What Is ISO 27001? A Complete Beginner's Guide

What is ISO 27001, in one sentence?

ISO/IEC 27001 is the international standard that specifies the requirements for an Information Security Management System (ISMS) — a structured, risk-based framework of policies, processes, people, and technology for protecting information. It is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), which is why you’ll often see it written as ISO/IEC 27001.

If the discipline is new to you, it helps to start with the fundamentals before the jargon. Our primer on ISO 27001 information security explains what “information security” actually means in this context — the assets you are protecting, the threats you are protecting them against, and why a managed, repeatable approach beats a scramble of ad-hoc fixes.

Just as important is the commercial case for doing any of this in the first place. Plenty of teams treat security as pure cost until a lost deal changes their minds, so it is worth being clear on why ISO 27001 is important — how a certificate removes friction from enterprise sales, reassures regulators, and signals maturity to partners who would otherwise walk away.

Crucially, ISO 27001 is a certifiable standard. Unlike SOC 2, which results in an attestation report, it results in a formal certificate issued by an accredited certification body after that body has audited your ISMS. The certificate is recognised in virtually every market on earth, which is a large part of why globally-minded companies pursue it.

A certificate is also easy to misread, so it pays to set expectations correctly from the start. Before you brief your team or wave one at a customer, get clear on what ISO 27001 certification proves — and, just as usefully, what it does not. It attests to a working system for managing risk over time, not a guarantee that you can never be breached.

ISO 27001 and the wider ISO 27000 family

ISO 27001 does not stand alone. It sits at the head of the ISO 27000 family of standards: ISO 27000 provides the shared vocabulary, ISO 27001 sets the certifiable requirements, ISO 27002 offers control guidance, ISO 27005 covers risk, and 27017/27018 extend the model to the cloud. For most organisations ISO 27001 is the one that matters, and the rest are reference material that helps you implement it well.

ISO 27001 is the only member of the family you can actually be certified against, and it is published and maintained by the standards body itself. You can review the official abstract and obtain the current text from the International Organization for Standardization (ISO), which is always the authoritative source for the exact wording of the requirements.

The companion you will reach for most often is ISO 27002. Where 27001 states what you must do, ISO 27002 explains how — it gives practical implementation guidance for each Annex A control and, while it is not certifiable itself, it is the manual most teams keep open while building their controls.

Because the two are so closely related, newcomers often blur them together. If you are unsure which document governs what, our comparison of ISO 27001 vs ISO 27002 lays out the division of labour: one is the auditable management-system standard, the other is the best-practice guidance that supports it.

Risk sits at the centre of the whole standard, and ISO 27005 is the family’s dedicated guidance on managing it. If you want to align your methodology with current thinking, our breakdown of ISO 27005: 2018 vs 2022 explains what changed in the recent revision and why it matters for your risk assessment.

The standard itself is not frozen in time either. The ISO 27001:2022 update restructured Annex A into 93 controls, introduced new controls for modern threats, and reorganised everything into four themes — if you last looked at ISO 27001 years ago, this is the change to read first.

To understand why the standard looks the way it does, it helps to know where it came from. The ISO 27001 history traces its evolution from the original British Standard BS 7799 through successive ISO editions, which explains much of its management-system DNA and its emphasis on continual improvement.

The ISMS: the heart of the standard

If you remember one concept from this guide, make it this: ISO 27001 certifies a management system, not a snapshot of your security at a single moment. An ISO 27001 ISMS is the living set of policies, procedures, roles, risk decisions, and controls through which your organisation manages information security on an ongoing basis — it is the thing the auditor actually certifies.

Standing an ISMS up for the first time is a project in its own right, with a logical order that rewards patience. Our guide to ISO 27001 ISMS creation walks through that build: defining scope, assigning ownership, writing the core policies, and wiring in the processes that make the system genuinely run rather than just sit on paper.

Once it exists, the harder discipline is keeping it alive. An ISMS that is set up and then ignored will quietly drift out of conformity, which is why ISO 27001 ISMS maintenance matters as much as the initial build — recurring reviews, evidence collection, and updates whenever your systems, risks, or people change.

