ISO 27001
ISO/IEC 27001Also called ISO/IEC 27001:2022, ISMS standard
ISO 27001 is the international standard for running an information security management system. It sets out how an organisation identifies information risks, chooses controls and keeps improving them. Firms can be certified against it by an accredited body. The current version, ISO/IEC 27001:2022, includes 93 controls in Annex A.
How it works
An organisation defines the scope of its management system, assesses information security risks and selects controls from Annex A. It writes a statement of applicability explaining which controls apply. An accredited certification body runs a two-stage audit, then surveillance audits each year and a recertification audit every three years. Internal audits and management reviews run in between.
For financial firms, ISO 27001 certification is common evidence of security practice when assessing suppliers, alongside SOC 2 reports. It does not satisfy any financial regulation by itself, but its risk-based structure maps well to DORA and to supervisory expectations on ICT risk.
The rules
Specifies requirements to establish, implement, maintain and continually improve an information security management system, with 93 Annex A controls.
Any organisation seeking ISMS certificationCommon questions
Is ISO 27001 a legal requirement?
No. It is a voluntary standard. Customers, regulators and procurement teams often ask for it as evidence of security practice, and some public contracts require it. Financial rules such as DORA set their own ICT risk requirements.
How long does ISO 27001 certification last?
A certificate runs for three years. The certification body carries out surveillance audits in years one and two and a recertification audit before the certificate expires.
What changed in ISO 27001:2022?
Annex A was restructured from 114 controls in 14 domains to 93 controls in four themes: organisational, people, physical and technological. New controls include threat intelligence, cloud services security and data leakage prevention.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 sets the certifiable requirements for a management system. ISO 27002 is guidance that explains how to implement each Annex A control. Organisations are certified against 27001 only.
