Skip to content
SecTepeMit Sicherheit gut aufgestellt!
DE
Glossary

ISO 27001: Requirements, Certification and Process Explained

What is ISO 27001? The information security standard explained: requirements, Annex A, the certification process, duration, costs and validity.

Definition: ISO/IEC 27001 is the world standard for an information security management system (ISMS). It sets out how a company plans, runs, checks and keeps improving its security. The goal is to keep data secret, correct and available. Companies can get certified against it.

What Is ISO 27001?

Two standards bodies publish ISO 27001 together: ISO and IEC. That is why its full name is ISO/IEC 27001. The first edition came out in 2005. The current edition dates from 2022. Since 31 October 2025, certificates based on the old 2013 edition are no longer valid.

The standard does not ask for any set tools. It requires a management system, an ISMS. With it, a company finds its risks, decides on controls and checks on a regular basis whether they work.

A picture: ISO 27001 is not a lock, but the house rules. They set out who is in charge of which door, how often the locks are checked and what happens when a key is lost.

Why Is ISO 27001 Important?

Cyber attacks and data leaks cost money, trust and at times the whole firm. ISO 27001 makes sure that security does not depend on chance or on single people.

Benefits of Certification

  • Clear handling of risks: you know which risks exist and how you treat them.
  • Trust: customers and partners see that an independent auditor has assessed your ISMS.
  • Laws and contracts: the standard helps with duties from NIS-2, the GDPR and customer contracts.
  • Fewer forms to fill in: a certificate answers many questions that customers ask when they buy from you.

The Requirements of ISO 27001

The standard has two parts: the mandatory clauses 4 to 10 and Annex A.

Clauses 4 to 10

  • Context (4): who are the parties involved, what do they expect, and which areas belong to the ISMS?
  • Leadership (5): the bosses are in charge and set a security policy.
  • Planning (6): assess risks, choose controls and set goals.
  • Support (7): staff, skills, training, how you share news and the papers you keep.
  • Operation (8): put the planned controls in place and reassess risks on a regular basis.
  • Performance evaluation (9): measure results, run your own audits and have the bosses review the ISMS.
  • Improvement (10): fix gaps and keep making the ISMS better.

Annex A: 93 Controls

Annex A lists 93 controls in four groups. There are 37 for the company as a whole, 8 for people, 14 for buildings and rooms, and 34 for technology. Examples are who may access what, training, backups, logs and how you check your suppliers. Not every control fits each firm. In the statement of applicability (SoA), you explain which ones you use and which ones you do not.

Building an ISMS to ISO 27001

  1. Win the bosses over: without their backing and budget, the project fails.
  2. Set the scope: which sites, departments and systems are included?
  3. List assets and risks: what needs protection, what can happen, and how bad would it be? See IT risk management.
  4. Choose controls: treat the risks and write the statement of applicability.
  5. Rules and training: write policies and train your staff.
  6. Check: run an internal audit and a management review before the auditor comes.

You will find a detailed guide in our article ISO 27001 certification with a 6-phase roadmap.

The ISO 27001 Certification Process

  1. Stage 1 audit: the certification body reviews the documents and whether you are ready for the main audit.
  2. Stage 2 audit: the auditors check on site or by video whether the rules are followed in daily work.
  3. Certificate: once all major gaps are fixed, you get the certificate.
  4. Surveillance: there is one surveillance audit in each of the next two years.
  5. Recertification: after three years, the whole ISMS is checked again.

Make sure the auditor is accredited. In Germany, the body that does this is called DAkkS.

ISO 27001 and Continual Improvement

An ISMS is never finished. New threats, new systems and changes in the company call for updates. For this, the standard uses the PDCA cycle:

  • Plan: set goals and plan controls.
  • Do: put the controls in place.
  • Check: measure and review the results.
  • Act: fix what does not work.

Costs and Effort

The costs have several parts. The auditor charges by the day. How many there are depends mainly on the number of staff and on the scope. On top come your internal effort, outside consulting if needed and the cost of missing controls. Also plan for the yearly surveillance audits. Your own staff time is often the largest part, not the audit.

ISO 27001, BSI IT-Grundschutz, TISAX and SOC 2

  • BSI IT-Grundschutz: a German approach with very concrete modules. An ISO 27001 certificate based on IT-Grundschutz is also possible.
  • TISAX: the assessment scheme of the car industry, which builds on ISO 27001.
  • SOC 2: an audit report by a CPA firm, common mainly in the US. Many controls overlap with ISO 27001.

Who Is ISO 27001 For?

The standard fits organizations of any size and sector. Many IT service firms, software and cloud vendors want it. So do banks, hospitals, public bodies and suppliers whose customers ask for a certificate.

Support from SecTepe

Our ISO 27001 consulting guides you from scope and risk analysis to the audit. With the ISO 27001 software SecTepe.Core, you manage risks, controls, the statement of applicability and evidence in one place.

Conclusion

ISO 27001 sets out how a company keeps its data safe in a planned way. At its core are the risk check, the right controls from Annex A and steady improvement. The certificate shows customers and partners that an outside auditor has checked the ISMS. It is valid for three years and is checked every year.

FAQ about ISO 27001

What is ISO 27001 in simple terms?

ISO 27001 is a world standard for keeping data safe. It describes how a company builds a system to find, rate and treat its risks. This system is called an ISMS. If you meet the requirements, an independent body can certify you.

What are the requirements of ISO 27001?

The mandatory requirements are in clauses 4 to 10. They cover the scope, the role of top management and risk assessment. They also cover training, written rules, internal audits, a yearly review by management and ongoing fixes. Annex A lists 93 controls. The company decides which of them apply. It writes down why in the statement of applicability.

How does ISO 27001 certification work?

First, you build the ISMS and run it for a while. Then an accredited certification body checks it in two stages: stage 1 reviews the documents and whether you are ready, stage 2 checks how the rules work in daily practice. If no major gaps are left open, you get the certificate.

How long does it take to get ISO 27001 certified?

It depends on size, scope and starting point. Many mid-sized companies plan six to twelve months from start to certificate. If good processes and documents already exist, it goes faster.

How long is an ISO 27001 certificate valid?

A certificate is valid for three years. During this time, the certification body checks each year in a surveillance audit whether the ISMS still works. After three years, the full audit is done again.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 holds the rules you are certified against. ISO 27002 is a guide. It explains the 93 controls from Annex A in more detail and gives advice on how to put them in place. You cannot be certified against ISO 27002.

More terms in “Compliance & Regulation”

All terms in “Compliance & Regulation” →