ISO/IEC 27001:2022
ISO 27001 certification, from scope statement to certificate
What gets certified, the documents auditors read first, how the Statement of Applicability works, and what happens across the three-year certification cycle.
In short
ISO/IEC 27001 is the international standard for an information security management system (ISMS). An accredited certification body audits it in two stages and issues a certificate valid for three years, with surveillance audits in years one and two. It certifies the management system, meaning your scope, risk treatment, controls and the evidence that they operate, not your product.
What ISO 27001 actually certifies
ISO/IEC 27001 is a certifiable standard for an information security management system. The certificate is awarded for running that management system: a documented, repeating cycle of scoping, risk assessment, control selection, implementation, internal audit, management review and improvement. The security tools you use matter only as part of that cycle.
This is why first-time teams often find it heavier than SOC 2. The auditor assesses how you govern security as well as the technical controls. In return you get a certificate from an accredited body, recognised internationally, that a buyer can check.
A narrow, honest scope statement is the most important decision in the project. It decides which systems, people and locations the auditor examines, and so how much work the whole programme is.
Who needs ISO 27001
ISO 27001 is what buyers in Europe, the UK, the Middle East and much of APAC and India ask for, in the way US buyers ask for SOC 2. Public-sector tenders and regulated industries often require it outright. If you sell internationally you will often hold both, which is why it pays to build them on the same controls.
- SaaS and services companies selling into European, UK or APAC enterprises
- Suppliers to banks, insurers, healthcare and government
- Companies whose customers must assess their own supply chain under NIS2 or DORA
- Teams planning ISO 42001 for AI, which shares ISO 27001’s structure
The documents the auditor reads first
Four documents carry most of the weight at Stage 1. If they are coherent, the rest of the audit tends to follow.
- Scope statement (clause 4.3)
- Which systems, people and locations the ISMS covers, and what is excluded.
- Risk assessment and treatment (6.1.2, 6.1.3)
- Your method, the risks you found, and what you decided to do about each.
- Statement of Applicability (6.1.3)
- Every Annex A control, whether it applies, why, and how it is implemented.
- Policies and records (clauses 5 to 10)
- The security policy, objectives and the records that prove the system runs.
The Statement of Applicability
The Statement of Applicability (SoA) lists all 93 Annex A controls in the 2022 edition. For each one it records whether the control applies, why, and how it is implemented.
It is the document auditors scrutinise most. An SoA that lists controls without justifying exclusions is one of the most common Stage 1 findings. “Not applicable” is an acceptable answer, but only with a reason that follows from your risk assessment and scope.
| Annex A theme | Controls | Examples |
|---|---|---|
| A.5 Organisational | 37 | Policies, supplier security, incident management, cloud services |
| A.6 People | 8 | Screening, terms of employment, awareness, remote working |
| A.7 Physical | 14 | Secure areas, equipment, clear desk, storage media |
| A.8 Technological | 34 | Access control, logging, backup, secure development |
| Control | Justification or implementation | Status |
|---|---|---|
| A.5.23 Cloud services | Supplier assessments and an exit plan | Implemented |
| A.7.4 Physical monitoring | Excluded: no premises of our own | Justified |
| A.8.28 Secure coding | Scanning in CI, review before merge | In progress |
| A.5.30 ICT continuity | Restore tested every quarter | Implemented |
Each row carries its justification, so an exclusion explains itself. Example data, not a customer record.
In Certifyi you set each control’s applicability, justification and status on the Statement of Applicability screen. Read more in what a Statement of Applicability is.
Risk assessment and treatment
ISO 27001 is risk-driven: the controls you select exist to treat the risks you identified. The standard asks for a repeatable method, a register with owners, and a treatment decision for every risk: modify it with controls, avoid it, share it, or accept it.
Score risks before and after treatment, so the register shows what your controls actually achieved.
| Risk | Treatment | Inherent | Residual |
|---|---|---|---|
| Laptop loss or theft | Disk encryption and device management | High | Low |
| Critical supplier outage | Exit plan and a tested alternative | High | Medium |
| Credential phishing | Phishing-resistant MFA and training | High | Medium |
| Excessive access | Quarterly access reviews | Medium | Low |
Inherent and residual scores side by side show what each treatment achieved. Example data, not a customer record.
Accepting a risk is a decision someone owns. Record who approved it and when it expires, so an old decision comes back for review instead of quietly standing.
Stage 1 and Stage 2
Certification is a two-stage audit. Findings are raised as minor or major nonconformities rather than as a pass or fail. A major nonconformity must be corrected, with a root-cause analysis and evidence of the fix, before the certificate is issued.
- Stage 1
- A review of your documented ISMS and readiness: scope, risk assessment, SoA, policies, internal audit and management review.
- Stage 2
- An audit of whether the system operates: the auditor samples evidence that controls work as described.
See Stage 1 vs Stage 2 for what each visit samples.
