ISO 27001 — Information security management systems
What is ISO 27001?
ISO 27001 is the international standard for information security management systems. It requires a company to know what data and information assets it has, how important they are, what risks they face and which controls keep those risks in check.
The standard is often confused with technical protection. ISO 27001 isn’t a piece of software or an antivirus product — technical measures are only one part of it. Rules, responsibilities, access to data, supplier contracts, staff behaviour and what you do when an incident happens need just as much attention.
Clients ask for it: banks, public contracting authorities, foreign buyers and the customers of IT companies who want proof that their data is safe with a supplier. The standard combines well with ISO 9001, because they share the same structure.
If you still have an ISO 27001:2013 certificate
The deadline for moving from ISO/IEC 27001:2013 to the 2022 edition was 31 October 2025. Certificates to the old edition are no longer valid after that date.
This means:
- if a 2013 certificate is still shown on your website or in your bids, it no longer carries the weight a client assumes it does;
- the move is no longer handled as an update to an existing certificate, but through a new certification process to the 2022 edition;
- most of the system stays — the main work is aligning the Statement of Applicability with the new Annex A and covering the controls introduced in 2022.
If you’re not sure which edition your certificate is issued against, it says so on the certificate itself. Get in touch and we’ll assess exactly what is missing.
What an information security management system covers
ISO/IEC 27001 doesn’t only protect data on computers. It covers everything information touches — people, procedures, premises and technology. What the standard requires:
- The scope of the system — which information, processes, sites and systems are protected.
- Risk assessment in terms of confidentiality, integrity and availability, with risk acceptance criteria the organisation sets itself.
- Risk treatment — choosing controls and planning how to implement them.
- The Statement of Applicability — a mandatory document, see below.
- An information security policy and objectives adopted by top management.
- Incident management — reporting, assessment, response, lessons learned.
- Working with suppliers who have access to your information.
- Internal audit and management review.
Who implements it
The standard applies to organisations of any size and sector. It is implemented where information is the business itself, or where a client requires it:
- software companies, cloud service providers and development centres;
- data centres, hosting and managed IT service providers;
- banking, insurance and financial services;
- telecoms and network service providers;
- healthcare, laboratories and research;
- companies that process data for clients in the European Union, where the certificate is asked for in supplier checks.
The trigger usually comes from outside — a security questionnaire from a large customer, a tender condition or a request from a parent company.
From risk assessment to certificate
- Defining the scope — precisely, because it appears on the certificate.
- An inventory of information assets and dependencies — what you have, where it is and who has access to it.
- Risk assessment using a defined methodology, with risk owners.
- A risk treatment plan — choosing the controls you need and checking them against Annex A, with the option of adding your own.
- Preparing the Statement of Applicability, with a justification for every control.
- Implementing the controls — policies, access control, cryptography, logging, physical security, working with suppliers, staff training.
- Setting up incident management and business continuity arrangements.
- Internal audit and management review, followed by the two-stage certification audit.
What changes in day-to-day work
The biggest change is that access stops being a matter of habit. Who may access what is defined and checked — and when someone leaves the company, their access leaves with them.
- Access is granted on a need-to-know basis and reviewed regularly.
- An incident is reported, assessed and learned from, instead of being fixed and forgotten.
- Suppliers who handle your data have contractual obligations and are monitored.
- Backups aren’t just made — they are tested by restoring them.
- Customers’ security questionnaires are answered from existing documentation instead of being put together from scratch every time.
Annex A in the 2022 edition — 93 controls in four themes
The current edition is ISO/IEC 27001:2022. It reorganised Annex A: instead of the previous 114 controls in 14 domains, there are now 93, arranged in four themes:
- organisational — policies, roles, working with suppliers, incident management;
- people — pre-employment screening, training, the disciplinary process, remote working;
- physical — access to premises, equipment, storage media;
- technological — access to systems, cryptography, logging, network security, secure development.
The reorganisation isn’t just cosmetic: several new controls were introduced, including threat intelligence, information security for the use of cloud services, ICT readiness for business continuity and monitoring activities. The number of controls went down because related ones were merged, not because less is required.
The Statement of Applicability — a mandatory document
The Statement of Applicability is the only document the standard requires to cover every control in Annex A. For each one it states whether it applies, why, and whether it has been implemented — and if it doesn’t apply, a justification must be given.
