Guides, checklists, and control mappings that take you from first gap analysis to a maintained certificate. Built from real certification engagements.
An ISMS built only to pass the audit stops working the day after it.
ISO/IEC 27001 is the international standard for an information security management system (ISMS): the policies, risk process and controls a firm uses to protect its information, and the evidence that they work. Certification comes from an accredited certification body after a two-stage audit.
For a UK firm of 25 to 250 people, it is usually the certificate an enterprise customer or a regulated buyer asks for first. Holding it answers a large part of most security questionnaires before anyone reads them.
The certificate is the receipt. The ISMS is the product.
The 2022 edition sets out its requirements in Clauses 4 to 10 and lists 93 controls in Annex A. You select those controls through your risk assessment and record the decisions in a Statement of Applicability.
| Ref | Domain | Controls | Guides |
|---|---|---|---|
| clauses | Mandatory Clauses | 22 | 22 guides → |
| A.5 | Organizational Controls | 37 | 37 guides → |
| A.6 | People Controls | 8 | 8 guides → |
| A.7 | Physical Controls | 14 | 14 guides → |
| A.8 | Technological Controls | 34 | 34 guides → |
Every article in this vault maps to a stage of the certification journey — start where you are.
Understand what the standard requires before committing budget or timeline.
Baseline your current controls against Annex A and plan the work.
Turn the Statement of Applicability into owned, evidenced, operating controls.
Pass Stage 1 and Stage 2 with evidence auditors can sample.
Keep the certificate through surveillance audits and continual improvement.
Top management owns the ISMS. The standard makes leadership accountable for the policy, the objectives and the resources (Clause 5), and a security or compliance lead runs it day to day.
Each Annex A control you select has an owner in the team that operates it, who keeps its evidence current all year rather than in the weeks before an audit.
Internal audit and management review close the loop. Internal audit needs someone who isn't auditing their own work.
Every clause and control has its own guide in the matrix above.
Short answers to the questions we hear most from firms starting, or rescuing, an ISO 27001 programme.
ISO/IEC 27001 is the international standard for an information security management system. It sets out requirements for managing information security risk, in Clauses 4 to 10, and a reference set of 93 controls in Annex A. The current edition is ISO/IEC 27001:2022, and organisations can be certified against it.
It depends on your scope and your starting point. The certification audit runs in two stages, and Stage 2 needs evidence that the ISMS has been operating, including an internal audit and a management review. See the certification process.
The main costs are the certification body's audit fees, any outside help, tooling and your team's time. Scope and starting maturity drive all four. See ISO 27001 certification cost for UK figures.
ISO/IEC 27001 contains the requirements you are certified against. ISO/IEC 27002 is guidance on implementing the Annex A controls. You can't be certified to ISO 27002.
Three years. The certification body runs surveillance audits during that cycle, usually annually, and a recertification audit before it ends.
Every guide in one place. Filter by journey stage or domain.
Work with a Trust Architect to scope your ISMS, close the gaps, and get audit-ready — without stalling your roadmap.