ISO 27001

ISO 27001 is the international standard for information security management systems (ISMS). It sets out how organisations systematically identify, address, monitor and improve information security risks, and is the only certifiable standard in the ISO 27000 series. The current version, ISO/IEC 27001:2022, covers the management system requirements set out in Chapters 4 to 10, as well as 93 controls in the normative Annex A. Certification is granted to organisations and defined parts of organisations, not to products or individuals.

What is ISO 27001?

ISO 27001 sets out the requirements for a management system that enables an organisation to manage its information security – using a risk-based approach rather than a measure-based one. The standard does not prescribe which firewall to use or which encryption method to choose. Instead, it requires a traceable process: identifying risks, assessing them, deciding how to manage them, implementing measures, measuring their effectiveness and feeding the findings back into the management process.

The correct designation is ISO/IEC 27001, as the standard is published jointly by the International Organisation for Standardisation and the International Electrotechnical Commission. In Germany, it is published as DIN EN ISO/IEC 27001. In common parlance, the abbreviated form ISO 27001 has become established; this generally refers to the 2022 edition.

It is important to understand the distinctions within the family of standards. Only ISO 27001 itself is certifiable; ISO/IEC 27002:2022 contains detailed implementation guidance on the same 93 controls, but does not constitute grounds for certification. In addition, ISO/IEC 27005 provides a methodology for risk management, ISO/IEC 27017 and 27018 offer guidance for cloud environments, and ISO/IEC 27701 extends the standard to include data protection management. Furthermore, only organisations or defined parts of organisations are certified – not products and not individuals.

What is an ISMS in accordance with ISO 27001?

An Information Security Management System (ISMS) in accordance with ISO 27001 is the totality of policies, procedures, roles, resources and evidence used by an organisation to manage information security on an ongoing basis. The term is deliberately broad: an ISMS is neither a piece of software nor a set of documents, but a control loop.

This control loop follows the PDCA principle of Plan, Do, Check and Act. In practice, this means that every measure must be traceable back to an assessed risk and that every decision – including the deliberate decision to accept a risk – is documented. The standard explicitly protects more than just digital data: it covers information in any form, including paper files, verbal communication and employees’ knowledge.

Central to this is the scope, referred to as ‘Scope’ in the text of the standard. It defines which sites, business processes, systems and organisational units the ISMS covers. At the same time, the scope is the most frequently underestimated factor: a very narrowly defined scope simplifies certification considerably but reduces the validity of the certificate – a point that should be checked first when assessing third-party certificates in supplier management.

How is ISO 27001 structured?

ISO 27001 follows the harmonised structure shared by all modern ISO management system standards. The mandatory requirements are set out in Chapters 4 to 10; Chapters 1 to 3 cover the scope, normative references and terms.

Chapter	Title	Key points
4	Context of the organisation	Interne und externe Themen, Erwartungen interessierter Parteien, Festlegung des Anwendungsbereichs
5	Leadership	Commitment of top management, information security policy, roles and responsibilities
6	Planning	Risk assessment and risk treatment, statement on applicability, safety objectives, change management
7	Support	Resources, expertise, awareness, communication, documented information
8	Operation	Implementation of the planned processes, carrying out the risk assessment and risk treatment
9	Performance assessment	Monitoring and measurement, internal audit, management review
10	Improvement	Continuous improvement, handling non-conformities and corrective actions

The practical weighting differs from the order in which the chapters appear. Chapter 6 is the core of the document, as it sets out the entire risk process, including an explanation of its applicability. Chapter 5, on the other hand, is decisive for the success of the project: without demonstrable commitment from top management – in terms of resources, decisions and visible involvement in the management review – certification projects regularly fail, regardless of their technical maturity.

What measures are set out in Annex A of ISO 27001?

Annex A of ISO 27001:2022 contains 93 controls, which are organised into four subject areas. These controls do not constitute a mandatory list: the organisation compares the controls derived from its risk treatment against Annex A in order to identify any gaps, and sets out in the statement of applicability which controls it implements and which it excludes, along with the reasons for doing so.

