ISO 27001 Simplified

In this ultimate guide I have packaged my 10+ years of experience with ISO 27001 to provide a simplified, actionable guide to what it is, why you need it, and how to achieve certification.

ISO 27001 is the international standard for the design, implementation, management and continuous improvement of an Information Security Management System (ISMS.)

In this ultimate guide, we will explore what ISO27001 entails, its benefits, implementation steps, common challenges, and much more.

So, let's dive in and demystify the world of ISO27001 together.

What is ISO27001:2022 and How Does It Work?

ISO 27001 is the international standard for the design, implementation, management and continuous improvement of an Information Security Management System (ISMS.)

But, what is an ISMS?

ISMS stands for Information Security Management System. It is a comprehensive framework that encompasses the policies, processes, procedures, people, and technology that you implement to mitigate risks related to information security.

It encompasses various aspects, including:

  • Risk management
  • Asset management
  • Access control
  • Incident response
  • Business continuity
  • and much much more...

It's important to understand that an ISMS is not a technology thing.

It's not a piece of software, a platform, a tool.

It is a method for managing information security within your organisation that combines the effective use of policies, processes, procedures, people, and technology to identify, manage and mitigate risks that impact your business.

Why is an ISMS so important?

An ISMS is designed to provide organisations with a structured approach to managing and continuously improving their information security.

Your ISMS is meant to consider the context of your organisation and exist as a living system that adapts and evolves in response to the internal and external factors that impact your business. For example:

  • Legal and regulatory changes
  • Customer expectations and requirements
  • Technology changes
  • Changes in the threat landscape
  • New vulnerabilities

In the same way that your organisation has a Customer Relationship Management system made up of sales, marketing and service related activities; information security needs a management system - an Information Security Management System.

Its role, its purpose is to provide a systematic approach to how you identify, protect, detect, respond and recover from threats, risks and vulnerabilities that impact your business.

Where does ISO27001:2022 come in?

ISO 27001 is the embodiment of what thousands of security experts worldwide consider to be industry best practice for designing, implementing, managing and continuously improving an Information Security Management System.

It is a globally recognised, international standard that provides a structured framework for managing and improving your information security.

The good news is that it doesn't discriminate either.

It is technology agnostic, vendor agnostic and is applicable to any organisation - regardless of size, scale, industry or geography.

So if you want to improve your information security - but don't know where to start.

You're in the right place.

ISO27001:2022 Basics: Understanding the Standard

Before we deep dive into all the details, lets cover some of the basics.

ISO 27001:2022 is part of the ISO 27000 family of standards

ISO27000 Family of Standards by Cybermana
ISO/IEC 27000 Family of Standards, International Organisation for Standardisation (ISO)

There are (currently) 25+ Standards that make up the ISO/IEC 27000 family of standards, all dedicated to the world of information security management.

This catalogue of Standards broadly fall into 4 categories:

  • Vocabulary - A glossary of common terms used in both the ISO/IEC 27000 family of standards and information security more broadly.
  • Requirements - A collection of requirements for the design, implementation, management and continuous improvement of an ISO compliant management system.
  • General Guides - A collection of supporting guides that provide practical and actionable guidance for implementing specific features of an ISO compliant management system.
  • Industry Guides - A collection of industry-specific guides for implementing specific features of an ISO compliant management system.

Before you panic - you don't need to know all of them.

The key one's you need to know are:

  • ISO/IEC 27000:2018 - Provides an overview of information security management systems, alongside 50+ terms and definitions commonly used in the Standards.
  • ISO/IEC 27001:2022 - This is the actual Standard that specifies the requirements for establishing, implementing, maintaining and continuously improving an information security management system.
  • ISO/IEC 27002:2022 - Provides implementation guidance on a set of common information security controls, including the ISO/IEC 27001:2022 Annex A Controls.
  • ISO/IEC 27005:2022 - Provides guidance on managing information security risks.

The remainder of the ISO/IEC 27000 family of standards provide additional resources, depending on the context of your organisation.

ISO 27001:2022 is based on the ISO Annex SL Directive

Illustration of ISO Annex SL structure by Cybermana
ISO Annex SL Directive, International Organisation for Standardisation (ISO)

An Information Security Management System (ISMS) is not the only management system that exists within your business right?

You'll have management systems for many aspects of your business - be it HR, finance, IT, data protection, privacy, quality etc.

Some of the biggest challenges organisations face when it comes to management systems and their wider Governance, Risk and Compliance (GRC) journey include:

  • Complexity - Multiple legal, regulatory and compliance requirements
  • Cost - Multiple management systems to satisfy requirements, often running in silos
  • Integration - The ability to bridge multiple management systems in a streamlined way

To help address this, the International Organisation for Standardisation (ISO) established the Annex SL directive.

