Context and scope
Understand internal and external issues, interested parties and their requirements, then define a clear ISMS scope.
ISO/IEC 27001:2022
ISO 27001 readiness, implementation and assurance.
ISO/IEC 27001 is the internationally recognised standard for an information security management system. We help organisations in Ireland, South Africa and beyond build an ISMS that passes certification and keeps working between audits.
At a glance
A management system, not a document set.
ISO/IEC 27001:2022 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). Certification is issued by an accredited certification body after a two-stage audit, followed by annual surveillance audits and recertification every three years.
The transition period from the 2013 edition ended on 31 October 2025, so certificates must now be held against the 2022 edition. Customers, regulators and frameworks such as NIS2, DORA and POPIA increasingly treat ISO 27001 as a baseline expectation.
| Current edition | ISO/IEC 27001:2022 (with Amendment 1:2024 on climate considerations) |
|---|---|
| Annex A controls | 93 controls in four themes: organisational, people, physical, technological |
| Certification | Stage 1 and Stage 2 audits by an accredited certification body |
| Certificate cycle | Three years, with annual surveillance audits |
| 2013 edition | Transition to 2022 ended 31 October 2025 |
| Related standards | ISO/IEC 27701 (privacy), ISO/IEC 42001 (AI management) |
Scope
Who benefits from ISO 27001.
Any organisation can implement ISO 27001, but certification is most valuable where customers, partners or regulators need independent assurance.
- SaaS, fintech and technology companies answering enterprise security questionnaires
- Managed service providers and outsourcers handling client data and systems
- Financial services, healthcare and public-sector suppliers facing regulatory supply-chain expectations
- Organisations preparing for NIS2, DORA, POPIA or JS-2 that want a structured control framework
Requirements
What ISO 27001 requires.
Clauses 4 to 10 define the management system. Annex A provides a reference set of controls, selected through risk assessment and recorded in a Statement of Applicability.
Leadership
Top-management commitment, an information security policy and defined roles and responsibilities.
Risk assessment and treatment
A repeatable method to identify, analyse and evaluate risks, with treatment plans and a Statement of Applicability.
Support and operation
Resources, competence, awareness, communication, documented information and operational control.
Performance evaluation
Monitoring and measurement, internal audit and management review.
Improvement
Nonconformity handling, corrective action and continual improvement.
Common gaps
Common ISO 27001 gaps.
- Risk assessments copied from templates rather than reflecting real assets, threats and owners
- Statements of Applicability that exclude controls without justification
- The 2022 controls, such as threat intelligence, cloud services security, configuration management, data leakage prevention and secure coding, implemented on paper only
- No technical evidence that vulnerability management, access control and logging actually work
- Internal audits performed by people who also own the controls being audited
- Management reviews held once a year with no recorded decisions
Free checklist
ISO 27001:2022 Readiness Checklist
A checklist covering ISMS scope, risk assessment, Statement of Applicability, the 2022 Annex A controls, internal audit and certification readiness.
FAQs
ISO 27001 questions we hear most often
Does SecuriCentrix issue ISO 27001 certificates?
No. Certificates are issued by accredited certification bodies. We prepare you for certification, perform independent internal audits and validate technical controls, keeping our advisory work separate from the certification audit.
How long does ISO 27001 certification take?
For a focused scope in a small-to-medium organisation, readiness typically takes three to six months, followed by the Stage 1 and Stage 2 audits. Larger or more complex scopes take longer.
What changed in ISO 27001:2022?
Annex A was restructured from 114 controls in 14 domains to 93 controls in four themes, with 11 new controls including threat intelligence, cloud services security, ICT readiness for business continuity, data leakage prevention and secure coding.
Does ISO 27001 cover NIS2 or DORA?
It covers much of the ground, particularly risk management, policies, access control and continuity. However, both regimes add specific requirements such as incident reporting deadlines, management-body accountability and third-party provisions. See our NIS2 and DORA pages.
Can we extend ISO 27001 to privacy or AI?
Yes. ISO/IEC 27701 extends an ISMS to privacy information management, and ISO/IEC 42001 provides a management system for AI. Both can be built on the same management-system foundations.
Related services and guidance
Sources
This page is general guidance, not legal advice. Last reviewed 27 October 2026.