That is why it is the first document an auditor opens: it shows whether the risk assessment was genuinely carried out or Annex A was simply copied in full. If you declare every control applicable ‘to be on the safe side’, the audit will then ask for evidence for all 93 — including the ones your organisation doesn’t need at all.
Climate change in the organisation’s context
Since February 2024, ISO/IEC 27001 has had an amendment (ISO/IEC 27001:2022/Amd 1:2024), one of the climate amendments ISO made to its management system standards. It requires the organisation to determine whether climate change is a relevant issue, and adds a note that relevant interested parties can have requirements related to climate change.
This isn’t a separate system or new documentation. What is required is that the consideration takes place and can be seen — in the context analysis and in the management review. If you conclude that climate change isn’t relevant to your information security system, that is an acceptable outcome too, provided it is clear the question was asked.
How long implementation takes
Implementing ISO 27001 usually takes 30 to 90 days. Exactly how long depends on the size of the organisation, the number of employees and how much of the above is already in place. The asset inventory and the risk assessment take the most time, because they need people from several departments. We give an estimate for your case after a short conversation about the scope. On your side, for small and medium-sized organisations it takes 2 to 5 hours a week in total, spread across several people — more on this in our frequently asked questions.
What affects the price
Three things affect the cost of implementation:
- the size of the organisation;
- the number of employees;
- the standard being implemented — the amount of work differs from standard to standard.
We can only give an exact price after you get in touch and we have a short conversation about the scope. Without that, any figure would be guesswork, so we don’t give one here.
Frequently asked questions
Do we have to implement all 93 controls in Annex A?
No. Controls are chosen based on the results of the risk assessment. But for every control you don’t implement, there must be a justification in the Statement of Applicability — leaving one out without a justification is a nonconformity.
Does the certificate mean we comply with GDPR?
No. ISO/IEC 27001 covers information security, not the protection of personal data as a legal obligation. There is a separate standard for that, ISO/IEC 27701, but it doesn’t confirm legal compliance either.
What if we use cloud services?
The standard covers this — the 2022 edition has a specific control for information security when using cloud services. Responsibility towards your own customers stays with you, so requirements for the provider are agreed in the contract and you monitor whether they are met.
What is the Statement of Applicability and why is it mandatory?
It is the document that states, for every control in Annex A, whether it applies, why, and whether it has been implemented. The standard requires it explicitly — and it is the document the auditor starts from, because it shows which controls you apply and your reasoning for each decision.
Does the standard require penetration testing?
Not as an explicit requirement. The standard requires technical vulnerabilities to be identified and controls to be checked — and penetration testing is one way of proving that. Whether you need it, and how often, follows from your risk assessment, not from the standard.
Does the standard require encryption?
Annex A includes a control on cryptography, but you decide whether each control applies, based on risk, and you justify that in the Statement of Applicability. Encryption isn’t an unconditional obligation but a measure justified by risk — like every other control.
General questions — cost and duration, who issues the certificate and how long it is valid — are covered in our frequently asked questions.
Related standards
- ISO 27701 — privacy information management. Since the 2025 edition it is a standalone standard: you can be certified to it without ISO/IEC 27001, and if you already have an ISMS, the two systems can be integrated.
- ISO 22301 — business continuity; goes further than ISO/IEC 27001’s requirements for preparing for disruption.
- ISO 20000-1 — IT service management; a common pairing for service providers.
- GDPR — the EU data protection regulation; ISO/IEC 27001 helps you meet its requirements but isn’t proof of compliance.
- ISO 9001 — the quality management system, with a shared structure and documentation.
- Frequently asked questions about ISO standards — how certification works, how long a certificate is valid, what new editions mean.
- Overview of all standards — if you’re not sure what you need.
- ISO 42001 — artificial intelligence management; shares the same structure and can build on the access and logging controls you already have.
- Penetration testing — one way to prove that technical controls work.
How STANDARDISO can help
We guide you through the whole process — from the information asset inventory and risk assessment, through the treatment plan and the Statement of Applicability, to implementing the controls and the internal audit. The certificate is issued by an independent, accredited certification body.
We work from your real processes: the documentation describes what you actually do, rather than forcing your work into a template. We train your staff so they can keep using the system after the audit. Everyone on our team works in English, and we can prepare your documentation in English, Serbian or both.