ISO/IEC 27001:2022

Why ISO 27001 matters

Customers, especially from Europe, the US and large Indian enterprises, often ask "are you ISO 27001 certified?" before sharing data with a supplier. Many Indian IT, BPO and SaaS companies hold the certificate. GRC analysts, internal auditors and implementers work with it every day.

What an ISMS is

An information security management system (ISMS) is not a product. It is a set of policies, processes, roles and records that an organisation uses to manage information security risks continuously. ISO 27001 says what the ISMS must include; it does not prescribe specific technology.

The ISMS follows the plan-do-check-act (PDCA) cycle: plan (assess risks, choose controls), do (implement them), check (monitor, audit, measure), act (fix problems and improve).

The mandatory clauses (4 to 10)

Clauses 1 to 3 are introduction, references and terms; they hold no requirements.

Annex A: 93 controls in four themes

The 2022 version reorganised the old 114 controls (2013) into these 93, and added 11 new ones, including threat intelligence, cloud services, data masking, data leakage prevention, web filtering and secure coding. Detailed guidance for each control is in a companion standard, ISO/IEC 27002:2022. The transition period for certificates from the 2013 version ended on 31 October 2025.

Statement of Applicability (SoA)

The SoA is a key document: for each of the 93 Annex A controls it states whether it is applied, why (or why not), and how. Auditors read it closely. A control can be excluded only with a valid reason, such as "7.x not applicable: we have no own premises; staff are fully remote", backed by the risk assessment.

Control 8.13  Information backup
Applicable: Yes
Reason: Risk R-01 (ransomware) and R-07 (accidental deletion)
How: Daily encrypted backups to separate cloud account; monthly restore test (ticket evidence)
Owner: IT Operations lead

Certification

1. Stage 1 audit: an accredited certification body reviews documents and readiness.
2. Stage 2 audit: auditors check that the ISMS really works, with evidence and interviews.
3. Certificate issued, normally valid for three years.
4. Surveillance audits each year, and a recertification audit at the end of the cycle.

Findings are called nonconformities (major or minor). Each needs a root cause and a corrective action.

Common mistakes

• Buying a "template pack" and printing documents that do not match how the company really works.
• A scope so small (one room) that the certificate means little to customers. Read the scope on any certificate you rely on.
• Treating certification as the finish line. The ISMS must keep running and improving.