ISO/IEC 27001:2022 · Information security management
ISO/IEC 27001:2022 certification
ISO/IEC 27001:2022 requires a risk-based information security management system. It is audited against your own risk treatment decisions and the 93 controls in Annex A — not against a fixed checklist.
Who ISO 27001 suits
- SaaS and managed service providers facing enterprise security reviews.
- Organizations handling personal, financial or health data under contract.
- Teams that need a defensible answer to vendor security questionnaires.
What the standard requires
Scope and context
Define the ISMS boundary, dependencies and the interfaces it relies on.
Leadership and policy
Security policy, assigned accountability, and management review of the ISMS.
Risk assessment
A repeatable method, an asset-based risk register, and documented treatment decisions.
Annex A controls
93 controls across organizational, people, physical and technological themes.
Statement of Applicability
Every Annex A control listed with an inclusion or exclusion decision and a justification.
Monitoring and improvement
Metrics, internal audit, incident response and corrective action.
At a glance
Standard
ISO/IEC 27001:2022
Category
Information security management
Indicative fee
From $5,000 for coordination support. Certification body audit fees are quoted separately.
Certification cycle
Three years, with surveillance audits at approximately 12 and 24 months.
Issued by
An authorized certification body. Northbridge coordinates the programme and maintains the register.
Need this standard?
Send the contract clause or questionnaire item that triggered the requirement. We will confirm fit before you commit.
What we prepare with you
Risk register and SoA
We build the risk assessment method, the asset register and the Statement of Applicability the auditor will test against.
Control evidence
Access reviews, change management, supplier assessment, logging and incident records assembled into an auditable evidence pack.
Readiness audit
A full internal audit against Annex A before the certification body is booked.
Audit sequence
Stage 1 readiness review
The certification body reviews documentation and readiness, and agrees the Stage 2 plan.
Stage 2 audit
On-site or hybrid assessment of implementation and evidence against the standard.
Findings and correction
Nonconformities are closed with root-cause analysis and evidence of correction.
Decision and registration
On a positive decision the certificate is issued and published in our public register.
ISO 27001 questions
Does ISO 27001 require specific technology?
No. It requires controls that are appropriate to your risk assessment. A small cloud-native team and a data centre operator will implement different controls and both can conform.
How much documentation is needed?
The standard mandates a defined set: scope, policy, risk method, risk assessment, treatment plan, SoA and evidence of competence. Everything else should follow from your own risks.
What is the Statement of Applicability?
A document listing all 93 Annex A controls, stating whether each is applied, and giving a justification. Auditors test the system against it.
Can we certify a cloud-hosted environment?
Yes. The ISMS scope can cover cloud services you operate, including the shared responsibility boundary with your provider.
Scope ISO 27001 for your organization
Tell us your sites, headcount and target date. You will receive a written scope, audit-day estimate and fee within one business day.
Related standards: ISO 22301:2019 · ISO 9001:2015