ISO 27001 is the international standard for information security management. In plain English, it is how you prove to a client, a regulator or an insurer that you have thought properly about what could go wrong with the information you hold — and that you have done something about it, on purpose, with evidence.
It is the standard most businesses are asked for the moment they start handling someone else’s data at any scale. It is also the one most commonly misunderstood, because people assume it is a technical standard. It isn’t. It is a management standard that happens to be about information.
What ISO 27001 actually requires
The standard has two parts, and the difference between them matters more than anything else in this article.
Clauses 4 to 10 are the management system. These are mandatory, without exception. They cover understanding your organisation and its interested parties, leadership commitment, a documented risk assessment and risk treatment process, resources and competence, operational planning, internal audit, management review, and how you handle nonconformities. If you already hold ISO 9001 or ISO 45001, this structure will look familiar — it is the same harmonised framework.
Annex A is the control set. Ninety-three controls, grouped into four themes: organisational (37), people (8), physical (14) and technological (34). These are not a checklist to be implemented wholesale. They are a reference list you compare your risk treatment decisions against, to make sure you haven’t overlooked something obvious.
That distinction is where most first attempts go wrong. Businesses start at Annex A, try to implement 93 controls, exhaust themselves, and arrive at audit with a pile of controls and no risk assessment explaining why any of them are there. The standard works the other way round: assess the risk, decide the treatment, then check Annex A for gaps.
The Statement of Applicability
The Statement of Applicability, or SoA, is unique to ISO 27001 and it is mandatory. It lists every one of the 93 Annex A controls and states, for each: whether it applies to you, why, and whether it is implemented.
Exclusions are allowed — a business with no physical premises and no development function will legitimately exclude several controls. What is not allowed is excluding something without a defensible reason. “Not applicable” with no justification is one of the most reliable ways to pick up a nonconformity, because the auditor’s next question is simply “why not?”
Treat the SoA as the document that has to survive a hostile reading. It is the first thing a competent auditor opens and the document clients most often ask to see.
What changed in ISO 27001:2022
The 2022 revision restructured Annex A from 114 controls in 14 domains down to 93 in four themes. Most of that was consolidation rather than removal — existing controls merged — but eleven controls were genuinely new, including threat intelligence, information security for cloud services, ICT readiness for business continuity, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
Separately, ISO published ISO/IEC 27001:2022/Amd 1:2024 in February 2024. This does not create a new edition — the standard is still cited as ISO/IEC 27001:2022 — and no certificate was reissued because of it. It adds two lines to Clause 4: a requirement to determine whether climate change is a relevant issue, and a note that interested parties may have climate-related requirements. The same two lines went into roughly 31 management system standards at once, including ISO 9001, ISO 14001 and ISO 45001, so it is a harmonisation change rather than anything specific to information security. In practice it means a line in your context of the organisation, not a sustainability project.
The transition window for organisations certified to the old 2013 version closed at the end of October 2025. If you hold a certificate that still references ISO/IEC 27001:2013, it is no longer valid and a client checking it will find that out.
How certification actually works
Certification runs on a three-year cycle and the initial assessment is split in two.
- Stage 1 is a readiness review. The auditor checks your documentation, scope, risk assessment and SoA, and confirms you have run at least one internal audit and one management review. Turning up without those two is the most common reason a Stage 1 goes badly.
- Stage 2 is the real audit. The auditor tests whether what your documents claim is actually happening — by sampling records, interviewing staff and following evidence trails.
- Surveillance audits follow in years one and two, covering part of the system each time.
- Recertification in year three reassesses the whole system.
Audit duration is set by your headcount and the complexity of your scope, not negotiated. Scope is worth real thought: certifying one business unit, one product or one office is legitimate and often sensible, but the certificate will state the scope and a client reading it will notice if the part of your business that handles their data sits outside it.
Use a certification body accredited by UKAS or an equivalent national accreditation body. Unaccredited certificates cost less and are routinely rejected in tendering.
