Overview
ISO/IEC 27001 sets the requirements for an information security management system (ISMS). It asks an organisation to define what information it protects, assess risks to its confidentiality, integrity and availability, choose controls and keep them working.
The current edition is ISO/IEC 27001:2022. Its Annex A lists 93 controls in four themes: organisational, people, physical and technological. Each organisation decides which apply and records its choices in a Statement of Applicability.
Who needs it
- IT, software and SaaS companies whose customers ask for it in security questionnaires.
- Manufacturers handling customer designs and drawings.
- Service providers handling personal or financial data.
- Suppliers to government and regulated sectors.
Process
- Scope the ISMS: sites, teams, systems and information.
- Risk assessment and risk treatment plan.
- Statement of Applicability against Annex A.
- Policies and procedures, kept in proportion to your size.
- Awareness training, internal audit and management review.
- Certification audit in two stages by an accredited certification body.
How Aaditech helps
We keep ISMS documentation lean and practical, and coordinate with your IT team or provider on technical controls. We help you pick a certification body accredited for ISO/IEC 27001 in your sector.
Contact us to start with an ISO 27001 gap analysis.
