We use privacy-by-default, cookieless analytics.

Optional analytics cookies are used only if you accept them.

Read our Terms of Use and Privacy Policy.

Global ISO 27001 · FAQ index

Questions and answers

Search the answers across this artifact’s FAQ modules. Open any answer in its guide or copy a direct link to share it.

35 questions across 7 modules

Back to FAQ overview
Author
Sorena AI
Published
May 9, 2026
Updated
Oct 15, 2026
Browse 7 FAQ modules

Showing 1–15 of 35 questions

ISO/IEC 27001 Annex A Control Ownership

Does ISO/IEC 27001 require an Annex A control owner?

ISO/IEC 27001 requires the organization to assign relevant ISMS responsibilities and authorities, but it does not require a role with the exact title 'Annex A ' or one owner for every Annex A row. The organization determines the controls necessary for risk treatment; some may come from outside Annex A.

A named is still useful. Define that person's authority and duties, such as coordinating implementation, confirming operating evidence, reporting failures, and proposing changes. The remains responsible for approving the treatment plan and accepting residual information security risk.

  • Assign ownership at a level that matches how the control operates; one enterprise owner may govern a shared control while local operators perform it.
  • Record accountable owner, operators, evidence producer, reviewer, escalation route, and relevant scope.
  • Include necessary controls designed by the organization or drawn from other sources, not only the Annex A reference controls.
  • Example: one identity-governance owner can define access-review criteria across the scoped organization while application owners perform reviews and retain their own approvals. The record should show both the shared accountability and each operating handoff.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Annex A Control Ownership

What should a control-ownership record contain?

ISO/IEC 27001 does not mandate a control-owner register or a fixed set of fields. Use the , a control register, or another controlled record that lets people find the current responsibility and evidence without creating conflicting sources of truth.

For each , connect the owner to the control's purpose, scope, implementation status, operating process, evidence, dependencies, open issues, and relevant risk-treatment records. If several teams operate the control, name the accountable owner and each operational handoff.

  • Record the control identifier, accountable role, operators, scope, evidence location, review date, and escalation path.
  • Link implementation status and evidence to the SoA without implying that the SoA itself must contain every ownership field.
  • Record handover, unresolved issues, access changes, and the effective date when responsibility moves.
  • For a supplier-operated control, name the internal owner who governs the requirement and evidence, the supplier activity, the contract or service record, and the internal response when the supplier misses the control.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Annex A Control Ownership

Who approves ownership changes and transfer decisions?

ISO/IEC 27001 does not require two approvers or prescribe who approves a control-owner change. Define approval authority in the organization's ISMS roles and change process, proportionate to the control's scope and risk.

A routine personnel change may need only the process owner to update the record. A transfer that changes control design, treatment, scope, a supplier dependency, or residual risk also needs the relevant risk and governance decisions updated.

  • Record the effective date, old and new owners, affected scope, handover status, and approving authority required by the internal process.
  • Confirm operational scope, supplier impact, and unresolved exception status before closing a change.
  • Keep unresolved ownership conflicts in a named risk or issue queue until cleared.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Annex A Control Ownership

When must ownership be reviewed again?

Review ownership at the organization's planned interval and when a change affects the assignment or control. ISO/IEC 27001 does not set a universal review frequency for control-owner records.

Useful triggers include reorganizations, role departures, scope or architecture changes, supplier transitions, control failures, audit findings, incidents, and changes to risk treatment. Preserve enough history to show when each assignment applied.

  • Revisit after business or service boundary changes, supplier transitions, or material control-process incidents.
  • Re-run ownership checks after internal audit findings, management review actions, or approved risk exceptions that affect Annex A controls.
  • Carry unresolved ownership conflicts into management review with owner, date, and decision needed.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Annex A Control Ownership

Questions and answers

Does ISO/IEC 27001 require one for every Annex A control?

No. ISO/IEC 27001:2022 requires relevant ISMS responsibilities and authorities to be assigned and communicated, but it does not prescribe a role called or require a one-to-one owner for each Annex A entry. The organization can assign one owner across related controls, use a shared-service owner with local operators, or use another model, provided responsibilities, authority, evidence, and escalation remain clear.

Can a also be the ?

Yes, if the organization's role design gives that person both responsibilities and enough authority, but the two accountabilities remain distinct. The coordinates control operation and evidence. ISO/IEC 27001 requires the identified to approve the risk-treatment plan and accept the residual information security risk.

Who owns a control performed by a cloud or other supplier?

The supplier may perform the activity, but the organization should retain an internal owner for the scoped requirement, supplier governance, evidence review, exceptions, and response. Record what the supplier performs, what the organization performs, the evidence each party produces, and the action required when the service or assurance report shows a gap.

Read answer in guideOpen FAQ module
ISO/IEC 27001 Certification Body Evidence

What evidence belongs in a certification audit?

Start with evidence that ISO/IEC 27001 itself requires the organization to retain or make available: the ISMS scope, risk-assessment and treatment process and results, information security objectives, operational records needed for confidence, monitoring and measurement results, internal-audit programme and results, management-review results, and nonconformity and corrective-action records.