Annex SL is a framework the ISO uses to define the core requirements and characteristics of a generic management system; which are then tailored to specific domains such as quality management, business continuity management and of course, information security management.

The significance of this is that Annex SL enables organisations to harmonise, streamline and standardise (supported) management systems in order to establish a more Integrated Management System.

ISO27001:2022 is one of these Standards, alongside many others, including:

  • ISO 9001:2015, Quality management systems
  • ISO/IEC 19770-1:2017, Information Technology - IT asset management systems
  • ISO/IEC 20000-1:2018, Information Technology -Service management systems
  • ISO 22301:2019, Business continuity management systems
  • ISO 37301:2021, Compliance management systems

Now, I'm not suggesting that you look at these other standards now.

The focus of this article is ISO/IEC 27001:2022.

But as you continue your journey of building your cyber resilience, ISO 27001 creates the opportunity to harmonise, streamline and optimise the way your organisation operates through one Integrated Management System.

Let's move onto the the ISO/IEC 27001 Standard itself.

Understanding the structure of ISO 27001:2022

High level structure of the ISO27001:2022 standard by Cybermana
ISO/IEC 27001:2022, International Organisation for Standardisation (ISO)

As I mentioned earlier in this article, ISO 27001 is the international standard for the design, implementation, management and continuous improvement of an Information Security Management System (ISMS.)

The ISO 27001 Standard is made up of two core components:

  • The Requirements - a collection of mandatory requirements, organised as per the Annex SL directive, that you have to follow in order to comply with the Standard.
  • Annex A Controls - a catalogue of essential security controls commonly used to treat risks identified during your risk assessment process.

Think of the requirements (or mandatory clauses) as the things that you must do in order to establish an ISO 27001 compliant Information Security Management System.

Whereas, the Annex A controls are controls that you select to treat risks that impact your organisation.

We'll explore this in more depth later in this article.

ISO27001:2022 Basics: Core Principles

Over the years, I have seen a lot of successful ISO 27001 implementations.

I've also seen a lot of not-so-successful ISO 27001 implementations.

Success is dependent on you keeping some core principles in the back of your mind.

#1 Context of your organisation

ISO 27001 is designed to guide you through the process of establishing, maintaining and continuously improving an ISMS that is in the context of your organisation.

Every business is different and there is no one size-fits-all ISMS that you can cookie cutter from one organisation to another.

Why? Because Context is King!

To be successful, it is vital that you take into consideration the context of the organisation.

Otherwise, you run the risk of implementing an ISMS that might comply with ISO 27001 but is ineffective, costly and incongruent with the objectives and outcomes that the business is trying to drive.

#2 Risk-based

ISO 27001 is grounded in risk. And this is a good thing!

Risk helps us identify, prioritise and focus on what's important to protecting and safeguarding our business, our people, our customers, our systems and our data.

ISO 27001 guides us through the process of establishing a risk management strategy, risk assessment processes and risk treatment processes that

The result is a foundation that makes risk work for you to help drive continuous improvement of your security posture and risk profile.

#3 Continuous improvement

ISO 27001 is underpinned by the concept of evaluating the performance and driving continuous improvement of your ISMS.

This helps us ensure that our ISMS is effective and delivering against our objectives, whilst enabling us to respond to change in a controlled and managed way.

#4 Integrate, don't isolate

As ISO 27001 is based on the ISO Annex SL Directive, it is designed to integrate with other management systems, frameworks, standards and controls.

Creating silo's and isolating management systems is the fast track to increasing cost, complexity and friction within your organisation.

Damaging the effectiveness, efficiency and impact that your ISMS can have.

ISO27001:2022 Basics: The Requirements (aka The Mandatory Clauses)

High level structure of the ISO27001:2022 standard by Cybermana

ISO 27001 is made up of 7 requirements (or mandatory clauses) that organisations must comply with in order to establish an ISMS that conforms to the Standard.

  • Clause 4, Context of the organisation
  • Clause 5, Leadership
  • Clause 6, Planning
  • Clause 7, Support
  • Clause 8, Operation
  • Clause 9, Performance evaluation
  • Clause 10, Improvement

Within these mandatory clauses are a collection of 34 subclauses that detail the requirements for specific characteristics of an ISMS.

Combined, these clauses establish the foundations of an ISMS that applies a risk-based approach, underpinned by the principle of continuous improvement.

