Clear answers for teams implementing ISO/IEC 27001: define the ISMS scope, assess information security risk, choose treatment options, build the Statement of Applicability, and keep audit evidence current.
Use these answers to define responsibilities, connect risk and control decisions, and prepare the records needed for the scoped ISMS.
ISO/IEC 27001:2022 sets requirements for establishing, implementing, maintaining, and continually improving an . Start with five connected decisions: the ISMS scope, risk-assessment criteria and results, risk treatment and necessary controls, the Statement of Applicability, and the evidence used for monitoring, internal audit, management review, and improvement.
These focused FAQ modules break this artifact into narrower answer sets so teams can move straight to the right source-backed guidance.
How to assign practical owners for ISO/IEC 27001 Annex A controls without confusing control ownership with the standard's required risk-owner accountability.
What ISO/IEC 27001 certification auditors may sample, how to connect requirements to operating evidence, and what the certification body does not own.
How should teams run ISO/IEC 27001 internal audits: who should own each step, what evidence is expected, and how findings are resolved.
What ISO/IEC 27001 management review must consider, what top management must decide, what evidence to retain, and how to set the cadence.
How ISO/IEC 27001 risk acceptance works: criteria, risk-owner approval, residual-risk evidence, external obligations, and reassessment triggers.
Justify ISO/IEC 27001 Annex A exclusions from scope and risk treatment, distinguish implementation gaps, and retain approval and review evidence.
What ISO/IEC 27001 surveillance audits check, how they differ from internal audit and recertification, and what evidence to maintain between audits.
The ISMS scope must establish the management system's boundaries and applicability. When setting it, the organization considers relevant internal and external issues, relevant interested-party requirements, and interfaces and dependencies between its activities and activities performed by other organizations. The scope must be available as documented information.
Teams should connect the scope to information handled by the business, not only to departments or platforms. If customer data, production environments, outsourced operations, or critical suppliers support the scoped service, the ISMS record should explain how those interfaces are governed.
Sources (2)
ISO/IEC 27001:2022 clause 4.3 defines the considerations and documented-information requirement for the ISMS scope.
Information security management systems — Requirements
This source supports the certification context for organizations whose scoped ISMS will be audited by a certification body.
Requirements for bodies providing audit and certification
Risk assessment should identify risks to the confidentiality, integrity, and availability of information within the ISMS scope, analyse them with defined criteria, and prioritize them for treatment. The record should show the asset, threat or weakness, business impact, likelihood or severity logic, risk owner, and current decision.
Risk treatment begins with treatment options selected in light of the assessment results. Common organizational options include modifying, avoiding, sharing, or retaining risk, but ISO/IEC 27001 does not impose that exact four-label taxonomy. The organization determines all necessary controls, checks them against Annex A, produces the SoA, formulates the treatment plan, and obtains risk-owner approval and residual-risk acceptance.
Sources (2)
ISO/IEC 27001:2022 clauses 6.1.2 and 6.1.3 define risk criteria, assessment, treatment, necessary-control comparison, the SoA, the treatment plan, and risk-owner approval.
Information security management systems — Requirements
This source supports the risk-management explanation because ISO/IEC 27005 gives guidance for identifying, assessing, treating, monitoring, and reviewing information security risks.
Guidance on managing information security risks
The Statement of Applicability connects risk treatment to the control set. It must contain the necessary controls, justification for their inclusion, whether those controls are implemented, and justification for excluding any Annex A controls. Necessary controls may be designed by the organization or drawn from sources beyond Annex A.
Keep the SoA traceable to risk-assessment results, applicable requirements, treatment options, implementation status, and evidence. Control owners and evidence locations are useful internal fields, but ISO/IEC 27001 does not require those exact fields to appear in the SoA.
Sources (2)
ISO/IEC 27001:2022 clause 6.1.3(d) states the required contents of the Statement of Applicability and its connection to risk treatment.
Information security management systems — Requirements
This source supports the Annex A control context because ISO/IEC 27001 Annex A controls are aligned with ISO/IEC 27002:2022 control guidance.
Information security controls
This FAQ helps connect your ISMS scope, risk register, treatment plan, Statement of Applicability, Annex A evidence, internal audit results, and management-review actions into one accountable evidence model.
Convert ISO/IEC 27001 answers into owners, evidence requests, control checks, and review tasks.
Review your ISMS scope, SoA, risk-treatment evidence, audit readiness, and certification gaps.
Certification evidence should show both design and operation. Design evidence explains the ISMS scope, policies, risk process, control selection, SoA, objectives, roles, and procedures. Operating evidence shows the process ran: completed risk reviews, access reviews, security events, supplier reviews, training records, vulnerability handling, incident records, audit reports, management-review minutes, nonconformities, and corrective actions.
A surveillance audit samples continuing conformity during an active certification cycle. A certificate does not prove every control is permanently effective or every system secure; the organization still needs evidence that the scoped ISMS operated, changes were assessed, findings were handled, and management reviewed performance.
Sources (2)
This source supports the certification-body and audit context for ISO/IEC 27001 certificates.
Requirements for bodies providing audit and certification
This source supports the recommendation to verify and monitor management-system certifications through a public certification database.
verify and monitor certifications
Internal audit must determine whether the ISMS conforms to ISO/IEC 27001 and to the organization's own requirements, and whether it is effectively implemented and maintained. The audit programme must consider process importance and previous audit results, so high-risk or repeatedly weak areas receive appropriate attention.
Management review is where leadership decides whether the ISMS remains suitable, adequate, and effective. Required inputs include previous-review actions; relevant context and interested-party changes; performance trends in nonconformities, corrective actions, monitoring, audit results and objective fulfilment; interested-party feedback; risk-assessment results; treatment-plan status; and improvement opportunities. Add resource needs where they affect the decisions.
