ISO/IEC 27001: complete guide to the ISMS, Annex A and certification

ISO/IEC 27001 is the international standard that sets the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). Its current edition is ISO/IEC 27001:2022; it is voluntary and fits organizations of any size and sector [1]. It is certified through an audit by an external certification body, not through a self-declaration [1].

This guide walks through the whole standard: what it is and is not, the structure of clauses 4 to 10, Annex A and its 93 controls, what changed from the 2013 edition and the transition that ended on 31 October 2025, the 2024 climate amendment, the certification cycle, how it relates to the ENS, NIS2 and DORA, the phases of a project and a checklist. If you want help implementing it, there is our GRC and compliance consulting.

What ISO/IEC 27001 is and what surrounds it

ISO/IEC 27001:2022 is the third edition of the standard, published in October 2022 by the ISO/IEC JTC 1/SC 27 committee (information security, cybersecurity and privacy protection). It has 19 pages, replaces the 2013 edition (withdrawn, together with its 2014 and 2015 corrigenda) and has one amendment, Amd 1:2024 [1]. The official abbreviation is "ISO/IEC 27001" because ISO and IEC publish it jointly; ISO also says standards should be cited with their full reference, for example "certified to ISO/IEC 27001:2022" [1].

The standard relies on other pieces that are worth telling apart:

The text of both standards is paid content in the ISO and UNE stores [1] [2]. This guide relies on the official ISO, UNE, IAF and ENAC pages and does not reproduce the protected content of the standard. To audit or certify you need the full text.

Who it applies to and what it is not

ISO/IEC 27001 is a voluntary standard. ISO describes it as applicable to companies of any size and from all sectors [1], and the organization itself decides whether to get certified: some implement it just to benefit from its good practices, others also want the certificate to reassure customers [1]. According to the ISO Survey 2022, quoted on the ISO page, over 70,000 certificates were reported in 150 countries [1]. According to a signed article in the SC 27 Journal, since the 2025 edition the ISO Survey compiles its data directly from IAF CertSearch, the global database of accredited certifications [8].

Three limits are worth setting from the start:

• It is not a legal obligation by itself. It is a voluntary standard [1]; a customer or a tender may of course ask for it by contract.
• It does not certify a product or a service. It certifies a management system, with a specific scope. ISO says that, to use a certification logo, you should contact the body that issued the certificate [1].
• It is not a catalogue of controls you must fully meet. It is a risk-based management system; controls are chosen according to those risks (see Annex A below).

The three principles an ISMS protects are the confidentiality, integrity and availability of information, through a risk management process [1].

Structure of the standard: clauses 4 to 10

The standard follows ISO's harmonized structure for management system standards. The clauses with requirements run from 4 ("Context of the organization") to 10 ("Improvement") [13], and Annex A is normative [4].

The references to 4.2 c), 6.3, 9.2, 9.3 and the new order of clause 10 come from the list of changes in IAF MD 26 [4]. Only the titles of clauses 4 and 10 are checked against the ISO page; the rest of the table is a summary. The exact content of each requirement is in the text of the standard.

Documented information the standard requires

The ISMS is demonstrated through documented information: IAF MD 26 records that it must be available as evidence in clauses 9.1, 9.2, 9.3 and 10.2 [4]. In addition, the standard requires producing the Statement of Applicability (SoA) in clause 6.1.3 d) [4]. The complete list of mandatory documented information is in the text of the standard.

Risks, controls and the Statement of Applicability

The heart of the ISMS is clause 6.1. The sequence is this:

1. Assess the risk with a process the organization itself defines and that produces consistent and comparable results (clause 6.1).
2. Choose how to treat each risk and determine the necessary controls, whether they come from Annex A, from another source or from your own design (6.1.3).
3. Compare those controls with Annex A to confirm that no necessary control has been omitted (6.1.3 c).
4. Produce the Statement of Applicability and the risk treatment plan.

IAF sums it up this way: comparing the necessary controls with those in Annex A lets you confirm that none was inadvertently omitted, and if one is found, the risk treatment plan must be updated and the control implemented [4]. A signed article in the ISO SC 27 journal puts it like this: controls used to be "selected" from Annex A; today they are "determined" from risk treatment and then "compared" with Annex A, and the necessary controls do not have to be Annex A controls [7].