To learn more about each of the clauses and subclauses, along with practical guidance on how to establish, maintain, manage and continuously improve them; check out my definitive reference guide to the ISO 27001 requirements.

ISO27001:2022 Basics: The Annex A Controls

Introducing the ISO/IEC 27001:2022 Annex A Controls

High level structure of the ISO27001:2022 standard by Cybermana

As of ISO/IEC 27001:2022, Annex A is made up of 93 information security controls, designed to mitigate common risks that most organisations face.

The ISO 27001 Annex A controls are organised into 4 categories:

  • Organisational (37 controls)
  • People (8 controls)
  • Physical (14 controls)
  • Technological (34 controls)

To learn more about each of the ISO27001:2022 Annex A controls, along with practical guidance on how to establish, maintain, manage and continuously improve them; check out my definitive reference guide to the ISO27001 Annex A Controls.

But, what is a control?

Flow chart illustrating how a threat exploits a vulnerability, which introduces a risk.
Overview of controls treating risk

Simply put, a control is a measure you put in place to treat a risk.

It is a thing you do to reduce the likelihood or impact of an adverse event from occurring.

Risk is everywhere. It is a fact of life. It is a reality of doing business, particularly in today's globally connected, cloud-based world.

In the world of information security and ISO 27001, risk drives our purpose.

It helps us identify and evaluate what adverse events may impact our business.

Controls are the tool we use to take action and reduce risk.

How does ISO 27001 use the Annex A Controls?

As mentioned above, ISO 27001 is grounded in risk. Risk drives our purpose.

A high performing ISMS that complies with ISO 27001 must established processes for the identification, assessment, treatment and management of risk.

One of the artefacts we need to create to comply with ISO 27001 is called the Statement of Applicability (SOA).

The SOA is a document that lists which Annex A controls you will implement to treat the risks you have identified (i.e. your risk assessment).

Your SOA should contain five key elements:

  1. Document control information such as version, author, dates and approvals.
  2. The Annex A Controls that are required to treat the risks that impact your organisation.
  3. A statement that outlines why the Annex A Controls have been included.
  4. Confirmation that the Annex A Controls you have selected, have been implemented.
  5. Justification for why you have omitted any of the Annex A Controls.

To learn more about which ISO27001:2022 Annex A Controls may be relevant to you, check out my definitive reference guide to the ISO27001 Annex A Controls.

Can I use controls from other frameworks or standards as well?


In fact, it's actively encouraged.

Remember the core principles discussed earlier in this document?

  1. Context of your organisation
  2. Risk-based
  3. Continuous improvement
  4. Integrate, don't isolate

Leveraging controls from other frameworks or standards enables you to create a more harmonious, integrated management system that addresses the risks that impact your organisation.

Common examples include:

  • ISO 9001:2015, Quality management systems
  • ISO/IEC 19770-1:2017, Information Technology - IT asset management systems
  • ISO/IEC 20000-1:2018, Information Technology -Service management systems
  • ISO 22301:2019, Business continuity management systems
  • ISO 37301:2021, Compliance management systems
  • UK Cyber Essentials (Plus)
  • Center for Internet Security (CIS) Controls
  • NIST Special Publication 800-53
  • Cloud Security Alliance (CSA) Cloud Controls Matrix (CCM)

But, as I mentioned above, control selection is driven by the risks that impact your organisation. You should only consider these frameworks if there is a requirement for you to do so.

However, what you will find is that some standards have controls that overlap with ISO 27001 Annex A. enabling you to create a more unified control framework.

#ProTip - Keep overlapping controls in mind, because there will be overlap. Maybe not in language, but definitely in intent. By keeping overlapping controls in mind, you will be able to reduce cost, optimise resource and accelerate your compliance journey.

Benefits of Adopting ISO27001:2022

Implementing ISO 27001 offers organisations numerous benefits, both from a security and business perspective.

The standard helps establish a strong security posture, ensuring the confidentiality, integrity, and availability of information assets.

By identifying and mitigating risks, organisations can prevent costly data breaches and protect their reputation.

Furthermore, ISO 27001 aids in building trust with customers, partners, and stakeholders.

Demonstrating compliance with internationally recognised standards can serve as a competitive differentiator and open doors to new business opportunities.

Moreover, ISO 27001 promotes a culture of security awareness and responsibility throughout the organisation, fostering a resilient and proactive approach to information security.

Ultimately, ISO 27001 helps improve security and drive business outcomes.

ISO 27001 is not merely a checkbox exercise; it can be a catalyst for positive change.

