ISO/IEC 27001:2022
The international standard for an Information Security Management System (ISMS). The 2022 revision restructured Annex A into 93 controls across 4 themes, down from 114 controls across 14 domains in the 2013 version.
ISO/IEC 27001 doesn't certify a product or a single control — it certifies that an organization operates a real Information Security Management System: a continuous, documented cycle of identifying risks, selecting controls to treat them, and improving over time (the standard's own "plan-do-check-act" backbone). Certification comes from an accredited third-party certification body, not from ISO itself, and follows an initial two-stage audit, annual surveillance audits, and full recertification every three years.
The 2022 revision reorganized Annex A's reference controls into four themes — organizational, people, physical, and technological — replacing the 2013 version's 14 clause-based domains, and reduced the total control count from 114 to 93 (partly through consolidation, partly through the addition of new controls addressing cloud security, threat intelligence, and data masking). Organizations certified under the 2013 version had a transition deadline set by the International Accreditation Forum to move to the 2022 controls.
Who is impacted
Any organization that wants a portable, internationally recognized way to demonstrate a real information security program — extremely common as a vendor-security requirement in enterprise sales outside the US (where SOC 2 dominates), and increasingly requested alongside SOC 2 by global buyers.
Requirements
A documented ISMS scope, a risk assessment and treatment methodology, a Statement of Applicability explaining which Annex A controls apply and why, and evidence that the organization actually operates those controls — not just documents them. Certification requires an external audit; self-attestation isn't ISO 27001 certification.
Key deadlines
ISO/IEC 27001:2022 published
Executive guides & research
ISO 27001: The Complete Executive Guide
A practitioner's guide to the ISMS, the 2022 Annex A restructure, the certification process, and what actually changed from the 2013 version.
Glossary
ISMS
Information Security Management System — the continuous, documented risk-management process ISO 27001 certifies, not a single tool or control.
Statement of Applicability (SoA)
The ISO 27001 document listing every Annex A control, whether it's applicable to the organization's ISMS scope, and — if excluded — why. Auditors treat it as a central artifact of the certification.
Related
Stay ahead of ISO 27001 changes
Get Regulatory Alerts the moment something about ISO/IEC 27001:2022 changes — new deadlines, guidance updates, enforcement actions.