This management-system mindset is what makes ISO 27001 powerful, and it rests on a clear set of ISO 27001 principles that force leadership involvement, demand you assess risk before choosing controls, and require you to monitor, audit, and continually improve. The whole thing follows the “Plan–Do–Check–Act” cycle: plan your approach to risk, implement controls, check that they work, and act to improve.

The two halves: Clauses 4–10 and Annex A

ISO 27001:2022 has two distinct parts, and understanding the split removes most of the confusion newcomers feel. On one side are the mandatory management-system clauses; on the other is Annex A, the catalogue of security controls. Almost every “where do I even start?” question resolves once this structure clicks into place.

The first half is the set of mandatory clauses, numbered 4 to 10, and they are not optional — every certified organisation must satisfy all of them. Our deep dive on the ISO 27001 clauses explains each one, from understanding your organisation’s context in Clause 4 through to improvement and corrective action in Clause 10.

Taken together, those clauses add up to a defined list of things an auditor will expect to see. If you would rather work from a single consolidated view, our summary of the ISO 27001 requirements pulls the mandatory obligations into one place so nothing slips through the cracks as you plan.

The mandatory clauses (4–10) describe the management system itself, and in outline they are:

• Clause 4 — Context: understand your organisation, interested parties, and define the ISMS scope.
• Clause 5 — Leadership: top-management commitment, an information security policy, and clear roles.
• Clause 6 — Planning: the risk assessment, risk treatment plan, and security objectives.
• Clause 7 — Support: resources, competence, awareness, communication, and documented information.
• Clause 8 — Operation: actually running the risk treatment and operating your controls.
• Clause 9 — Performance evaluation: monitoring, internal audit, and management review.
• Clause 10 — Improvement: handling nonconformities, corrective action, and continual improvement.

Annex A is the second half: the catalogue of security controls you draw on to treat the risks you identified. In the 2022 edition there are 93 controls grouped into four themes — Organizational (37), People (8), Physical (14), and Technological (34) — and you choose among them rather than implementing all 93 by default.

Because there are so many, it helps to see them laid out and explained in plain terms. Our guide to the ISO 27001 Annex A controls breaks down all 93, grouping them by theme so you can quickly find the ones relevant to your environment and understand what each is actually asking for.

Knowing the controls is one thing; putting them in place is another. The practical work of turning a control objective into a real, operating safeguard is covered in implementing ISO 27001 controls, which focuses on the how — the tooling, process changes, and evidence each control tends to require.

Which controls apply to you depends entirely on where you draw the boundary. Getting your ISO 27001 scope right is one of the highest-leverage decisions in the whole project: too broad and you drown in work, too narrow and the certificate won’t reassure the customers you are trying to win.

Once you have decided which controls are in and which are out, you record and justify those decisions in one master document. The ISO 27001 Statement of Applicability is that document — the auditor’s map to your controls, and usually the very first artefact they ask to see.

The core principles: confidentiality, integrity, availability

Every control and clause in ISO 27001 ultimately serves three foundational goals, often called the CIA triad:

• Confidentiality — information is accessible only to those authorised to see it.
• Integrity — information stays accurate and complete and is not altered without authorisation.
• Availability — information and the systems that hold it are accessible when authorised users need them.

When you assess a risk under ISO 27001, you’re really asking which of these three properties a threat could compromise, and how badly — which is exactly what a structured ISO 27001 risk assessment is for. Keeping the triad front of mind makes the whole standard feel less like a checklist and more like a coherent way of thinking about protecting what matters.

How ISO 27001 certification actually works

Earning the certificate follows a predictable path from internal preparation to an external audit. The bulk of the effort is internal and happens long before an auditor appears: you scope the ISMS, assess risk, implement controls, and only then bring in an assessor. Our ISO 27001 certification process guide walks through that journey end to end, so you can see the whole route before you set off.

A crucial part of that preparation is auditing yourself before anyone else does. A genuine ISO 27001 internal audit tests your own controls against the standard, surfaces gaps while they are still cheap to fix, and is itself a mandatory requirement of Clause 9 — skipping it is one of the most common reasons organisations stumble at Stage 2.

Everything you build has to be provable, because auditors do not take your word for anything. Throughout the project you accumulate ISO 27001 evidence — records, logs, tickets, and screenshots — that demonstrates each control is genuinely operating day to day rather than merely written down somewhere.

