 2013 edition are no longer valid
- Stage 1Documentation and readiness review by the certification body
- Stage 2Certification audit of the ISMS in operation
- Years 1 and 2Surveillance audits after certification
- Year 3Recertification audit
Overlaps
How it fits with other frameworks
ISO 27001 rarely arrives alone. Where it meets the other regimes you probably already run.
SOC 2
Most Annex A controls have a counterpart in the Trust Services Criteria, so one set of controls and evidence can serve both. What you get differs: a certificate against a standard, or an auditor's attestation report.
NIS2
A running ISMS covers much of the Article 21 measures. NIS2 adds what ISO 27001 does not: the incident reporting clock, management liability and national registration.
GDPR
Annex A includes privacy and protection of personal data (A.5.34), and an ISMS is the usual evidence for Article 32 security of processing. It does not cover lawful basis, records of processing or data subject rights.
ISO 42001
Same clause structure, so AI governance can run inside the same management system, with one internal audit and one management review.
On Noru
How Noru runs ISO 27001
The same control library, evidence vault and registers as the rest of your programme — not a separate project.
ISO 27001 and 27002 as one framework
Switching on ISO 27001 enables ISO 27002 with it, shown and billed as one framework. Its controls go through verification and map onto the shared control library with their Annex A reference — the quarterly access review that answers A.5.18 also answers SOC 2 CC6.2 and CC6.3.
Evidence with a date and a source
Evidence is collected continuously from the systems you connect — AWS, GCP, Azure, GitHub, Entra ID and more — and versioned in the evidence vault, so each control shows a current status and a dated history. Controls no system can observe are evidenced with uploaded documents.
Risk, policies and people in one place
The risk register links to findings, controls and treatments; policies are drafted, versioned, approved and acknowledged; awareness campaigns track completion per person — the material an auditor samples for clauses 6 and 7.
Audits planned against what exists
Internal and external audits are planned on a shared calendar against evidence already collected, and the audit package for a framework and period bundles controls, evidence, policies and milestones for export.
Who can issue an ISO 27001 certificate?
A certification body accredited for ISO/IEC 27001 by a national accreditation body — Swedac in Sweden, for example — that takes part in the international mutual recognition of accreditation, so the certificate is accepted abroad. Certificates from unaccredited bodies exist and carry little weight in procurement, so check the accreditation before you sign.
Is an ISO 27001:2013 certificate still valid?
No. The transition to ISO/IEC 27001:2022 ended on 31 October 2025, and certificates to the 2013 edition are no longer valid. If a supplier shows you one, ask for the current certificate and its scope.
What drives the cost of ISO 27001 certification?
Four things: the audit days the certification body needs, set mainly by how many people and sites are in scope and how complex it is; the gap between what you run today and what the standard requires; any outside help with the risk assessment, policies or internal audit; and the internal time to run the ISMS once it exists — usually the largest and least visible line.
Can we certify only part of the company?
Yes. You define the ISMS scope, and a narrow first scope — one product or service and the teams and systems that run it — is common. The scope is printed on the certificate, so customers see exactly what it covers, and you can widen it at a later audit.
What is the difference between ISO 27001 compliance and certification?
Compliance means you run an ISMS that meets the standard; certification means an accredited body has audited it and says so. Only the second is evidence a customer can rely on without auditing you themselves.
Primary sources
Regulatory references on this page were last checked on .
- ISO/IEC 27001:2022 — information security management systems, International Organization for Standardization
- ISO/IEC 27001:2022/Amd 1:2024 — climate action changes, ISO
- ISO/IEC 27002:2022 — information security controls, ISO
- INAB — transition requirements for ISO/IEC 27001:2022 under IAF MD 26 (end of transition 31 October 2025)
See where you stand
A 45-minute walkthrough of ISO 27001 against your own controls, integrations and evidence.