Topics	Number	Examples
A.5 Organisatorische Maßnahmen	37	Policies, roles, supplier relationships, threat intelligence, cloud usage, incident management
A.6 Personenbezogene Maßnahmen	8	Pre-employment checks, awareness-raising and training, disciplinary procedures, remote working
A.7 Physische Maßnahmen	14	Security areas, access control, surveillance, cabling, handling of data storage media
A.8 Technologische Maßnahmen	34	Access control, cryptography, logging, vulnerability management, secure development

In the 2022 version, each measure is also assigned additional attributes – such as measure type, affected protection objectives, allocation to the functions of identification, protection, detection, response and recovery, as well as operational capabilities. Whilst the use of these attributes is not mandatory, they make filtering and alignment with other frameworks considerably easier.

What has changed with ISO 27001:2022?

The 2022 edition has primarily reorganised Annex A: the 114 measures across 14 sections have been consolidated into 93 measures across four thematic areas. This reduction is mainly due to measures being merged, not to any being deleted – in terms of content, the scope has actually increased. Eleven new measures have been added, reflecting developments in the threat landscape since 2013:

• Threat intelligence (A.5.7)
• Information security when using cloud services (A.5.23)
• ICT preparedness for business continuity (A.5.30)
• Physical security monitoring (A.7.4)
• Configuration management (A.8.9)
• Deletion of information (A.8.10)
• Data masking (A.8.11)
• Prevention of data leaks (A.8.12)
• Monitoring activities (A.8.16)
• Web filtering (A.8.23)
• Secure programming (A.8.28)

The changes in Chapters 4 to 10 are less extensive; among other things, the planning of changes to the ISMS has been added. A subsequent amendment to the standard has also incorporated climate change as a potentially relevant contextual factor in Chapters 4.1 and 4.2.

For certified organisations, the revised version was accompanied by a transition period, after which certificates issued under the 2013 version ceased to be valid. The exact status of transition periods and amendments should be checked before implementation, as accreditation bodies continue to update the regulations.

What documents does ISO 27001 require?

ISO 27001 requires a manageable amount of mandatory documented information – significantly less than is often suggested in practice. Mandatory elements include, amongst others, the scope of the ISMS, the information security policy, the procedures for risk assessment and risk treatment together with their results, the Statement of Applicability, the information security objectives, evidence of competence, the results of monitoring and measurement, the internal audit programme with audit results, the results of the management review, and the documentation of non-conformities and corrective actions.

Particular emphasis is placed on the Statement of Applicability (SoA). It lists all 93 controls from Annex A and documents, for each one, whether it is applicable, why, whether it has been implemented, and the basis for the decision. The SoA thus serves as the link between risk assessment and measures – and is the document that auditors request first, as it reveals the consistency of the entire system.

The most common misjudgement concerns scope: an ISMS does not improve simply by containing more documents. Auditors check whether the documented information describes actual practice. A lean, actively implemented policy passes the audit; a comprehensive set of rules that nobody applies in day-to-day business leads to non-conformities.

What requirements does ISO 27001 set out for communication?

ISO 27001 addresses communication on two levels. Clause 7.4 requires the organisation to identify the internal and external communications relevant to the ISMS – in other words, to specify what is communicated, when, to whom and by what means. This seemingly formal requirement becomes a key issue in the event of an incident, as it sets out responsibilities and channels in advance.

At the measure level, clause A.5.14 is particularly relevant: the transmission of information requires rules, procedures and agreements for all types of transmission channels, explicitly including electronic messaging. In practice, this means specifying which classes of information may be exchanged via which services – and thus also addressing the use of private consumer messaging apps for business purposes. Added to this are the measures for handling information security incidents (A.5.24 to A.5.28), information security during a disruption (A.5.29) and the new measure on ICT readiness for business continuity (A.5.30), which establishes the link to business continuity management.

The interplay of these requirements leads to a consequence that is often only realised at a late stage in certification projects: the communication channels defined in the ISMS must remain functional even when the organisation’s own infrastructure is the subject of the incident. If a compromised network is isolated or the email system is shut down as a precautionary measure, directory services, email and collaboration platforms are no longer available as coordination channels. Organisations therefore maintain pre-approved channels that function independently of the affected infrastructure, are documented in a traceable manner and are tested as part of crisis communication exercises.

Teamwire demonstrates how to set up a channel for alerting and incident coordination, independent of the regular IT system, in a demo or via a free trial.

What is the process for ISO 27001 certification?

ISO 27001 certification is carried out by an independent, accredited certification body as part of a two-stage audit and is subsequently maintained over a three-year cycle.