The three-year cycle
A certificate covers a three-year cycle: an initial audit, two shorter surveillance visits, then a recertification audit that looks at the whole system again. Surveillance visits sample part of the ISMS, so controls outside this year’s sample still have to operate.
| When | Audit | What it covers |
|---|---|---|
| Year 0 | Initial certification | Stage 1 and Stage 2 across the full scope |
| Year 1 | Surveillance | A sample of the ISMS and last year’s findings |
| Year 2 | Surveillance | Another sample, often different areas |
| Year 3 | Recertification | The whole system again, for a new certificate |
Keep each audit’s findings and the evidence of their fixes, because the next auditor will ask what changed. Read how a surveillance audit and a recertification audit work.
ISO 27001 and SOC 2
They overlap heavily on controls and differ on structure and geography. If you hold a SOC 2 report, much of the control work carries over: access control, change management, logging, supplier management and incident response serve both. What ISO 27001 adds is the management-system layer: scope, risk method, SoA, internal audit and management review.
The path to certification
The sequence is the same for every organisation. How long each phase takes depends on your scope and on what already exists.
-
01
Scope and risk
Scope statement, asset inventory, risk method, risk assessment and a first treatment plan.
Your ISMS owner, with help from our implementation team if you want it
-
02
Controls and policies
Annex A controls selected in the SoA, policies adopted and acknowledged, evidence linked to controls.
Control owners, working in Certifyi
-
03
Internal audit and review
Internal audit by someone objective, a management review, and findings tracked to closure.
An objective internal auditor and leadership
-
04
Certification audit
Stage 1 documentation review, then the Stage 2 implementation audit.
Accredited certification body
Who does what
Software, implementation support and the independent certification body are different jobs. This is how they divide.
| Task | Your team | Certifyi | Certification body |
|---|---|---|---|
| Scope | Decide and document it | Records scope against the framework | Reviews it at Stage 1 |
| Risk assessment | Run it and own each decision | Holds the register with owners and treatments | Inspects method and results |
| Statement of Applicability | Justify each control | Records applicability and status per control | Tests it against practice |
| Internal audit and review | Carry them out objectively | Schedules audits and records management reviews | Expects both before Stage 2 |
| Certificate | Not involved | Not involved | Issues it, then audits each year |
How Certifyi helps
Keep the ISMS running between audits
Certifyi is the workspace where your ISMS lives between audits. The certificate comes from your certification body.
-
ISO 27001:2022 in the catalogue
Adopt the standard and track clauses and Annex A controls in one place.
-
Statement of Applicability
Set applicability, justification and status for every control.
-
Risk register
Score each risk on likelihood and impact, record its treatment and owner, and see on a heatmap where the risk sits.
-
Audit calendar and management reviews
Plan internal audits and record management review decisions and actions.
-
Tamper-evident activity log
Evidence stays on the Annex A control it supports, and every change to it is written to the tamper-evident activity log, so at a surveillance visit you can show what changed since the last one and who changed it.
From the blog
ISO 27001 articles
Longer answers to the questions teams ask while they work on ISO 27001.
-
Incident response plans: what SOC 2 and ISO 27001 auditors actually check
-
ISO 27001:2022 changes: the 93 Annex A controls, the 11 new ones, and what the transition meant
-
ISO 27001 Stage 1 vs Stage 2 audit: what to expect
-
The best ISO 27001 compliance software in 2026
-
The ISO 27001 Statement of Applicability, explained
-
ISO 27001 vs SOC 2: which should you do first?
Questions
ISO 27001, answered
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system. An accredited certification body audits the system in two stages and issues a certificate valid for three years, with surveillance audits in between.
Who issues the ISO 27001 certificate?
An accredited certification body, accredited by a national body such as UKAS or ANAB. Consultants and software vendors cannot certify you, and neither can Certifyi.
Do we need all 93 Annex A controls?
No. You select the controls that treat your risks and justify each exclusion in the Statement of Applicability. Weak justifications are one of the most common Stage 1 findings.
Do we need an internal audit before certification?
Yes. Clause 9.2 requires an internal audit programme, and the certification body expects at least one internal audit and one management review before Stage 2. The internal auditor must be objective, so it cannot be the person who built the controls.
How long does ISO 27001 take?
It depends on your scope, how much of the management system already exists, and the certification body’s schedule for Stage 1 and Stage 2. We look at your scope with you first, because a date given before that would be a guess.
How long is the certificate valid?
Three years, with a surveillance audit in each of the two intervening years and a recertification audit in year three.
What happens if Stage 2 finds a major nonconformity?
Certification waits until it is fixed. You submit a root-cause analysis and corrective action, and the auditor verifies it, sometimes with a short follow-up visit, before recommending certification.
Is ISO 27001 harder than SOC 2?
It is more prescriptive about governance: internal audit and management review are mandatory. The technical control overlap with SOC 2 is substantial, so doing both on the same controls avoids paying twice.
Can a small team get ISO 27001?
Yes. The standard scales to the organisation: a 20-person company documents a smaller scope, fewer assets and simpler processes. What it cannot skip is the management system itself.
Define your ISMS scope in a 30-minute call.
Bring your systems, locations and the customers asking for ISO 27001. A tight scope makes every later step smaller, so we start there and follow it through risk, the SoA and your audit calendar in Certifyi.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them