Annex A 2022: 93 controls in four themes

Annex A reproduces the 93 controls of ISO/IEC 27002:2022 with the same identifiers and names, grouped under the same four themes: organizational, people, physical and technological [7]. UNE gives the split by theme in 27002:2022: 37, 8, 14 and 34 controls [5].

Two nuances that are often forgotten:

• Recommendation versus requirement. In ISO/IEC 27002 the text of each control is written as a recommendation ("the organization should"); in Annex A of 27001 it is written as a requirement ("the organization shall") [7]. Even so, Annex A works as a reference list to compare against, not a list where every item must be met.
• Attributes. 27002:2022 adds example attributes to each control so they can be reorganized outside the four themes: control type (preventive, detective, corrective), information security properties (confidentiality, integrity, availability), cybersecurity concepts (identify, protect, detect, respond, recover), operational capabilities and security domains [7].

From the 2013 edition to the 2022 one

IAF summarizes the main changes of 27001:2022 compared with 27001:2013. These are the most relevant [4]:

In 27002, UNE highlights as new controls those on threat intelligence, cloud services, web filtering and secure coding; some existing controls were also merged, for example asset inventory and asset ownership, which now form a single control [5]. UNE also points to a special emphasis on supplier management [5].

IAF considers that the impact on organizations that already have an ISMS need not be significant [4]. In practice the work concentrates on updating the SoA and the risk treatment plan and on showing that any new or changed controls you have chosen are implemented and effective.

The transition: it ended on 31 October 2025

IAF MD 26 set a three-year (36-month) transition period from the publication month of the 2022 edition. These are the dates in its timeline [4]:

According to IAF MD 26, all certifications based on ISO/IEC 27001:2013 expire or are withdrawn at the end of the transition period [4]. Today, therefore, a certificate to the 2013 edition is no longer valid. A certificate that cites ISO/IEC 27001:2022 (or its adoption UNE-EN ISO/IEC 27001:2023) is the one to ask for.

In IAF's timeline, the transition audit could be carried out together with a surveillance or recertification audit, or separately, and could not rely only on document review, especially for the technological controls [4].

Amendment 1:2024: climate change

ISO/IEC 27001:2022/Amd 1:2024 was published in February 2024, is one page long and is titled "Climate action changes". It applies to ISO/IEC 27001:2022 [3]. ISO publishes the amendment text on its Online Browsing Platform. This guide does not summarise its content: read it there and ask your certification body how it takes it into account in audits.

How certification works

Getting certified is voluntary and is done by an independent certification body, not by ISO [1]. Holding a certificate from an accredited body adds confidence, because an accreditation body has independently confirmed that body's competence [1].

In Spain the accreditation body is ENAC. According to ENAC, only accredited certification bodies have shown competence and impartiality, because they operate under UNE-EN ISO/IEC 17021-1; moreover, applying for accreditation is a voluntary decision of the body, so if a body is not accredited for a scheme it is because it has not applied or has not yet passed the assessment [9]. For ISO/IEC 27001, the applicable accreditation standards are ISO/IEC 17021-1 and ISO/IEC 27006-1 [8]. The status of an accredited certificate can be checked in IAF CertSearch, the global database of accredited certifications [8].

The usual cycle looks like this:

Two clarifications. The frequency of surveillance audits and the length of the cycle are specified in the certification body's offer: ask about them before signing. And an article in the SC 27 journal warns that a "cheap and easy" certification can dilute its commercial value, and that confidence comes from a recognized, accredited body [8].

ISO 27001 versus the ENS, NIS2 and DORA

They are different frameworks with different legal nature. A well-built ISMS organizes part of the work for the others, but no certification equals another or guarantees compliance with a law.

