ISO 27001: a plain-language guide
Short answer: ISO/IEC 27001 is the international standard for an information security management system (ISMS). It asks you to find your information security risks, choose controls to reduce them, and keep checking that they work. An accredited certification body audits you, and if you pass, you get a certificate that is valid for three years.
What is ISO 27001?
ISO/IEC 27001 is published by ISO and IEC. The current version is ISO/IEC 27001:2022. It does not tell you which tools to buy. Instead, it sets out how to run security as a managed process: decide what you need to protect, assess the risks, put controls in place, measure them and improve over time. That process is called an information security management system, or ISMS.
The standard has two parts. Clauses 4 to 10 are the management system requirements, such as scope, leadership, risk assessment, internal audit and management review. Annex A is a list of security controls you choose from based on your risks.
Who needs ISO 27001?
No law makes ISO 27001 compulsory for most companies, but customers often do. It is common for IT services firms, SaaS companies, fintechs, BPOs and any business that handles client data to be asked for an ISO 27001 certificate in a tender or security questionnaire. For companies in India selling to customers in Europe, the Middle East or large Indian enterprises, it is often the first certificate they are asked for.
What are the ISO 27001 Annex A controls?
The 2022 version has 93 controls in four themes:
| Theme | Controls | Examples |
|---|---|---|
| Organisational | 37 | Security policies, supplier security, incident management, threat intelligence |
| People | 8 | Background checks, security awareness training, remote working |
| Physical | 14 | Office access, clear desk, equipment security |
| Technological | 34 | Access control, encryption, backups, logging, secure development |
You do not have to apply every control. You decide which ones apply and explain why in a document called the Statement of Applicability (SoA).
How do you get ISO 27001 certified?
- Set the scope. Decide which parts of the business, locations and systems the ISMS covers.
- Assess your risks. List your information assets, what could go wrong and how likely and serious it would be.
- Choose controls and write the SoA. Pick Annex A controls that treat your risks.
- Write policies and put controls in place. For example, an access control policy, MFA, backups and staff training.
- Run it and keep evidence. Auditors want to see that controls actually operate, not just that policies exist.
- Do an internal audit and a management review. Both are required before certification.
- Stage 1 audit. The certification body reviews your documents and readiness.
- Stage 2 audit. The auditor checks that the ISMS works in practice. If it does, you are certified.
After certification, there are surveillance audits in the first and second years and a recertification audit in the third year.
How long does ISO 27001 take?
For a small or mid-sized company, getting ready commonly takes three to nine months, depending on how much is already in place and how much time the team can give it. The audits themselves add a few weeks. Keeping a clear checklist of what is done, partly done and not started is the easiest way to keep it moving.
ISO 27001:2013 or 2022?
The 2013 version has been withdrawn, and the transition period for certificates under it ended on 31 October 2025. New certifications and renewals are against ISO/IEC 27001:2022.
How ExpertComply helps with ISO 27001
ExpertComply GRC includes an ISO/IEC 27001:2022 checklist with every requirement written in plain language. You mark each item done, partly done, not started or not applicable, attach evidence, and see your progress at any time. Ready-made policy templates and the built-in advisor help you fill the gaps. ExpertComply VAPT checks your code and website for the technical weaknesses that the technological controls are meant to prevent.
ExpertComply is guidance software. It does not issue certificates; only an accredited certification body can do that.
See plans Ask for a walkthrough