The certifiable part is the management system in clauses 4 to 10. The Annex A controls are a reference set chosen through risk assessment and justified in the Statement of Applicability. It is the default security expectation of many European buyers.
The ISO 27001 framework page covers requirements and the audit cycle.
Read more
Related terms
- Information security management system
- An information security management system is the set of policies, processes and responsibilities an organization uses to manage information security risk.
- Annex A
- Annex A of ISO/IEC 27001:2022 is the reference list of 93 information security controls, grouped into organizational, people, physical and technological themes.
- Statement of Applicability
- The Statement of Applicability is the mandatory ISO 27001 document listing which Annex A controls apply, which are excluded and why.
- Surveillance audit
- A surveillance audit is the yearly audit a certification body performs between ISO certification audits to confirm the management system is still maintained.