--- title: "ISO/IEC 27001 FAQ: ISMS Scope, Risk and SoA" canonical_url: "https://www.sorena.io/artifacts/global/iso-27001/faq" source_url: "https://www.sorena.io/artifacts/global/iso-27001/faq/items" author: "Sorena AI" description: "Practical ISO/IEC 27001 FAQ covering ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, certification evidence, audits, management review, and surveillance readiness." published_at: "2026-05-09" updated_at: "2026-05-09" keywords: - "ISO/IEC 27001 FAQ" - "ISO 27001 ISMS scope" - "Statement of Applicability" - "ISO 27001 risk treatment" - "Annex A controls" - "ISO 27001 certification evidence" - "ISO 27001 internal audit" - "ISO 27001 management review" - "ISO/IEC 27001" - "ISMS" - "certification evidence" - "global compliance" --- **[SORENA](https://www.sorena.io/)** - AI-Powered GRC Platform [Home](https://www.sorena.io/) | [Solutions](https://www.sorena.io/solutions) | [Artifacts](https://www.sorena.io/artifacts) | [About Us](https://www.sorena.io/about-us) | [Contact](https://www.sorena.io/contact) | [Portal](https://app.sorena.io) --- # ISO/IEC 27001 FAQ: ISMS Scope, Risk and SoA Practical ISO/IEC 27001 FAQ covering ISMS scope, risk assessment, risk treatment, Statement of Applicability, Annex A controls, certification evidence, audits, management review, and surveillance readiness. *ISO/IEC 27001 FAQ* *ISMS implementation* *ISO/IEC 27001:2022* ## ISO/IEC 27001 FAQ Clear answers for teams implementing ISO/IEC 27001: define the ISMS scope, assess information security risk, choose treatment options, build the Statement of Applicability, and keep audit evidence current. Use this as implementation guidance for an information security management system, not for legal interpretation or a substitute for an accredited certification audit. ISO/IEC 27001 is easiest to operate when the FAQ is tied to actual ISMS decisions: what is in scope, which risks were assessed, which controls were selected, what evidence proves they operate, and what leadership reviews when the ISMS changes. ## Browse sub-FAQ modules ### [ISO/IEC 27001 Annex A Control Ownership FAQ](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md) How should teams assign Annex A Control Ownership under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - 4 items ### [ISO/IEC 27001 Certification Body Evidence FAQ](/artifacts/global/iso-27001/faq/certification-body-evidence.md) How should teams handle Certification Body Evidence under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - 4 items ### [ISO/IEC 27001 Internal Audit FAQ](/artifacts/global/iso-27001/faq/internal-audit.md) How should teams run ISO/IEC 27001 internal audits: who should own each step, what evidence is expected, and how findings are resolved. - 4 items ### [ISO/IEC 27001 Management Review FAQ](/artifacts/global/iso-27001/faq/management-review.md) How should teams handle Management Review under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - 4 items ### [ISO/IEC 27001 Risk Acceptance FAQ](/artifacts/global/iso-27001/faq/risk-acceptance.md) How should teams handle Risk Acceptance under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - 4 items ### [ISO/IEC 27001 SoA Exclusions FAQ](/artifacts/global/iso-27001/faq/soa-exclusions.md) How should teams justify Statement of Applicability exclusions under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - 4 items ### [ISO/IEC 27001 Surveillance Audits FAQ](/artifacts/global/iso-27001/faq/surveillance-audits.md) How should teams handle Surveillance Audits under ISO/IEC 27001? Practical answer with owners, evidence, review triggers, and external source references. - 4 items Browse all indexed questions: [/artifacts/global/iso-27001/faq/items](/artifacts/global/iso-27001/faq/items.md) ## All FAQ items *Page 1 of 2. Showing 20 of 28 items.* ### [When does a page need an Annex A Control Owner and what does ownership mean?](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md#when-does-a-page-need-an-annex-a-control-owner-and-what-does-ownership-mean) *Module: [ISO/IEC 27001 Annex A Control Ownership](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md)* Assign a named owner for each Annex A control that is included in your ISMS scope so responsibility for operation and implementation decisions remains traceable over time. - Define ownership in your SoA/control register at the same granularity as your control evidence (per control row). - Assign owner roles that match your internal model (security, infrastructure, platform, application, and shared-service ownership patterns). - Keep role updates explicit when teams, systems, or service boundaries move. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source to confirm the governing requirements context for ISMS scope and control governance. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - Use this for control implementation context for Annex A-related operationalization. ### [What ownership evidence must be kept for one control?](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md#what-ownership-evidence-must-be-kept-for-one-control) *Module: [ISO/IEC 27001 Annex A Control Ownership](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md)* Use a single control record that captures the current owner, owner history, decision context, and required evidence links. - Record the control identifier, scope boundary, current owner, backup owner, date of last confirmation, and review status. - Attach evidence links for risk treatment inputs, implementation status, test results, and open issues affecting that control. - Capture ownership transfer artifacts (handover notes, rationale, and approval references) when roles change. Sources for this answer: - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - Use this for control implementation context and control-level evidence practices. - [ISO/IEC 27005:2022 standard page](https://www.iso.org/standard/80585.html?ref=sorena.io) - Use this for risk treatment and monitoring context reflected in control records. ### [Who approves ownership changes and transfer decisions?](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md#who-approves-ownership-changes-and-transfer-decisions) *Module: [ISO/IEC 27001 Annex A Control Ownership](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md)* Use at least two independent checks for ownership changes (for example owner + reviewer), with a formal approver or governance step for critical controls. - Require a documented decision path for each owner change with date, approver(s), and rationale. - Confirm operational scope, supplier impact, and unresolved exception status before closing a change. - Keep unresolved ownership conflicts in a named risk or issue queue until cleared. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this as the governing requirements context for ISMS governance and scope decisions. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - Use this as practical context for control-level responsibility and operations. ### [When must ownership be reviewed again?](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md#when-must-ownership-be-reviewed-again) *Module: [ISO/IEC 27001 Annex A Control Ownership](/artifacts/global/iso-27001/faq/annex-a-control-ownership.md)* Review ownership on fixed intervals and whenever ownership-impacting events occur (scope changes, supplier changes, incidents, and exceptions). - Revisit after business or service boundary changes, supplier transitions, or material control-process incidents. - Re-run ownership checks after internal audit findings, management review actions, or approved risk exceptions that affect Annex A controls. - Carry unresolved ownership conflicts into management review with owner, date, and decision needed. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this as the governing context for periodic review and management review cadence in ISMS operation. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - Use this as practical context for ongoing control maintenance and operational review. ### [How should teams handle Certification Body Evidence under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/certification-body-evidence.md#how-should-teams-handle-certification-body-evidence-under-isoiec-27001) *Module: [ISO/IEC 27001 Certification Body Evidence](/artifacts/global/iso-27001/faq/certification-body-evidence.md)* Start with the operational decision: define what Certification Body Evidence means in your ISO/IEC 27001 scope, who owns it, and what record proves the decision is current. - Name the accountable owner and reviewer for Certification Body Evidence. - Record the scope, assumptions, decision, approval date, evidence location, exception status, and next review trigger. - Escalate when Certification Body Evidence changes risk acceptance, service commitments, customer promises, regulatory duties, or certification evidence. