What is ISO/IEC 27001? The 2022 standard explained

What is ISO/IEC 27001?

ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system (ISMS). It applies to organisations of any size and in any sector, and protects the confidentiality, integrity and availability of information by applying a risk management process. The current version is ISO/IEC 27001:2022.

Certification is optional. According to the ISO Survey 2022, there were more than 70,000 certificates in 150 countries. ISO asks organisations to quote the full reference, for example “certified to ISO/IEC 27001:2022”.

How many controls are in ISO 27001:2022?

Annex A of the 2022 version lists 93 controls in four categories: organisational, people, physical and technological. The 2013 version had 114 controls in 14 clauses. The update added 11 new controls, merged 24 and updated 58.

Is an ISO 27001:2013 certificate still valid?

No. Certification bodies had until 31 October 2025 to move their clients to the 2022 version, and certificates based on the 2013 version expired or were withdrawn at the end of that transition. From 30 April 2024, new certifications and recertifications had to be against the 2022 version.

How does certification work?

An independent certification body audits your ISMS. In the UK, the United Kingdom Accreditation Service (UKAS), the national accreditation body appointed by government, accredits the bodies that certify. According to certification body NQA, the audit happens in two stages: Stage 1 checks readiness and Stage 2 is the full assessment. Certificates are issued for three years, with surveillance audits in the first and second years and recertification in the third.

How do you check a supplier’s certificate?

Use UKAS CertCheck, a free public database where you can search by certificate number or company name. UKAS-accredited certification bodies must keep their clients’ certificate details on it.

What is the climate change amendment?

Amendment 1:2024, “Climate action changes”, was published in February 2024. It adds to clause 4.1 that the organisation shall determine whether climate change is a relevant issue, and a note to clause 4.2 that interested parties can have requirements related to climate change. UKAS treats it as a clarification rather than a new requirement, so there is no full transition programme, but certification bodies audit it.

How is ISO 27001 different from Cyber Essentials and SOC 2?

Cyber Essentials is a UK scheme covering five technical controls, renewed every year. ISO/IEC 27001 is an international standard for a whole management system, certified by an accredited body. SOC 2 is not a certification but an attestation report from a licensed CPA firm on a service organisation’s controls.