By aligning information security with business objectives, organisations can leverage ISO 27001 to enhance overall resilience and improve their bottom line.

Implementing ISO27001:2022: The 10 Step Guide

To implement ISO 27001, you will need to develop a management system - in the context of your organisation - that is made up of people, processes and technology.

While ISO 27001 implementation may seem like a daunting task, breaking it down into manageable steps can simplify the process.

Here is my 10 steps to implementing ISO 27001:

  • Step #1 - Get Management Support
  • Step #2 - Define the Scope
  • Step #3 - Establish Your Information Security Policy
  • Step #4 - Identify and Classify Your Assets
  • Step #5 - Define Your Risk Management Methodology
  • Step #6 - Assess Your Risks
  • Step #7 - Treat Your Risks
  • Step #8 - Evaluate Your Performance
  • Step #9 - Drive Continuous Improvement
  • Step #10 - Get Certified

By following this 10 step guide, you will save hundreds of hours in effort; whilst implementing an ISMS that is effective, relevant and in the context of your organisation.

ISO27001:2022 Compliance: Common Challenges and Solutions

While ISO27001:2022 offers a robust framework, organisations often face challenges during the compliance journey. Some common hurdles include:

  • Lack of Awareness - Limited understanding of ISO 27001 and its benefits among key stakeholders can hinder progress. Regular awareness programs and training initiatives can address this challenge.
  • Resource Constraints - Organisations may struggle to allocate sufficient resources, both financial and human, to effectively implement and maintain an ISMS. Strategic resource planning and proper budgeting can help overcome this obstacle.
  • Complexity - The breadth and depth of ISO 27001 requirements can be overwhelming. Engaging experienced consultants and leveraging automation tools can simplify compliance efforts.

By proactively addressing these challenges and seeking appropriate solutions, organisations can navigate the path to ISO 27001 compliance more effectively.

ISO27001:2022 Audits: Keys to Success

Audits play a vital role in maintaining ISO 27001 compliance. Conducting regular internal audits helps ensure the effectiveness and efficiency of the organisation's ISMS.

When preparing for internal or external audits, consider these key success factors:

Planning and preparation

Audits - both internal and external - are incredibly valuable activities. Effective planning and preparation enables you to maximise the value and impact of audits.

Proper documentation

Maintain accurate and up-to-date documentation of policies, procedures, and controls to streamline the audit process.

Thorough training

Provide comprehensive training to employees involved in the audit process to enhance their understanding of ISO 27001 requirements and audit techniques.

Clear communication

Ensure all stakeholders have a clear understanding of their roles and responsibilities, the audit process and what documentation they need to provide.

Continual improvement

Treat audit findings as opportunities for improvement, implementing corrective actions, and monitoring their effectiveness.

By adopting a proactive and systematic approach to auditing, organizations can reinforce their commitment to information security and reinforce the effectiveness of their ISMS.

Managing Ongoing Compliance with ISO27001:2022

ISO 27001 compliance is not a one-time effort. To maintain its effectiveness and continuously improve the ISMS, organisations must establish a culture of ongoing compliance and vigilance.

This involves regularly monitoring and reviewing the ISMS, conducting internal audits at planned intervals, and addressing any emerging risks or non-conformities promptly.

Additionally, organisations should stay up-to-date with the latest developments in the field of information security to adapt their practices as needed.

ISO27001 Frequently Asked Questions

As organisations explore ISO 27001, several commonly asked questions arise. Let's address some of these queries:

Is ISO27001:2022 applicable to all organisations?

ISO 27001 can benefit organisations of all sizes and across industries. Information security is a universal concern, and ISO 27001 provides a flexible framework that can be tailored to an organisation's unique context.

How long does it take to implement ISO27001:2022?

The timeline for ISO 27001 implementation varies depending on the organisation's size, complexity, and existing security practices. On average, the implementation process can take several months to a year.

How long does it take to get ISO27001:2022 Certified?

On average, the ISO27001:2022 Certification process takes 3 months.

Can ISO27001:2022 help improve regulatory compliance?

Yes, ISO 27001 provides a comprehensive framework that helps organisations meet regulatory requirements related to information security. Implementing ISO 27001 can aid in demonstrating compliance with various data protection regulations, such as GDPR, PIPEDA or CCPA.

Does ISO27001:2022 cover data protection regulations such as GDPR?

ISO 27001 in itself does not make you GDPR compliant. It is a complementary standard and framework that helps you establish, maintain and continuously improve your Information Security Management System (ISMS). Which in turn, can aid in satisfying aspects of GDPR (such as Principle 6: Maintain Adequate Security.)