What Is ISO 27001? Requirements and Certification

The question rarely arrives on its own. It comes inside a procurement pack from a buyer in Frankfurt or Singapore, or in a tender that names the standard by number and offers no alternative, phrased as though a yes or no would settle it. It will not. ISO 27001 describes a way of running information security; being certified to it is a separate, optional transaction with a company ISO has nothing to do with, and vendors blur the two constantly. Here is the standard, what it demands, and how to tell a real certificate from a confident sentence.

What Is ISO 27001?

ISO/IEC 27001 is a requirements standard for an information security management system, usually shortened to ISMS. The current text is ISO/IEC 27001:2022, the third edition, published in October 2022 and running to 19 pages. It comes from Subcommittee 27 of the technical committee ISO shares with the International Electrotechnical Commission, which is why the official reference carries both names. Almost everyone says ISO 27001; ISO's position is that ISO/IEC 27001 is correct and that a claim of certification should name the year too.

The word "system" is doing the work. ISO 27001 is not software, a control set or a security posture. It is a scope you defined, a risk assessment method you apply the same way every time, a plan for treating what you found, records showing people were trained, an internal audit you run on yourself, and a review where leadership looks at the results and decides something. Conformity means that machinery exists and runs. It does not mean your security is good, and the standard never claims it does.

What the system protects is the familiar trio: confidentiality, integrity and availability. ISO frames the standard around preserving those three through a risk management process, a more modest promise than most security marketing makes.

What Does ISO 27001 Require?

Seven numbered clauses carry all of it. Clauses 0 to 3 are introduction, scope, references and terms, so the requirements an auditor tests begin at clause 4.

Read down the right column and the pattern is plain: nearly every clause is satisfied by a record, not by a control. Strong technical security with no evidence anyone planned, reviewed or corrected it will fail an audit, while a modest environment with disciplined records will pass. Clause 9 is where most first attempts come apart, because the internal audit and the management review are the two activities nobody schedules until they are overdue.

Clause 6 is load-bearing. Everything downstream, including which Annex A controls you implement, falls out of a risk assessment you can defend. That is what makes a tested incident response plan an ISO 27001 artifact rather than a nice-to-have: clause 8 wants operational plans actually carried out, and clause 10 wants what you learned from them.

What Are the ISO 27001 Annex A Controls?

Annex A is a reference table, not a checklist. It carries 93 controls in four themes: A.5 organizational, A.6 people, A.7 physical and A.8 technological. The 2022 edition reorganized them from the fourteen domains of the 2013 text, which is why an older gap assessment maps awkwardly onto a current Statement of Applicability.

The mechanism connecting Annex A to your company is the Statement of Applicability, and a certification body reaches for it first. For each of the 93 controls you record whether it applies, why, and whether it is implemented. Excluding a control is legitimate; excluding it without a reason your risk assessment supports is a nonconformity. That is why the four themes read like an argument for breadth: security awareness training sits under people, vulnerability scanning under technological, and a company treating security as a purely technical problem will find two themes thinly evidenced.

Annex A gives you control titles. Implementation guidance lives in the companion standard ISO/IEC 27002:2022, covering access control, cryptography, human resource security and incident response, among others. Because ISO 27002 is guidance rather than requirements, nobody certifies against it, and a supplier claiming certification to ISO 27002 has misread its own paperwork.

NIST does part of the translation work for a US team. Its CSF 2.0 informative references catalog publishes a mapping from ISO/IEC 27001:2022 to the NIST Cybersecurity Framework, the cleanest way to see how this structure lines up against functions your engineers already talk in.

Is ISO 27001 Mandatory?

No. No United States statute requires ISO 27001, no regulator issues it, and no penalty follows from not holding a certificate. Even for organizations that adopt the standard, certification is a choice: ISO says on its own page that companies implementing ISO/IEC 27001 decide for themselves whether to go through a certification process, and that some implement it purely for the practices it contains.

What binds a US company is a different list, and ISO 27001 displaces none of it. A non-bank financial institution under FTC jurisdiction has the Safeguards Rule, codified at 16 CFR Part 314, whose section 314.4 sets out nine required elements including a written information security program and a designated qualified individual reporting to the board at least annually. A healthcare vendor has the HIPAA Security Rule. A merchant handling cardholder data has PCI DSS, contractual rather than statutory but with real financial consequences. State breach notification deadlines run whatever certificate hangs on the wall.

The force behind ISO 27001 is therefore commercial. Customers write it into contracts, procurement policies name it, insurers ask about it, and tenders across much of the world list it as a condition of bidding.

