Understand the ISO/IEC 27001:2022 standard
What is ISO 27001 ? How does an ISMS, the risk-based approach and continuous improvement cycle? Clear, straightforward insights for decision-makers and CISO.
What is ISO/IEC 27001?
ISO/IEC 27001:2022 is the international standard that sets the requirements for establishing an ISMS and, the only standard in the ISO 27000 family, enables certification by an accredited body.
ISO/IEC 27001:2022 is the international benchmark standard for information security management. Published jointly by ISO and IEC, it defines the requirements to establish, implement, maintain and continuously improve an Information Security Management System (ISMS). Its current version was published by ISO on 25 October 2022; the transition from the 2013 edition ended on 31 October 2025, and only 2022 certificates are now valid. A certificate is issued for 3 years, with a surveillance audit every 12 months; for an SME, allow around 8 months from project launch to certification.
Unlike a simple technical framework, ISO 27001 it adopts a management-driven approach: it does not prescribe a fixed list of measures, but requires a structured methodology to protect confidentiality, integrity and availability of information, in any form (digital, paper or know-how). It is also the only standard in the ISO 27000 family under which an organization can be certified by an accredited body. For the official certification framework, see the PECB ISO/IEC 27001 page, a certification body partner of BCIT.
What are the pillars of the standard?
The ISMS
A governance framework that aligns information security with the organization's objectives and context, driven by management.
The risk-based approach
Identify, analyze and address risks to information, rather than applying measures at random.
Annex A / ISO 27002
A catalog of 93 reference security controls from which you select based on your actual risks.
The PDCA cycle
Plan, Do, Check, Act: security becomes a living process, never static.
How does the risk-based approach work?
The organization identifies its risks, decides whether to reduce, accept, avoid or share them, then justifies each choice in the Statement of Applicability (SoA).
The heart of the ISO 27001 is risk assessment. The organization identifies threats and vulnerabilities affecting its information assets, assesses their likelihood and impact, then decides how to treat them:
- Reduce the risk by implementing one or more Annex A security controls.
- Accept the risk when its level is considered tolerable in context.
- Avoid the risk by discontinuing the activity or processing that exposes you to it.
- Share the risk, for example through insurance or a contractual third party.
This approach ensures that effort and budgets are focused where they matter most. One key output is the Statement of Applicability (SoA), which justifies the inclusion or exclusion of each control from Annex A.
What is the relationship with ISO/IEC 27002?
Annex A lists 93 controls across 4 themes; ISO/IEC 27002 is the companion standard that explains how to implement them.
Annex A of ISO 27001:2022 lists 93 security controls grouped into 4 themes:
- Organizational: policies, roles, asset and supplier management, and incident management.
- People: awareness, training, screening, and remote working.
- Physical: premises security, secure areas, and equipment protection.
- Technological: access control, encryption, logging, and network security.
| Theme | Number of controls |
|---|---|
| Organizational | 37 |
| People | 8 |
| Physical | 14 |
| Technological | 34 |
This annex is only a summary: the companion standard ISO/IEC 27002:2022 which details, for each control, its objective and implementation best practices. You select relevant controls based on your risk assessment results. Nothing is imposed blindly.
The 2022 version substantially streamlined Annex A: the 2013 version contained 114 controls across 14 categories; the 2022 revision grouped them into just 93 controls and 4 themes, creating a clearer structure.
How does the continuous improvement cycle (PDCA) work?
Plan: Plan
Define the scope, policy and objectives, and assess information security risks.
Do: Deploy
Implement the risk treatment plan and selected security controls.
Check: Monitor
Monitor, measure, conduct internal audits and management reviews to assess effectiveness.
How long is the certificate valid?
Once obtained, the certificate is valid for 3 years, subject to annual surveillance audits conducted by the certification body; after 3 years, a recertification audit restarts the cycle.
ISO 27001 does not replace regulatory texts, but it covers their foundations. The directive NIS 2 thus requires 10 categories of measures (Article 21), with violations punishable by fines of up to 10 000 000 € or 2 % of worldwide turnover for an essential entity, and 7 000 000 € or 1.4 % for an important entity:
“Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organizational measures to manage the risks to the security of network and information systems that these entities use for their operations or the provision of their services.” (Directive (EU) 2022/2555, Article 21, paragraph 1).
- Policies on risk analysis and information systems security
- Incident management
- Business continuity, backups, recovery, and crisis management
- Supply chain security
- Security in system acquisition, development and maintenance; vulnerability handling
- Assessment of the effectiveness of measures
- Basic cyber hygiene and cybersecurity training
- Cryptography and encryption
- Human resources security, access control, and asset management
- Multi-factor authentication and secure communications
The 93 Annex A controls cover these 10 categories, as do the 42 measures in the ANSSI cyber hygiene guide (published on 23 January 2017), which ANSSI describes as “a roadmap that serves the interests of any entity aware of the value of its data.”
What are the benefits of ISO 27001 certification?
Trust & business
Internationally recognized proof that reassures clients, partners and contracting authorities, and unlocks tender opportunities.
Regulatory compliance
A solid foundation for meeting GDPR, NIS2, DORA or HDS and reduce your legal exposure.
Risk management
Fewer incidents, better-contained impacts, and greater resilience against cyber threats.
Want to learn more about ISO 27001?
BCIT Formation guides you in understanding the standard and building your ISMS and pursuing certification — rated 4.7/5 on Trustpilot. Let’s discuss your context and goals for 15 minutes.