When the internal groundwork is solid, an independent assessor steps in. The organisations that perform the audit and issue your certificate are the accredited ISO 27001 certification bodies, and choosing a properly accredited one is essential — a certificate from an unrecognised body carries little weight with informed buyers.

The assessment itself is not a single event but a two-part exercise. Together the two stages make up the full ISO 27001 certification audit, and knowing what each stage looks for helps you prepare the right things at the right time:

• Stage 1 — documentation review: the auditor checks that your ISMS is designed and documented correctly — scope, policies, risk assessment, treatment plan, and Statement of Applicability — and flags gaps to fix before Stage 2.
• Stage 2 — the main audit: the auditor tests whether your controls actually operate in practice, interviewing staff and sampling evidence, and if your ISMS conforms they recommend you for certification.

Stage 1 deserves specific preparation of its own. Our guide to the ISO 27001 audit document review explains exactly which documents the auditor expects, and in what shape, so you are not scrambling to assemble policies the night before.

Many organisations also strengthen their Stage 2 evidence with technical testing. Although not strictly mandatory, ISO 27001 penetration testing is a common and persuasive way to show that your technical controls hold up under real attack conditions, and it often surfaces issues a paper review would miss.

If the auditor does find problems, that is not automatically the end of the road. Findings are logged as ISO 27001 nonconformities, graded by severity, and you are given the chance to correct them — understanding how they are raised and closed out takes much of the fear out of the audit.

Who is allowed to certify you matters just as much as the audit itself. National oversight bodies, explained in our guide to ISO 27001 accreditation bodies, accredit the certification bodies, and that chain of oversight is exactly what makes a certificate credible to a customer on the other side of the world.

Within those bodies, the assessment is carried out by individual assessors. Knowing what qualifications and independence the ISO 27001 auditors must have helps you judge whether a quote is credible and what to expect from the people who will be reviewing your business.

If vetting bodies and assessors yourself sounds like a lot, you do not have to do it alone. You can draw on our vetted ISO 27001 auditor network, which connects you with accredited, independent assessors matched to your sector and scope.

Certification is a cycle, not a finish line, and the first checkpoint comes quickly. In years one and two an annual ISO 27001 surveillance audit confirms you are still operating the system as certified — lighter than the initial audit, but very much a real one that can raise findings.

Then, at the three-year mark, the certificate must be fully renewed. A complete ISO 27001 recertification repeats the depth of the original assessment, which is why a well-maintained ISMS, rather than a last-minute scramble, is what keeps the whole three-year rhythm manageable.

Handled well, all of this adds up to a smooth, lasting path to iso 27001 certification rather than a stressful, one-off ordeal.

ISO 27001 vs SOC 2 and other frameworks

This is the most common question we hear, and the honest answer is: it depends on your buyers. SOC 2 dominates in North America and produces a report; ISO 27001 is the global default and produces a certificate. Our ISO 27001 vs SOC 2 comparison weighs the two in detail, so you can decide which one your market actually rewards.

The good news is that the two overlap heavily — access management, encryption, logging, change management, and vendor risk apply to either framework. If you already hold SOC 2, expanding from SOC 2 to ISO 27001 reuses most of that work, so the second framework costs far less effort than the first.

If your customers are mostly US-based SaaS buyers, SOC 2 may come first; if you sell into Europe, the UK, the Middle East, or Asia–Pacific, or you’re answering government and enterprise tenders, ISO 27001 is usually the one that unlocks the deal. Teams standardising on a US control catalogue may also want our ISO 27001 vs NIST comparison to see how the two line up.

How much does ISO 27001 cost and how long does it take?

Total cost depends on your size, the scope of your ISMS, and how mature your controls already are. Beyond the certification body’s audit fees, budget for internal staff time, security tooling, and any consulting or penetration testing. For small and mid-sized companies the all-in figure typically lands somewhere between roughly $15,000 and $60,000 — our full ISO 27001 cost breakdown shows where the money goes.

Timeline-wise, most organisations reach certification in 3 to 12 months, and our ISO 27001 timeline maps each phase. The single biggest factor is how much you have to build from scratch: a company already holding SOC 2 or running mature controls moves much faster than one starting cold. The hidden cost is almost always time — every month stuck in readiness is a month of stalled deals, which is exactly where a specialist partner changes the economics.

