ISOReadyHub home Start a Discovery Conversation
ISO Standards · Information security

ISO/IEC 27001 built around risk, controls and evidence.

ISO/IEC 27001:2022 sets requirements for an information security management system (ISMS). It is not simply a cybersecurity checklist.

A credible ISMS connects business context, information-security risk, risk treatment, governance, selected controls, operating evidence and continual improvement.

Start a Discovery Conversation
Last verified
Status
ISO/IEC 27001:2022 with Amendment 1:2024

Annex A is not a checklist

Annex A is a reference set of information-security controls. Controls should be selected and justified through:

  • Risk treatment
  • Legal requirements
  • Contractual requirements
  • Business requirements
  • Other relevant obligations
Edition and transition

Current edition and amendment

ISO/IEC 27001:2022 has an applicable Amendment 1:2024 concerning climate-action changes.

Deliverables

What you receive

A typical implementation may produce:

  • ISMS scope
  • Context and interested-party analysis
  • Risk methodology
  • Risk register
  • Risk treatment plan
  • Statement of Applicability
  • Objectives and measures
  • Policy and procedure framework
  • Evidence register
  • Internal-audit plan
  • Management-review inputs
  • Certification-readiness tracker

The question that matters

Existing technology is not proof of control effectiveness. The question is:

Can the organization prove the control is operating as intended?

Evidence

Evidence examples

Depending on scope, evidence can include:

  • Access reviews
  • Privileged-access records
  • Vulnerability and patch evidence
  • Logging and monitoring records
  • Backup and recovery evidence
  • Incident records
  • Supplier assurance
  • Secure-development evidence
  • Awareness records
  • Risk treatment progress

How the work happens

Implementation follows the same evidence-first sequence, scaled to your scope, maturity and existing systems.

  1. Discover
  2. Assess
  3. Implement
  4. Prove
  5. Assure
What happens at each stage How engagements are structured

Start with a focused discovery conversation

Tell us what you are trying to achieve, what is driving the requirement and where you are today. We use the first discussion to clarify scope and next steps, not to force a predefined package.

Discuss ISO/IEC 27001