In the Stage 1 audit, the certification body checks whether the ISMS is, in principle, ready for certification: the scope, policy, risk assessment, statement of applicability, internal audit and management review must be in place and fit together coherently. You can address any identified gaps before Stage 2. In the Stage 2 audit, the auditors examine the actual implementation on-site and through interviews – it is not the document that counts here, but proof that the described procedures are being applied. Non-conformities are classified by severity and must be corrected through corrective actions, including a root cause analysis.

Upon successful completion, a certificate valid for three years is issued. In the following two years, surveillance audits of reduced scope take place, with recertification in the form of a full audit in the third year. A prerequisite for the certificate’s validity is the accreditation of the certification body – in Germany, this is carried out by the German Accreditation Body. Non-accredited certificates are generally not accepted in tenders and supplier evaluations.

Two internal steps are mandatory prior to the external audit: at least one internal audit covering the entire scope of application and a documented management review by top management. Neither of these is a mere formality; rather, they are the most common cause of delays if they are scheduled too late.

How does ISO 27001 relate to NIS-2, DORA and the GDPR?

ISO 27001 is a voluntary standard and does not replace any legal obligation – but it does provide the methodology for meeting and demonstrating compliance with regulatory requirements in a structured manner.

Framework	Character	Relationship to ISO 27001
NIS-2	Legal obligation for essential and important facilities	An ISMS systematically addresses many requirements; a certificate does not replace these obligations
DORA	EU regulation directly applicable to the financial sector	A sound foundation; DORA-specific elements such as the information register and reporting deadlines are missing from the ISMS
GDPR Art. 32	Legal obligation to implement appropriate protective measures	Supports the provision of evidence, but does not constitute certification under Article 42 of the GDPR
BSI IT Security Framework	National procedural model with a catalogue of building blocks	Certification to ISO 27001 based on the IT Security Framework is possible through the BSI
ISO 22301	Standard for business continuity management systems	Supplements ISO 27001 with a methodology for business continuity and recovery
TISAX	Testing and replacement procedures in the automotive industry	It builds on ISO 27001 in terms of content, but is a separate procedure

The certificate’s role in market activities is noteworthy. Whilst it does not replace any legal obligation, in practice it significantly shortens supplier vetting processes, is increasingly required in public tenders and framework agreements, and serves as evidence within the context of a data processing agreement – without removing the controller’s obligation to select and monitor processors.

What are the typical mistakes made when implementing ISO 27001?

The most common mistake is to treat ISO 27001 as a documentation project with certification as the end goal. The standard requires a system to be in regular operation; a system that is only activated in the run-up to audits will result in the same findings at every surveillance audit. Further examples from practical implementation:

• Scope of application so narrowly defined that key processes fall outside it, and the certificate carries little weight with customers
• Risk assessment presented as a one-off table rather than as a recurring process with defined triggers
• Statement on applicability with no discernible link to the risks actually assessed
• Measures taken from Annex A without any associated risk being documented
• Top management involved only in a formal capacity; management review presented as a retrospectively drawn-up report
• Key performance indicators that measure activity rather than effectiveness – for example, the number of training sessions conducted rather than their impact
• Supplier management reduced to the collection of certificates, without checking the scope of application or validity
• Internal audits carried out by the very same people responsible for the processes being audited

Summary: Key points regarding ISO 27001

• ISO 27001 is the international standard for information security management systems and the only certifiable standard in the ISO 27000 series.
• The standard takes a risk-based rather than a measure-based approach: every measure must be traceable to an assessed risk, and every decision must be documented.
• The mandatory requirements are set out in Chapters 4 to 10, ranging from context and leadership through planning and operation to performance evaluation and improvement.
• Annex A of the 2022 edition contains 93 controls across four subject areas: organisational, personnel-related, physical and technological.
• The 2022 revision introduced eleven new controls, including threat intelligence, cloud usage, prevention of data breaches and ICT readiness for business continuity.
• The Statement of Applicability (SoA) links risk assessment and controls and is the key document examined during the audit.
• Certification is a two-stage process and is maintained over a three-year cycle comprising two surveillance audits and one recertification.
• A certificate is only valid if issued by an accredited certification body and has a sufficiently broad scope of application.
• ISO 27001 does not replace any legal obligations arising from NIS-2, DORA or the GDPR, but it does provide the methodology for their structured fulfilment and verification.
• The most common implementation error is treating it as a documentation project rather than as part of normal operations – a system that is only activated before audits results in recurring findings.