Then add for the necessary controls identified in the Statement of Applicability. The audit is based on sampling, so an evidence index improves retrieval but does not replace underlying records or guarantee certification.

  • Index each record to the certified scope, relevant clause or SoA entry, evidence owner, period, and source system.
  • Use normal operating records - tickets, approvals, logs, reviews, tests, reports, and meeting decisions - rather than audit-day reconstructions.
  • Keep known gaps and exceptions visible as nonconformities, corrective actions, treatment actions, or accepted risks.
  • Example: an access-control policy and review procedure show design; a dated user population, reviewer decision, removed access, exception, and follow-up ticket show operation for the sampled period.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Certification Body Evidence

How should evidence show design and operation?

explains how the ISMS is meant to work: policy, scope, roles, criteria, procedures, SoA rationales, treatment plans, and control designs. shows that those arrangements actually ran during the relevant period and that results were evaluated.

A policy can support a design claim but does not prove that an access review occurred, a recovery test succeeded, a supplier was reviewed, or a corrective action was effective. Match the evidence to the claim and audited period. Protect secrets and personal data by agreeing secure access, live demonstration, or proportionate redaction with the rather than withholding evidence without explanation. The auditor still needs enough verifiable information to reach a conclusion.

  • For selected controls, retain implementation descriptions and dated samples from the systems where the control operates.
  • For performance evaluation, retain the measure, method, result, analysis, evaluator, and resulting decision.
  • For findings, retain the nonconformity, cause evaluation, correction, corrective action, and effectiveness result.
  • Do not set one evidence-retention period for every record unless another requirement supports it. Use legal, contractual, operational, certification-cycle, and internal record-control needs to set and document retention.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Certification Body Evidence

Who owns the evidence and who decides certification?

The organization owns its ISMS and evidence. Process owners, control owners, risk owners, internal auditors, and top management each retain their ISO/IEC 27001 responsibilities; an external auditor should not be written into those operating roles.

The audits the ISMS and makes the certification decision under the applicable scheme. ISO/IEC 27006-1:2024 adds ISMS-specific requirements for bodies that audit and certify against ISO/IEC 27001 and complements ISO/IEC 17021-1. is a separate assessment of the certification body's competence for the relevant activity and scope.

  • Assign every evidence family to the internal owner responsible for its accuracy and retention.
  • Do not ask the to approve operational risk or design controls on the organization's behalf.
  • When relying on an accredited certificate, verify both the certificate and the 's relevant rather than treating either name alone as proof.
  • Treat consultancy and certification as separate activities. ISO/IEC 17021-1 and ISO/IEC 27006-1 place impartiality requirements on the ; the organization must still make and own its ISMS decisions.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Certification Body Evidence

When should the certification evidence pack change?

Update evidence through normal ISMS operation, not only before an external audit. Planned monitoring, risk reassessment, internal audit, management review, and corrective action continuously create or change the records on which certification relies.

Significant changes to scope, products, services, locations, suppliers, technology, risks, controls, or legal and contractual requirements should trigger review of the linked risk treatment, SoA, , and certification-body notification obligations. The exact external notification and audit process comes from the certification arrangement, not from this checklist.

  • Keep evidence periods and retention rules visible so samples can be traced to the audited cycle.
  • Refresh the index when owners, repositories, control implementations, or scope change.
  • Raise unresolved inconsistencies before audit; do not conceal them in a polished evidence folder.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Certification Body Evidence

Questions and answers

Does ISO/IEC 27001 prescribe a single certification evidence checklist?

No. ISO/IEC 27001 specifies required documented information and the records needed to show that the ISMS operates as planned. The sets the audit plan and samples evidence within the certification scope. Build an index from the applicable clauses, the current Statement of Applicability, the audit period, prior findings, and material changes, then retain the underlying records.

Is a policy enough evidence for an ISO/IEC 27001 certification audit?

A policy can show design, authority, or expected behavior, but it does not prove operation. For a sampled control, pair the policy or procedure with dated such as an approval, review population, ticket, log, test result, exception, decision, and follow-up record that matches the certified scope and audit period.

Can sensitive evidence be withheld from the certification auditor?

Sensitive information still needs a workable audit method. Agree secure viewing, limited samples, live demonstration, redaction, or another method that protects secrets and personal data while leaving enough verifiable information for the auditor to test the requirement. A blank or heavily redacted record that cannot support a conclusion is not a substitute for evidence.

Does an accredited guarantee that the organization has no security incidents?

No. Certification is a third-party conclusion about conformity of the scoped ISMS based on the audit and sampled evidence. It is not a guarantee that every system is secure, every control always succeeds, or no incident will occur. Check the certificate's scope, validity, issuing body, and relevant before relying on the claim.

Read answer in guideOpen FAQ module
ISO/IEC 27001 Internal Audit

What must happen before, during, and after an internal audit?

Build an audit programme that states frequency, methods, responsibilities, planning requirements, and reporting. Consider the importance of each process and previous audit results rather than defaulting to equal annual coverage.