Sources (2)
This source supports the internal-audit, management-review, performance-evaluation, and improvement framing for the ISMS.
Information security management systems — Requirements
This source supports the point that risk treatment and monitoring should remain part of ongoing ISMS operation.
Guidance on managing information security risks
Treating ISO/IEC 27001 as a certificate project leaves the management system stale after the audit. Certification is separate from the organization's continuing duties to maintain scope, risk treatment, control operation, performance evaluation, and improvement records.
Another common mistake is copying every Annex A control into the SoA without risk-based reasoning. ISO/IEC 27001 expects teams to determine necessary controls from risk treatment, compare them with Annex A so controls are not overlooked, and justify exclusions. That is different from implementing every control identically across every environment.
Sources (2)
This source supports the distinction between ISO/IEC 27002 control guidance and ISO/IEC 27001 certification requirements.
Information security controls
This source supports the certification-body credibility and audit-practice context for ISO/IEC 27001 certification.
audit and certification
This hub covers ISO/IEC 27001:2022, the third edition published in October 2022, together with ISO/IEC 27001:2022/Amd 1:2024, titled Climate action changes. The IAF transition from the 2013 edition ended on 31 October 2025, so use the 2022 edition and 2024 amendment for a current assessment or accredited-certification baseline and confirm the certification body's applicable instructions.
ISO/IEC 27001 is a voluntary management-system standard. Certification is optional unless a contract, procurement rule, sector requirement, or other applicable obligation makes it necessary for the organization. A certificate does not by itself prove compliance with NIS2, privacy law, or another legal regime.
An organization can implement the standard and assess its own conformity without third-party certification, but it should describe that claim accurately. Certification is a separate decision made by a certification body after audit; an implementation statement or internal assessment is not an accredited certificate.
No. ISO/IEC 27001:2022 clause 1 says excluding any of the requirements specified in Clauses 4 to 10 is not acceptable when an organization claims conformity to the document.
ISO/IEC 27001:2022 clause 6.1.3 says the SoA must contain the necessary controls, justification for their inclusion, whether the necessary controls are implemented or not, and the justification for excluding any of the Annex A controls.
ISO/IEC 27001:2022 clause 8.2 says risk assessments shall be performed at planned intervals or when significant changes are proposed or occur.
ISO/IEC 27001:2022 clause 9.3.3 says the management review results shall include decisions related to continual improvement opportunities and any needs for changes to the .
No. ISO/IEC 27001:2022/Amd 1:2024 requires the organization to determine whether climate change is a relevant issue under Clause 4.1 and notes under Clause 4.2 that relevant interested parties can have climate-change requirements. Record the determination and address any resulting ISMS requirement or risk. The amendment does not add a universal Annex A climate control.
ISO/IEC 27001:2022 groups the 93 Annex A controls into 37 organizational controls, 8 people controls, 14 physical controls, and 34 technological controls. These groups organize the reference set; they do not create a requirement to implement every control. The organization determines necessary controls from risk treatment, checks them against Annex A, and justifies any Annex A exclusions in the Statement of Applicability.
"Information security management systems — Requirements"
"audit and certification"
"Requirements for bodies providing audit and certification"
"Information security controls"
"Guidance on managing information security risks"
"verify and monitor certifications"
"93 controls in 4 clauses"
"Climate action changes"
Build useful ISO/IEC 27001:2022 Annex A control evidence: selected controls, SoA rationale, owners, implementation proof, effectiveness checks, audit records, and improvement actions.
Prepare ISO/IEC 27001 audit evidence across ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, internal audit, management review, and corrective actions.
Plan optional ISO/IEC 27001 certification from scope readiness through Stage 1, Stage 2, findings, certification decision, surveillance, and recertification.
Build ISO/IEC 27001:2022 conformity evidence for ISMS scope, leadership, risk assessment and treatment, the Statement of Applicability, operations, audits, management review, and corrective action.
A practical ISO/IEC 27001:2022 roadmap from context and scope through risk treatment, the SoA, control operation, internal audit, management review, corrective action, and optional certification.
Keep ISO/IEC 27001 internal audit and management review distinct and connected: independent audit evidence, top-management decisions, corrective actions, resources, and improvement records.
Plain-language guide to ISO/IEC 27001:2022 Clauses 4-10: context, leadership, planning, support, operation, performance evaluation, improvement, and Annex A control selection.
Connect ISO/IEC 27001 risk-treatment choices, necessary controls, the treatment plan, Statement of Applicability, residual-risk acceptance, owners, evidence, and review triggers.
Build an ISO/IEC 27001 risk-treatment register that links assessed risks to treatment options, controls, SoA entries, actions, owners, residual-risk approval, evidence, and review triggers.
Operate the ISO/IEC 27001 Statement of Applicability as a live evidence index linking necessary controls, Annex A inclusion and exclusion rationale, implementation status, owners, and proof.
Practical ISO/IEC 27001:2022 Statement of Applicability template fields for necessary controls, Annex A applicability, inclusion and exclusion rationale, status, owners, evidence, and review history.
Compare voluntary ISO/IEC 27001 ISMS conformity and optional certification with NIS2 legal duties, entity scope, management accountability, incident reporting, supervision, and penalties.
Compare ISO/IEC 27001:2022's certifiable ISMS requirements with NIST CSF 2.0's cybersecurity outcomes, Profiles, Tiers, Functions, evidence uses, and adoption choices.
Compare ISO/IEC 27001 certification with SOC 2 examination reports: criteria, scope, assurance period, auditor and certification-body roles, deliverables, evidence reuse, and claim limits.