ISO 27001:2022 — From Compliance Requirements to an Operational ISMS

ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). It provides a framework for establishing, implementing, maintaining, and continually improving an organization's approach to managing information security risks. The 2022 revision updated the Annex A controls — reducing the total from 114 to 93 and reorganizing them into four themes — and introduced new controls addressing areas such as threat intelligence, cloud security, and data masking.

Certification requires an accredited third-party audit in two stages: a Stage 1 documentation review and a Stage 2 on-site assessment. Surveillance audits occur annually, and recertification is required every three years. The ongoing nature of the certification cycle means ISO 27001 is not a one-time project — it requires a management system that operates continuously.

The ISMS scope defines the boundaries of the management system — which parts of the organization, which locations, which information assets, and which processes are included. Scope decisions have significant consequences: a narrow scope may satisfy immediate customer requirements but limit the value of certification, while an overly broad scope increases implementation complexity and audit cost.

Effective scoping considers the organizational context (Clause 4), interested parties and their requirements, and the interfaces and dependencies between in-scope and out-of-scope activities. A well-defined scope statement is specific enough to be meaningful and defensible under audit scrutiny — vague scope statements are a common finding in Stage 1 audits.

ISO 27001 is fundamentally a risk-based standard. Clause 6.1 requires organizations to establish and apply an information security risk assessment process that produces consistent, valid, and comparable results. The risk assessment must identify risks associated with the loss of confidentiality, integrity, and availability of information assets, analyze those risks, and evaluate them against defined risk acceptance criteria.

The risk treatment plan documents how identified risks will be addressed — through controls, risk acceptance, risk transfer, or risk avoidance. Each treatment decision must be traceable to the risk assessment and to the controls selected from Annex A or from other sources. This traceability is what auditors verify during Stage 2 fieldwork.

Common risk assessment failures include: treating risk assessment as a one-time exercise rather than a recurring process, failing to document the methodology consistently, and selecting Annex A controls without linking them to specific identified risks.

The Statement of Applicability (SoA) is one of the most important documents in an ISO 27001 ISMS. It lists all Annex A controls, states whether each control is applicable or excluded, provides justification for each decision, and indicates the implementation status of applicable controls.

The SoA must be consistent with the risk treatment plan — controls selected in the risk treatment plan must appear as applicable in the SoA, and exclusions must be justified. Auditors scrutinize the SoA carefully because it is the primary document linking the risk assessment to the control implementation.

The 2022 revision requires organizations to review their SoA against the updated Annex A structure. Organizations certified under the 2013 version had until October 2025 to transition to the 2022 standard.

The 93 Annex A controls in ISO 27001:2022 are organized into four themes: Organizational controls (37), People controls (8), Physical controls (14), and Technological controls (34). New controls in the 2022 revision include threat intelligence, information security for cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.

Implementation priority should be driven by the risk assessment — controls that address high-priority risks should be implemented first. Organizations frequently make the mistake of implementing all controls simultaneously, which creates resource strain and produces superficial implementations. A phased approach based on risk priority produces more operationally effective controls.

ISO 27001 requires organizations to conduct internal audits at planned intervals to determine whether the ISMS conforms to requirements and is effectively implemented and maintained. Internal audits must be planned, conducted by competent auditors who are independent of the areas being audited, and documented with findings and corrective actions.

Management review is a separate requirement — senior leadership must review the ISMS at planned intervals to ensure its continuing suitability, adequacy, and effectiveness. Management review inputs include audit results, nonconformities, corrective actions, risk assessment results, and opportunities for improvement. Outputs must include decisions on continual improvement opportunities and resource needs.

Both internal audits and management reviews are frequently cited as nonconformities in certification audits — either because they were not conducted at the required frequency, because the documentation was insufficient, or because corrective actions from previous cycles were not tracked to closure.