Understand the ISO/IEC 27001:2022 standard
What is ISO 27001 ? How does an ISMS, the risk-based approach and continuous improvement cycle? Clear, straightforward insights for decision-makers and CISO.
What is ISO/IEC 27001?
ISO/IEC 27001:2022 is the international standard that sets the requirements for establishing an ISMS and, the only standard in the ISO 27000 family, enables certification by an accredited body.
ISO/IEC 27001:2022 is the international benchmark standard for information security management. Published jointly by ISO and IEC, it defines the requirements to establish, implement, maintain and continuously improve an Information Security Management System (ISMS). Its current version was published by ISO on 25 October 2022; the transition from the 2013 edition ended on 31 October 2025, and only 2022 certificates are now valid. A certificate is issued for 3 years, with a surveillance audit every 12 months; for an SME, allow around 8 months from project launch to certification.
Unlike a simple technical framework, ISO 27001 it adopts a management-driven approach: it does not prescribe a fixed list of measures, but requires a structured methodology to protect confidentiality, integrity and availability of information, in any form (digital, paper or know-how). It is also the only standard in the ISO 27000 family under which an organization can be certified by an accredited body. For the official certification framework, see the PECB ISO/IEC 27001 page, a certification body partner of BCIT.
What are the pillars of the standard?
The ISMS
A governance framework that aligns information security with the organization's objectives and context, driven by management.
The risk-based approach
Identify, analyze and address risks to information, rather than applying measures at random.
Annex A / ISO 27002
A catalog of 93 reference security controls from which you select based on your actual risks.
The PDCA cycle
Plan, Do, Check, Act: security becomes a living process, never static.
How does the risk-based approach work?
The organization identifies its risks, decides whether to reduce, accept, avoid or share them, then justifies each choice in the Statement of Applicability (SoA).
The heart of the ISO 27001 is risk assessment. The organization identifies threats and vulnerabilities affecting its information assets, assesses their likelihood and impact, then decides how to treat them:
- Reduce the risk by implementing one or more Annex A security controls.
- Accept the risk when its level is considered tolerable in context.
- Avoid the risk by discontinuing the activity or processing that exposes you to it.
- Share the risk, for example through insurance or a contractual third party.
This approach ensures that effort and budgets are focused where they matter most. One key output is the Statement of Applicability (SoA), which justifies the inclusion or exclusion of each control from Annex A.
What is the relationship with ISO/IEC 27002?
Annex A lists 93 controls across 4 themes; ISO/IEC 27002 is the companion standard that explains how to implement them.
Annex A of ISO 27001:2022 lists 93 security controls grouped into 4 themes:
- Organizational: policies, roles, asset and supplier management, and incident management.
- People: awareness, training, screening, and remote working.
- Physical: premises security, secure areas, and equipment protection.
- Technological: access control, encryption, logging, and network security.
| Theme | Number of controls |
|---|---|
| Organizational | 37 |
| People | 8 |
| Physical | 14 |
| Technological | 34 |
This annex is only a summary: the companion standard ISO/IEC 27002:2022 which details, for each control, its objective and implementation best practices. You select relevant controls based on your risk assessment results. Nothing is imposed blindly.
The 2022 version substantially streamlined Annex A: the 2013 version contained 114 controls across 14 categories; the 2022 revision grouped them into just 93 controls and 4 themes, creating a clearer structure.
How does the continuous improvement cycle (PDCA) work?
Plan: Plan
Define the scope, policy and objectives, and assess information security risks.
Do: Deploy
Implement the risk treatment plan and selected security controls.
Check: Monitor
Monitor, measure, conduct internal audits and management reviews to assess effectiveness.
How long is the certificate valid?
Once obtained, the certificate is valid for 3 years, subject to annual surveillance audits conducted by the certification body; after 3 years, a recertification audit restarts the cycle.
ISO 27001 does not replace regulatory texts, but it covers their foundations. The directive NIS 2 thus requires 10 categories of measures (Article 21), with violations punishable by fines of up to 10 000 000 € or 2 % of worldwide turnover for an essential entity, and 7 000 000 € or 1.4 % for an important entity:
“Member States shall ensure that essential and important entities take appropriate and proportionate technical, operational and organizational measures to manage the risks to the security of network and information systems that these entities use for their operations or the provision of their services.” (Directive (EU) 2022/2555, Article 21, paragraph 1).
- Policies on risk analysis and information systems security
- Incident management
- Business continuity, backups, recovery, and crisis management
- Supply chain security
- Security in system acquisition, development and maintenance; vulnerability handling
- Assessment of the effectiveness of measures
- Basic cyber hygiene and cybersecurity training
- Cryptography and encryption
- Human resources security, access control, and asset management
- Multi-factor authentication and secure communications
The 93 Annex A controls cover these 10 categories, as do the 42 measures in the ANSSI cyber hygiene guide (published on 23 January 2017), which ANSSI describes as “a roadmap that serves the interests of any entity aware of the value of its data.”
What are the benefits of ISO 27001 certification?
Trust & business
Internationally recognized proof that reassures clients, partners and contracting authorities, and unlocks tender opportunities.
Regulatory compliance
A solid foundation for meeting GDPR, NIS2, DORA or HDS and reduce your legal exposure.
Risk management
Fewer incidents, better-contained impacts, and greater resilience against cyber threats.
Want to learn more about ISO 27001?
BCIT Formation guides you in understanding the standard and building your ISMS and pursuing certification — rated 4.7/5 on Trustpilot. Let’s discuss your context and goals for 15 minutes.