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [What evidence should prove Certification Body Evidence is current under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/certification-body-evidence.md#what-evidence-should-prove-certification-body-evidence-is-current-under-isoiec-27001) *Module: [ISO/IEC 27001 Certification Body Evidence](/artifacts/global/iso-27001/faq/certification-body-evidence.md)* The evidence should show the process operating. For this artifact, the strongest record usually includes ISMS scope, risk assessment, treatment plan, Statement of Applicability, Annex A evidence, internal audits, corrective actions, and management review records. - Use source records from the system of work, not screenshots created only for audit day. - Keep exceptions visible as risk acceptance, corrective action, or management-review input. - Update linked registers when the answer changes an owner, risk, control, service, supplier, or review date. Sources for this answer: - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. - [ISO/IEC 27005:2022 standard page](https://www.iso.org/standard/80585.html?ref=sorena.io) - This source supports risk treatment and monitoring context that informs control decisions and residual risk handling. ### [Who should approve Certification Body Evidence decisions under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/certification-body-evidence.md#who-should-approve-certification-body-evidence-decisions-under-isoiec-27001) *Module: [ISO/IEC 27001 Certification Body Evidence](/artifacts/global/iso-27001/faq/certification-body-evidence.md)* The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions. - Use a named owner, named backup, and named escalation forum. - Separate preparation work from risk acceptance and final approval. - Keep approval records with the evidence rather than in disconnected email threads. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [When should Certification Body Evidence be reviewed under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/certification-body-evidence.md#when-should-certification-body-evidence-be-reviewed-under-isoiec-27001) *Module: [ISO/IEC 27001 Certification Body Evidence](/artifacts/global/iso-27001/faq/certification-body-evidence.md)* Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, security-critical system, personal data flow, incident process, or customer commitment changes. - Set a planned review date and a change-trigger rule. - Use findings to update controls, procedures, contracts, risk registers, or training. - Carry unresolved items into management review or risk acceptance. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [What must happen before, during, and after an internal audit?](/artifacts/global/iso-27001/faq/internal-audit.md#what-must-happen-before-during-and-after-an-internal-audit) *Module: [ISO/IEC 27001 Internal Audit](/artifacts/global/iso-27001/faq/internal-audit.md)* ISO/IEC 27001 internal audits should be planned, documented, and executed to confirm alignment between your ISMS and both your own requirements and standard requirements. - Create an audit program with objective and interval (for example annual or risk-based with additional audits after major changes). - Map each audit area to who can review what: preparer, evidence owner, independent reviewer, and approver. - Do not let process builders validate their own findings. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - This source supports the internal-audit cadence and objective of internal audits within ISO/IEC 27001 performance evaluation. - [ISO 27001 Lead Auditor Guideline](https://www.iso.org/standard/27001?ref=sorena.io) - Use the guideline language for planned internal-audit execution: conformance checks, implementation checks, and objective reporting. ### [What evidence makes an internal audit auditable?](/artifacts/global/iso-27001/faq/internal-audit.md#what-evidence-makes-an-internal-audit-auditable) *Module: [ISO/IEC 27001 Internal Audit](/artifacts/global/iso-27001/faq/internal-audit.md)* Evidence should show what was tested, how it was tested, who tested it, and the result. - Attach a control-level audit checklist and schedule from your ISMS scope. - Keep test artifacts, interview notes, log extracts, and issue tracking entries together with timestamps. - Record findings with severity, exception rationale, corrective action owner, and target close date. Sources for this answer: - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - Use this source to anchor audit checks where control implementation evidence is required. - [ISO/IEC 27001 Lead Auditor Guideline](https://www.iso.org/standard/27001?ref=sorena.io) - This source supports documented information requirements around findings, corrective action, and independent audit activity. ### [Who should review and approve internal-audit findings?](/artifacts/global/iso-27001/faq/internal-audit.md#who-should-review-and-approve-internal-audit-findings) *Module: [ISO/IEC 27001 Internal Audit](/artifacts/global/iso-27001/faq/internal-audit.md)* Assign a non-authoring reviewer to validate findings before closure. - Record each finding with owner, risk impact, decision date, and remediation proof. - Separate independent audit team responsibilities from implementation ownership. - Require management-review visibility for unresolved major findings. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [How often should internal audits and their outcomes be rechecked?](/artifacts/global/iso-27001/faq/internal-audit.md#how-often-should-internal-audits-and-their-outcomes-be-rechecked) *Module: [ISO/IEC 27001 Internal Audit](/artifacts/global/iso-27001/faq/internal-audit.md)* Re-check internal-audit outputs at planned intervals and when triggers indicate evidence may be stale. - Use calendar review dates plus change-trigger reviews for incidents, context shifts, or contractual scope changes. - Re-verify closed findings after remediation evidence is produced, not after the target date alone. - Track all unresolved findings in governance to prevent drift between audit cycles. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [How should teams handle Management Review under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/management-review.md#how-should-teams-handle-management-review-under-isoiec-27001) *Module: [ISO/IEC 27001 Management Review](/artifacts/global/iso-27001/faq/management-review.md)* Start with the operational decision: define what Management Review means in your ISO/IEC 27001 scope, who owns it, and what record proves the decision is current. - Name the accountable owner and reviewer for Management Review. - Record the scope, assumptions, decision, approval date, evidence location, exception status, and next review trigger. - Escalate when Management Review changes risk acceptance, service commitments, customer promises, regulatory duties, or certification evidence. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - ISO/IEC 27001 is the requirements standard that includes ISMS performance evaluation, including management review expectations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [What evidence should prove Management Review is current under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/management-review.md#what-evidence-should-prove-management-review-is-current-under-isoiec-27001) *Module: [ISO/IEC 27001 Management Review](/artifacts/global/iso-27001/faq/management-review.md)* The evidence should show the process operating. For this artifact, the strongest record usually includes ISMS scope, risk assessment, treatment plan, Statement of Applicability, Annex A evidence, internal audits, corrective actions, and Management Review records. - Use source records from the system of work, not screenshots created only for audit day. - Keep exceptions visible as risk acceptance, corrective action, or management-review input. - Update linked registers when the answer changes an owner, risk, control, service, supplier, or review date. Sources for this answer: - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. - [ISO/IEC 27005:2022 standard page](https://www.iso.org/standard/80585.html?ref=sorena.io) - This source supports risk treatment and monitoring context that informs control decisions and residual risk handling. ### [Who should approve Management Review decisions under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/management-review.md#who-should-approve-management-review-decisions-under-isoiec-27001) *Module: [ISO/IEC 27001 Management Review](/artifacts/global/iso-27001/faq/management-review.md)* The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions. - Use a named owner, named backup, and named escalation forum. - Separate preparation work from risk acceptance and final approval. - Keep approval records with the evidence rather than in disconnected email threads. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [When should Management Review be reviewed under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/management-review.md#when-should-management-review-be-reviewed-under-isoiec-27001) *Module: [ISO/IEC 27001 Management Review](/artifacts/global/iso-27001/faq/management-review.md)* Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, security-critical system, personal data flow, incident process, or customer commitment changes. - Set a planned review date and a change-trigger rule. - Use findings to update controls, procedures, contracts, risk registers, or training. - Carry unresolved items into Management Review or risk acceptance. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [How should teams handle Risk Acceptance under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/risk-acceptance.md#how-should-teams-handle-risk-acceptance-under-isoiec-27001) *Module: [ISO/IEC 27001 Risk Acceptance](/artifacts/global/iso-27001/faq/risk-acceptance.md)* Start with the operational decision: define what Risk Acceptance means in your ISO/IEC 27001 scope, who owns it, and what record proves the decision is current. - Name the accountable owner and reviewer for Risk Acceptance. - Record the scope, assumptions, decision, approval date, evidence location, exception status, and next review trigger. - Escalate when a risk-acceptance decision changes residual risk, service commitments, customer promises, regulatory duties, or certification evidence. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [What evidence should prove Risk Acceptance is current under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/risk-acceptance.md#what-evidence-should-prove-risk-acceptance-is-current-under-isoiec-27001) *Module: [ISO/IEC 27001 Risk Acceptance](/artifacts/global/iso-27001/faq/risk-acceptance.md)* The evidence should show the process operating. For this artifact, the strongest record usually includes ISMS scope, risk assessment, treatment plan, Statement of Applicability, Annex A evidence, internal audits, corrective actions, and management review records. - Use source records from the system of work, not screenshots created only for audit day. - Keep exceptions visible as Risk Acceptance, corrective action, or management-review input. - Update linked registers when the answer changes an owner, risk, control, service, supplier, or review date. Sources for this answer: - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. - [ISO/IEC 27005:2022 standard page](https://www.iso.org/standard/80585.html?ref=sorena.io) - This source supports risk treatment and monitoring context that informs control decisions and residual risk handling. ### [Who should approve Risk Acceptance decisions under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/risk-acceptance.md#who-should-approve-risk-acceptance-decisions-under-isoiec-27001) *Module: [ISO/IEC 27001 Risk Acceptance](/artifacts/global/iso-27001/faq/risk-acceptance.md)* The person who can fund, operate, and correct the process should own the decision; governance should review consistency and exceptions. - Use a named owner, named backup, and named escalation forum. - Separate preparation work from Risk Acceptance and final approval. - Keep approval records with the evidence rather than in disconnected email threads. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ### [When should Risk Acceptance be reviewed under ISO/IEC 27001?](/artifacts/global/iso-27001/faq/risk-acceptance.md#when-should-risk-acceptance-be-reviewed-under-isoiec-27001) *Module: [ISO/IEC 27001 Risk Acceptance](/artifacts/global/iso-27001/faq/risk-acceptance.md)* Review it at planned intervals and whenever the underlying scope, service, supplier, control, risk, security-critical system, personal data flow, incident process, or customer commitment changes. - Set a planned review date and a change-trigger rule. - Use findings to update controls, procedures, contracts, risk registers, or training. - Carry unresolved items into management review or Risk Acceptance. Sources for this answer: - [ISO/IEC 27001:2022 standard page](https://www.iso.org/standard/27001?ref=sorena.io) - Use this source as the governing requirements context for ISO/IEC 27001 scope, control governance, and review cadence in ISMS operations. - [ISO/IEC 27002:2022 standard page](https://www.iso.org/standard/75652.html?ref=sorena.io) - This source supports control implementation guidance and control-implementation expectations supporting ISO/IEC 27001 governance. ## FAQ Pagination - Canonical index (page 1): [/artifacts/global/iso-27001/faq/items](/artifacts/global/iso-27001/faq/items.md) - Page 1 rule: `/page/1` is intentionally not generated; use the canonical index markdown URL. - Current page: 1 of 2 Pages: [1](/artifacts/global/iso-27001/faq/items.md) | [2](/artifacts/global/iso-27001/faq/items/page/2.md) [Next page](/artifacts/global/iso-27001/faq/items/page/2.md) *Recommended next step* *Placement: after implementation guidance* ## Operationalize ISO/IEC 27001 Use this FAQ to connect your ISMS scope, risk register, treatment plan, Statement of Applicability, Annex A evidence, internal audit results, and management-review actions into one accountable evidence model. - [Open Assessment Autopilot for ISO/IEC 27001](/solutions/assessment.md): Convert ISO/IEC 27001 answers into owners, evidence requests, control checks, and review tasks. - [Talk through ISO/IEC 27001 implementation](/contact.md): Review your ISMS scope, SoA, risk-treatment evidence, audit readiness, and certification gaps. --- [Privacy Policy](https://www.sorena.io/privacy) | [Terms of Use](https://www.sorena.io/terms-of-use) | [DMCA](https://www.sorena.io/dmca) | [About Us](https://www.sorena.io/about-us) (c) 2026 Sorena AB (559573-7338). All rights reserved. Source: https://www.sorena.io/artifacts/global/iso-27001/faq/items