What Is ISO 27001? The Information Security Standard Explained

ISO 27001 is the international standard for managing information security. Its full name is ISO/IEC 27001:2022, and it sets out the requirements for an information security management system (ISMS): the policies, processes, people and controls an organisation uses to manage risks to its information. Organisations can be independently certified against it, which is why customers and tenders ask for it.

The standard has two parts that matter in practice: seven mandatory clauses (4 to 10) that define how the management system must work, and Annex A, a list of 93 controls you select from according to your risks. It applies to organisations of any size or sector, and covers information in every form, not just IT systems.

What is ISO 27001 in simple terms?

ISO 27001 is a framework for deciding how to protect your information, and for proving that you do. It does not tell you which firewall to buy. Instead it asks you to:

1. Decide which parts of the business the ISMS covers (the scope).
2. Work out what could go wrong with your information (the risk assessment).
3. Choose controls to deal with the risks that matter.
4. Run those controls, and make sure people know their part.
5. Check that they work, through measurement, internal audit and management review.
6. Fix what does not work, and keep improving.

Because it is risk-based, two certified organisations can look very different. A 15-person consultancy and a payment processor meet the same requirements, each in proportion to its own risks.

What does ISO/IEC 27001 mean?

Each part of the name tells you something:

The full title ends with the word “Requirements”, and that matters: ISO 27001 is the member of the family you can be certified against. Its companion, ISO 27002, gives detailed guidance on the controls but is not certifiable.

The standard grew out of British Standard BS 7799, first published by BSI in 1995. The first ISO edition followed in 2005, the second in 2013 and the third in 2022.

What is an ISMS?

An ISMS is the way an organisation runs information security as a managed, repeatable process rather than a one-off project. It protects the confidentiality, integrity and availability of information, and it covers people and processes as well as technology. An ISMS is not software you buy: it is your scope, risk assessment, policies, controls, roles, audits and reviews, owned by top management. ISO 27001 defines what an ISMS must include to be certified. Our guide to the information security management system explains how to build, run and audit one.

The diagram shows how the pieces fit: clauses 4 to 10 run as a cycle of planning, operating, checking and improving, and the Annex A controls are the safeguards you choose along the way.

What are the main parts of ISO 27001?

Clauses 0 to 3 introduce the standard and its terms. Clauses 4 to 10 are the mandatory requirements, and none of them can be excluded:

Our guide to ISO 27001 requirements explains each clause and the documents it calls for.

Annex A lists 93 controls in four themes:

You do not have to implement all 93. You must consider every one, then record which you apply and why in a Statement of Applicability. Our guide to ISO 27001 Annex A controls explains each control in plain English.

Clauses 4 to 10 follow the common structure (Annex SL) that ISO uses for its management system standards, including ISO 9001 and ISO 14001, so an organisation that already holds one of those can run them as an integrated system.

Which version of ISO 27001 is current?

The current version is ISO/IEC 27001:2022, the third edition, published in October 2022 and amended in 2024. The transition from the 2013 edition ended on 31 October 2025, so every valid certificate, and every new certification audit, is now to the 2022 edition.

If your policies or Statement of Applicability still use the old A.5 to A.18 numbering, they need rebuilding on the 2022 control list; our Annex A guide shows the new controls.

What is ISO 27001 certification, and how does it work?

ISO 27001 certification is confirmation, from an independent certification body, that your ISMS meets the standard. Only a certification body can issue the certificate; a consultant prepares you but cannot certify you. Our guide on how to choose an ISO 27001 consultant sets out what to look for and the red flags.

For a small or mid-sized organisation, steps 1 to 6 typically take three to nine months. Our guide to ISO 27001 certification cost breaks down consultancy, audit and surveillance fees over the full cycle. Once certified, you show it with your certification body’s mark rather than the ISO logo; our guide to the ISO 27001 logo explains the rules.

Who needs ISO 27001, and is it mandatory?

ISO 27001 is not a legal requirement in the UK. UK GDPR (Article 32) requires appropriate technical and organisational measures to protect personal data, and an ISMS is a recognised way to show you have them, but no law makes certification itself compulsory. EU rules such as DORA and the NIS2 directive likewise require security measures without mandating ISO 27001 certification, although an ISMS covers most of what they ask for.

In practice it becomes mandatory when a customer, tender or partner makes it a condition. That is most common for:

If no customer has asked for it yet, Cyber Essentials is often a quicker first step, and its evidence carries into ISO 27001 later.

How does ISO 27001 compare with Cyber Essentials, PCI DSS and SOC 2?

They answer different questions, and many organisations hold more than one.

For side-by-side detail, see Cyber Essentials vs ISO 27001 and PCI DSS vs ISO 27001. If a US customer asks for a SOC 2 report, our guide to SOC 2 compliance explains the examination; if it asks about the NIST Cybersecurity Framework instead, our NIST CSF guide maps it to ISO 27001. The official overview of the scheme is on the NCSC Cyber Essentials site.

What are the benefits of ISO 27001?

The main benefits are commercial and operational: access to contracts that require the certificate, shorter security questionnaires, security spending directed by risk rather than by the latest incident, and a routine of audits and reviews that stops controls drifting. Our article on the benefits of ISO 27001 covers each one and whether certification is worth the cost.

Why Sovereign Secure

• ISO 27001 certified ourselves, so we run the same ISMS routine, internal audits and surveillance audits we prepare clients for.
• Preparation and certification kept separate. We take you from gap analysis to audit-ready through our ISO 27001 consultancy; certification audits are carried out by an independent certification body, our partner MQA International.
• One evidence set for several schemes. As a PCI SSC Qualified Security Assessor (QSA) company and an IASME-licensed Cyber Essentials certification body, we map ISO 27001 to PCI DSS and Cyber Essentials.
• Wider ISO consultancy, including ISO 9001, 14001, 45001, 22301 and ISO 20000-1, for organisations running more than one management system.
• UK company since 2012, headquartered in Accrington, Lancashire (Companies House 08334453).

Next step

If you are deciding whether ISO 27001 is right for you, a gap analysis shows how far you are from certification and what it would take. Use the form below, which is already set to ISO 27001, or call +44 161 523 5276.