Nuances for each framework:

• ENS. ENS certification bodies are accredited by ENAC under UNE-EN ISO/IEC 17065, and public-sector technical audit bodies recognized by the CCN can also certify [14]. It is a different route from the ISO/IEC 17021-1 under which an ISMS is certified, and one does not replace the other. The ENS catalogue has 73 measures and Annex A has 93 controls, with different structures. If your organization serves the public administration, the reference is the ENS guide.
• NIS2. Article 21 asks for "appropriate and proportionate" technical, operational and organizational measures, takes into account "relevant European and international standards" and requires an "all-hazards" approach [10]. Article 25 asks Member States to encourage the use of European and international standards, without imposing or discriminating in favour of a particular type of technology [10]. Neither article designates a specific standard; only recital 79, which is non-binding, cites the ISO/IEC 27000 series as an example of European or international standards for physical and environmental security [10]. An ISMS under ISO 27001 is a recognized way to organize those measures, but you must check them one by one against Article 21(2) and the national transposition. More in the NIS2 guide and the NIS2 compliance solution.
• DORA. It applies to the financial entities within its scope since 17 January 2025 [11]. An ISMS can contribute risk, incident and supplier processes, but DORA requires its own pieces, such as the register of information on ICT third-party arrangements. It is explained in the DORA guide and the DORA compliance solution.
• AI Act. It regulates artificial intelligence systems and is not an information security management standard; the AI Act guide covers its obligations.

Phases of an implementation project

The time depends on the scope, prior maturity and available resources, and no standard sets a default duration. These are the usual phases, with no promises about duration:

1. Scope and context. Which services, systems, sites and people are in, which interested parties exist and what requirements they have.
2. Leadership and policy. Management approval of the policy, roles and responsibilities.
3. Risk assessment. Method, asset inventory, risks and their owners.
4. Treatment and SoA. Treatment decisions, determined controls, comparison with Annex A and the Statement of Applicability.
5. Implementation. Controls, procedures, training and awareness, supplier and incident management.
6. Measurement and internal audit. Indicators, internal audit and management review.
7. Certification audit. Stages 1 and 2 with an accredited body.
8. Maintenance. Surveillance, continual improvement and recertification.

To technically validate some controls (configuration, vulnerability management), the difference between Red Team and pentest helps choose the exercise, and the pentesting and Red Team service carries it out. Annex A does not impose a penetration test; that is a risk treatment decision.

Checklist

Common mistakes

• Using Annex A as a closed list of obligations. Annex A is a reference to compare against; the necessary controls are determined through risk treatment [7].
• An SoA copied from a template. The SoA must reflect the organization's risks and decisions.
• A scope chosen for convenience. A trimmed scope may not cover the service the customer asks about; the certificate is only valid for its scope.
• Accepting a certification to the 2013 edition. The transition ended on 31 October 2025 [4].
• Neglecting the people and physical themes. They are 8 and 14 Annex A controls, and no technical tool covers them on its own.
• Believing the certificate is the end. The body audits the ISMS periodically and there is a recertification at the end of the cycle.
• Mixing up ISO 27001 with the ENS, NIS2 or DORA. Each has its own conformity route; no certification replaces another (see above).
• Hiring a non-accredited body. It is possible, but ENAC stresses that only accredited bodies have shown competence and impartiality [9].
• Ignoring Amd 1:2024. It is a published amendment to ISO/IEC 27001:2022 [3]: read it and ask your certification body how it takes it into account.

ISO/IEC 27001 at Hodeitek

Hodeitek has its information security management system certified to ISO/IEC 27001 by OCA Instituto de Certificación, a body accredited by ENAC (certificate no. 34/5700/26/10159, issued on 12 October 2026). The scope, in summary, covers the information systems that support the HodeiShield SaaS service, the pentesting services, cybersecurity and ICT systems and services consulting, applied AI consulting for business and the design of business process automations, according to the current statement of applicability. It is a certification of the management system, not of a product, and it does not certify your organization.

To track the controls, HodeiShield offers a list of the 93 Annex A controls with status, owner, due date and evidence, a score of implemented over applicable controls and periodic external scanning of suppliers. It does not audit, does not certify, does not generate the Statement of Applicability as a document and does not cover the people or physical controls on its own; the use case details what the platform does and does not do. For full support, the GRC consulting team prepares the ISMS and its documentation.

This guide is informational and does not replace the official text of the standard or an auditor. Updated on 13 November 2026.