How ISO 27001 Certification Works

Certification is a transaction between your organization and an independent certification body. ISO does not perform certification, issue certificates or permit its logo to be used to suggest otherwise, so a supplier claiming to be certified by ISO is describing something that does not exist.

Above the certification body sits an accreditation body, and that is where certificates differ in value. ISO defines accreditation as formal recognition by an independent body that a certification body operates according to international standards, then says the quiet part plainly: accreditation is not compulsory, and a body without it is not automatically disreputable. The standard accredited bodies work to is ISO/IEC 27006-1:2024, published in March 2024, which sets the requirements for organizations that audit and certify an ISMS. It governs competence, impartiality and how long an audit must last, which is why audit days are not a negotiation.

The three year cycle changes how the work feels. A certificate does not renew by paying an invoice; it survives because the management system kept producing evidence through the two quiet years between audits. Companies that treat certification as a project meet the surveillance auditor with an eleven month gap in their records, and surveillance findings are where certificates get suspended.

Who Needs ISO 27001 Certification?

The standard applies to any organization of any size in any sector, which is true and not very useful. The practical answer is decided by who is asking. Buyers outside North America, public sector procurement across Europe, the Gulf and Asia, and multinationals imposing a group security policy on suppliers all name ISO 27001 in the paperwork. US enterprise buyers usually name a SOC 2 report instead, and the two sit against each other with heavy overlap in the underlying work and no conversion between the outputs.

Why vendor risk teams push the question down their supply chains is measurable. The 2026 Verizon Data Breach Investigations Report found third-party involvement in breaches up 60 percent, with breaches involving a third party now accounting for 48 percent of all breaches. When nearly half of incidents arrive through somebody's supplier, procurement stops accepting a questionnaire and starts asking for something an outside party checked.

How Long Does ISO 27001 Certification Take?

Any confident single number is a guess wearing a suit. Duration is decided by how much of the management system already exists and how long the method forces you to wait.

The forced wait is operating history. Stage 2 examines a system in operation, so the ISMS must have run long enough to produce internal audit findings, corrective actions and at least one management review, and no budget compresses that. A company with documented change management, a working access review and a risk register starts far closer to the line than one writing its first policy. Plan backward: fix the certificate date you need, work back through Stage 2, the gap closure window, Stage 1 and the management review, and start on whichever date the arithmetic produces.

How Much Does ISO 27001 Certification Cost?

Nobody publishes this. ISO does not set or cap certification fees, no regulator collects them and no survey reports them, so every dollar range circulating online is an estimate rather than a dataset. The mechanism is more useful than a range anyway.

Three costs sit under the total. The standard itself is the smallest: ISO sells ISO/IEC 27001:2022 for CHF 155, and most implementers buy ISO/IEC 27002:2022 alongside it. The certification body's fee is driven largely by audit duration, and because ISO/IEC 27006-1 governs how that duration is determined, the day count is not something an auditor invents to win the work. Headcount inside the scope is the main input, which is why the same certificate costs more each year as you hire.

The third cost never appears on an invoice and is usually the largest: your own people writing the risk assessment, running the internal audit, gathering evidence and sitting in interviews. Where no internal owner is senior enough to hold that line, a virtual CISO is the usual arrangement, because the work is judgment about scope and applicability rather than hours.

How to Verify an ISO 27001 Certificate

A supplier says it is certified. That sentence is worth almost nothing alone, and checking it takes about ten minutes.

ISO points buyers at two routes: look the certificate up in IAF CertSearch, which aggregates data from accreditation and certification bodies so both statuses can be confirmed in one place, or contact the certification or accreditation body directly. The first does not depend on the supplier cooperating.

Then read the certificate rather than filing it. Four things matter: the issuing body and who accredits it, the standard edition, the expiry date, and the scope statement. That last line is where certificates quietly narrow, and it separates a supplier whose operation was audited from one whose certificate covers a data center it no longer uses.

What Are the Benefits of ISO 27001?

The commercial benefit is the honest headline: it opens procurement doors that are otherwise closed, and it does so with a document a stranger can verify without asking you. Nothing else in security assurance is publicly checkable that way, and for a company whose growth depends on buyers it has never met, that property is the product.

The operational benefit is real but slower and easy to overstate. Certification forces a rhythm: risks reviewed on a schedule, an internal audit somebody answers for, a management review putting security in front of the people who control the budget. Plenty of organizations capture most of that without ever certifying, which is exactly the option ISO says is open to them.

What it does not buy is immunity. A certificate describes a management system inside a defined scope at the time it was audited, and organizations holding valid certificates get breached, because good process reduces the chance of an incident and never removes it.