Who needs ISO 27001?

ISO 27001 is voluntary, but in practice it is increasingly mandatory. You should expect it to land on your roadmap if you are a managed service or IT firm, a data processor, a fintech or healthtech, or any vendor handling sensitive customer information — particularly if you sell internationally. The trigger is usually a prospect’s security questionnaire, a contractual clause, or a tender requirement that simply will not proceed without a certificate.

Cloud and software vendors feel this pressure most acutely, because their whole business is holding other people’s data. If that is you, our guide to ISO 27001 for SaaS covers the scoping and control choices that fit a modern cloud stack.

Early-stage companies often assume certification is out of reach, yet it is frequently a startup’s fastest route into enterprise deals. Our practical playbook on ISO 27001 for startups shows how a small team can certify a tight scope without grinding the roadmap to a halt.

Even where it isn’t demanded outright, certification signals maturity. It tells customers, insurers, and investors that you take information security seriously enough to be measured against an external standard — and to keep passing the test year after year.

Common ISO 27001 myths to ignore

• “It’s only for large enterprises.” Startups certify routinely; a tightly scoped ISMS is very achievable for a small team and often unlocks enterprise revenue.
• “We have to implement all 93 Annex A controls.” No — your risk assessment decides which apply, and you justify any exclusions in the Statement of Applicability.
• “Certification means we’re finished.” The certificate lasts three years but requires annual surveillance audits and continual improvement. ISO 27001 is a programme, not a project.
• “It’s purely an IT exercise.” ISO 27001 explicitly requires leadership involvement, HR processes, and organisation-wide awareness. It is a business management system, not just a technical one.

Beyond these myths, most projects hit a familiar set of obstacles. Our roundup of common ISO 27001 challenges covers the ones that trip teams up most often — scope creep, thin evidence, and under-resourced ownership among them — so you can plan around them rather than discover them the hard way.

It also helps to learn from those who have already been through it. The ISO 27001 key learnings gathered from real-world certification projects distil what experienced teams wish they had known on day one, which is often worth more than any checklist.

Getting started: your path to certification

The best way to begin is to get your bearings before you spend any money. Our overview of getting started with ISO 27001 sets the direction, mapping the major milestones so the project feels like a sequence of manageable steps rather than one intimidating leap.

The first real task is to find out where you stand today. An ISO 27001 gap analysis compares your current practices against the standard’s requirements and produces a punch-list of exactly what is missing, which becomes the backbone of your project plan.

As you get closer to the audit, you will want a sharper read on your chances. A formal ISO 27001 readiness assessment simulates the auditor’s perspective and tells you, honestly, whether you are ready for Stage 2 or still have work to do.

For day-to-day execution, it helps to work from a concrete list. The ISO 27001 checklist turns the standard’s requirements into tickable tasks, so progress is visible and nothing important is quietly forgotten.

A great deal of ISO 27001 is documentation, and you do not have to write it all from a blank page. Ready-made ISO 27001 templates give you policies, procedures, and registers you can adapt to your organisation, saving weeks of drafting.

Whatever you produce then needs to stay organised and current. Good ISO 27001 documentation practices keep your policies, records, and evidence in order, which is exactly what an auditor wants to see and what a stressed team usually lacks.

How you run the programme matters as much as what you produce. Applying proven ISO 27001 best practices keeps the ISMS healthy and the effort proportionate, so security supports the business rather than fighting it.

Much of the manual grind can now be handled by software. Sensible ISO 27001 automation takes over repetitive evidence collection and control checks, freeing your team to focus on the judgement-heavy work that tools cannot do.

Choosing where that automation lives is its own decision. Our guide to ISO 27001 compliance software helps you compare the platforms and pick one that fits your stack rather than forcing you to reshape everything around it.

The end goal is to stop treating audits as annual fire drills. Moving to ISO 27001 continuous compliance means your controls stay in a certifiable state all year, so surveillance and recertification audits become routine rather than disruptive.

Continuous compliance only works if you can actually see what is happening. Ongoing ISO 27001 continuous monitoring watches your controls and evidence in real time, catching drift before it hardens into a finding.

And when you want to go deeper on any of this, there is a single place to look. Our full library of ISO 27001 resources collects the guides, tools, and downloads referenced throughout this hub in one convenient index.