ISO 27001 Manager

ISO 27001:2022 Structure Overview

ISO 27001:2022 is structured around 10 mandatory clauses plus Annex A. Clauses 1–3 are definitional (scope, references, terms). Clauses 4–10 are the normative requirements auditors test against:

Key changes from ISO 27001:2013 to 2022:

• Annex A controls reduced from 114 to 93, reorganized from 14 domains into 4 categories
• Attribute tagging added to controls (e.g., control type, security property, operational capability) — not mandatory to use but aids SoA structuring
• 11 new controls introduced covering cloud services, threat intelligence, ICT readiness, and data masking
• Clause 6.3 added: explicit requirement to plan changes to the ISMS in a controlled manner

Annex A Controls Overview

The 2022 revision consolidates controls into 4 categories:

The 11 new controls in ISO 27001:2022:

Statement of Applicability (SoA)

The SoA is a mandatory documented output of the risk treatment process (clause 6.1.3). It lists every Annex A control, states whether it is applicable to your ISMS, and — for applicable controls — what justifies inclusion and what the implementation status is.

Key SoA requirements:

• Every control must appear — no control can be silently omitted
• For each control: applicable (yes/no), justification, implementation status (planned/partially implemented/implemented)
• If excluding a control: the justification must demonstrate no risk or regulatory need — not simply that it is inconvenient to implement
• The SoA must reference your risk treatment plan — auditors will verify that selected controls map back to identified risks

Common mistake: Marking controls like "Monitoring activities" (A.8.16) or "Supplier security" (A.5.19) as not applicable because they seem complex. Auditors treat unexplained exclusions as evidence of an immature risk assessment. Unless you have zero suppliers and zero networked systems, those controls apply.

Certification Stages

Typical timeline from decision to certificate:

• Organizations with minimal security processes: 12–18 months
• Organizations with existing ISO 9001 or SOC 2 foundations: 6–9 months
• Between Stage 1 and Stage 2: typically 4–12 weeks to remediate Stage 1 findings

After certification, surveillance audits occur annually; full recertification every 3 years.

Stage 1 readiness checklist: risk register completed, SoA approved by management, all mandatory policies documented and approved, internal audit conducted, management review meeting held with minutes.

Common Implementation Pitfalls

Over-scoping the ISMS boundary: Including all business units when certification is only needed for one product or service line. A narrower, well-controlled scope achieves certification faster and reduces audit surface. Scope boundaries must be documented and defensible.

Policy-writing without evidence: Having an Access Control Policy but no access review records, no MFA enforcement logs, no joiners/movers/leavers process records. Auditors follow policies to evidence. A policy with no supporting records is a nonconformance.

Broken risk treatment linkage: Risk register identifies 30 risks; risk treatment plan references controls; SoA lists controls — but the three documents do not cross-reference each other. Auditors treat unlinked documents as evidence the process is theoretical, not operational.

Ignoring supplier and third-party controls: Clause 5.19–5.22 and the new cloud services control (A.5.23) are consistently under-implemented. Every SaaS tool your staff uses, every contractor with system access, every cloud provider is in scope. Maintain a supplier register with security assessment status.

Internal audit as a formality: ISO 27001 requires that the internal audit programme covers all ISMS clauses over time. Audits that are scheduled the week before Stage 2 and produce zero findings are a red flag — certification bodies expect to see genuine findings and corrective actions.