Where SMEs most often come unstuck
- A risk assessment nobody owns. Built once for the audit, never reviewed, no named owners, no evidence anything happened as a result.
- Asset registers that stop at laptops. Information assets include cloud services, SaaS accounts, paper files and the data itself — not just hardware.
- No supplier control. You are responsible for information your suppliers process on your behalf. Auditors ask for the due diligence and the contract clauses, and frequently get neither.
- Access reviews that never happen. Leavers retaining accounts is the single most common technological finding, and it is trivially easy to evidence either way.
- Untested incident response. A documented procedure with no record of it ever being exercised is a procedure the auditor has no reason to believe in.
- Awareness training with no records. Staff being told about security is not evidence. Attendance, content and dates are.
None of these are technical problems. They are record-keeping and ownership problems, which is why they cut across every sector — see the top 10 nonconformities we see in SMEs.
ISO 27001 vs Cyber Essentials vs SOC 2
These get treated as interchangeable in tender documents. They are not.
| What it is | Scope | |
|---|---|---|
| ISO 27001 | Certifiable international management system standard | Whole management system, risk-driven, organisation-wide |
| Cyber Essentials | UK government-backed scheme, five technical control areas | Baseline technical hygiene; mandatory for some public sector contracts |
| SOC 2 | US attestation report from an accountancy firm | Service organisation controls; commonly requested by US buyers |
Cyber Essentials is a sensible first step and takes weeks rather than months, but it is not a substitute for ISO 27001 and no accredited body will accept it as one.
The related standards worth knowing
- ISO 27002 — implementation guidance for the Annex A controls. Guidance only; you cannot be certified to it.
- ISO 27701 — extends an existing ISO 27001 system to cover privacy information management, and is the practical route to demonstrating UK GDPR control.
- ISO 27017 and ISO 27018 — cloud security and cloud personal data guidance, relevant if you are a cloud provider or heavily dependent on one.
- ISO 22301 — business continuity, frequently requested alongside ISO 27001 by clients who depend on your availability.
Common questions
How long does ISO 27001 certification take?
For a small business with a contained scope, three to six months is realistic from standing start to Stage 2, and the limiting factor is usually the mandatory internal audit and management review rather than building the system itself. Larger or multi-site organisations take longer.
Do I have to implement all 93 Annex A controls?
No. You have to consider all 93 and justify your decisions in the Statement of Applicability. Controls that genuinely do not apply to your organisation can be excluded with a documented reason.
Does ISO 27001 make me UK GDPR compliant?
No, though it helps considerably. ISO 27001 covers information security; UK GDPR imposes wider obligations on lawful basis, data subject rights, transparency and international transfers. ISO 27701 is the extension that bridges the gap.
Can a business with no IT department get certified?
Yes. Plenty of certified organisations outsource all their IT. What the standard requires is that you understand your risks, control your suppliers, and can evidence both — not that you run your own infrastructure.
What happens if we fail?
You don’t usually fail outright. Stage 2 produces findings graded minor or major. Minor nonconformities are typically closed with a corrective action plan; a major finding requires evidence of correction before the certificate is issued, which delays rather than ends the process.
Getting started
If a client has asked you for ISO 27001, send me the requirement and I will tell you what scope you actually need and what it will take to get there. Email Craig@cawconsultancy.co.uk or use the enquiry page.
Need help with this?
CAW Consultancy has helped UK businesses achieve ISO certification and industry accreditation for over 20 years, with a 100% pass rate. See what we do, or send us an enquiry — we’ll tell you what you need, what you don’t, and what it will cost.
Make compliance easier to run
CAW Digital builds paperless management systems, staff portals and business apps around the way you work, for £999 flat with no subscriptions or running costs. Systems are typically delivered within 72 hours.
It also builds company dashboards that put your KPIs, sales and compliance status in one live view for £999, and larger bespoke systems quoted per build with a free, no-obligation quote. For certification itself, CAW Consultancy supports ISO 27001, ISO 42001 and 20+ other standards.
Leave a Reply