For each audit, define the and scope before testing. Collect through records, observation, interviews, demonstrations, and samples; report the results to relevant management; then handle confirmed nonconformities through the corrective-action process.

  • State the audit objective, criteria, scope, method, sample basis, auditor, timing, and reporting path.
  • Choose coverage using process importance, change, risk, and previous results; ISO/IEC 27001 does not prescribe an annual cycle.
  • Separate audit judgment from responsibility for the activity being audited wherever needed to ensure objectivity and impartiality.
  • Example: after a major identity-platform change or repeated access-review failure, bring that process forward in the programme and increase the sample. A stable low-change process with clean earlier results may be audited later, provided the programme still gives adequate ISMS coverage.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Internal Audit

What evidence makes an internal audit auditable?

Retain evidence that the audit programme was implemented and the audit results. A usable audit file identifies the criteria and scope, auditor, dates, methods, samples, evidence examined, conclusions, and reported findings.

A finding should distinguish a from an observation or improvement suggestion. ISO/IEC 27001 requires action on nonconformities; labels such as observation or opportunity for improvement come from the organization's audit method and should not be used to weaken a failure to meet a requirement. For a nonconformity, link the unmet requirement and evidence to correction, cause analysis, , and the later effectiveness review required by Clause 10.2.

  • Keep the approved programme, audit plan, working papers needed to support conclusions, report, and distribution record.
  • Record enough sample detail to reproduce the test without copying sensitive logs or personal data unnecessarily.
  • Track each confirmed to the requirement, evidence, owner, correction, cause, , due date, and effectiveness result.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Internal Audit

Who should review and approve internal-audit findings?

The auditor forms and reports the audit conclusion; relevant management receives the results. The process owner normally owns correction and , while someone able to make an objective judgment verifies completion and effectiveness under the organization's procedure.

Do not close a because a due date passed or a document was uploaded. Confirm the immediate correction, assess the cause and whether the issue could exist elsewhere, implement any needed , and review its effectiveness. For example, correcting one missing approval fixes the sampled record; changing the workflow and then testing later approvals may address and verify the systemic cause.

  • Record each finding with owner, risk impact, decision date, and remediation proof.
  • Separate independent audit team responsibilities from implementation ownership.
  • Include audit-result trends and material unresolved findings in management-review inputs.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Internal Audit

How often should internal audits and their outcomes be rechecked?

ISO/IEC 27001 requires internal audits at planned intervals but sets no universal annual frequency. Set the programme so the organization can judge conformity and effective implementation across the ISMS, using process importance and previous results to decide timing and coverage.

A major change, incident, repeated failure, overdue , or new risk may justify an additional or earlier audit. That is a risk-based programme decision, not a separate fixed timetable imposed by the standard.

  • Use calendar review dates plus change-trigger reviews for incidents, context shifts, or contractual scope changes.
  • Re-verify closed findings after remediation evidence is produced, not after the target date alone.
  • Track all unresolved findings in governance to prevent drift between audit cycles.
Read answer in guideOpen FAQ module
ISO/IEC 27001 Internal Audit

Questions and answers

What is the purpose of an ISO/IEC 27001 ?

ISO/IEC 27001:2022 clause 9.2.1 says the organization shall conduct internal audits at planned intervals to provide information on whether the ISMS conforms to the organization's own requirements and to the requirements of the standard, and whether it is effectively implemented and maintained.

What should an programme include?

ISO/IEC 27001:2022 clause 9.2.2 requires the audit programme to include the frequency, methods, responsibilities, planning requirements and reporting, and requires the organization to consider the importance of the processes concerned and the results of previous audits.

Can people audit their own work?

ISO/IEC 27001 does not state a blanket rule in those words. Clause 9.2.2 requires the organization to select auditors and conduct audits so the audit process is objective and impartial. A person responsible for designing or operating an activity will usually lack enough independence to audit that same activity alone; use another competent auditor or safeguards that can demonstrate objective, impartial judgment.

What evidence should be retained for internal audits?

ISO/IEC 27001:2022 clause 9.2.2 requires documented information as evidence that the audit programme was implemented and to show the audit results. A usable file normally identifies the and scope, auditor, dates, methods, samples, evidence examined, conclusions, findings, report recipients, and links to corrective-action follow-up, while avoiding unnecessary copies of sensitive records.

Must every ISMS process and Annex A control be audited every year?

No universal annual coverage rule appears in ISO/IEC 27001. The organization must audit at planned intervals and build the programme around process importance and previous audit results. Changes, incidents, control failures, overdue actions, and new risks can justify earlier or deeper coverage. The programme should still provide enough coverage over time to evaluate the whole scoped ISMS.

What is the difference between a correction and ?

A correction controls or fixes the observed , such as completing a missed access review. addresses the cause so the problem does not recur or appear elsewhere, such as changing the workflow, ownership, or alerting that allowed reviews to be missed. Clause 10.2 also requires the organization to review the effectiveness of the corrective action.

Read answer in guideOpen FAQ module