Compliance guide · Global standard

ISO 27001, step by step.

ISO/IEC 27001 is the security certificate enterprise customers and tenders ask for most. Here is what the 2022 version contains, how certification works, and what it really takes to get there.

Get an ISO 27001 readiness quote See the 93 controls
Gap check to certificateSized for small and mid-sized firmsCertified by an accredited body, not us
In plain words

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a working set of policies, risk assessments, controls and reviews that keeps information safe. The 2022 version groups its 93 Annex A controls into four themes. An accredited certification body audits you and issues a certificate valid for three years, with surveillance audits every year. Certificates to the old 2013 version expired on 31 October 2025.

Checked against official sources on . General information, not legal advice.

Current version
ISO/IEC 27001:2022
Controls
93 in 4 themes
Certificate
3 years, yearly audits
Typical readiness
6–16 weeks
Annex A at a glance

93 controls, four themes.

You do not have to apply every control. You assess your risks, pick the controls that treat them, and explain each choice in a Statement of Applicability.

The 93 controls of ISO/IEC 27001:2022 Annex A in four themes: 37 organisational, 8 people, 14 physical and 34 technological. Eleven are new in 2022: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. 5 · ORGANISATIONAL37CONTROLSControl 5.1Control 5.2Control 5.3Control 5.4Control 5.5Control 5.6Control 5.7: Threat intelligence (new in 2022)Control 5.8Control 5.9Control 5.10Control 5.11Control 5.12Control 5.13Control 5.14Control 5.15Control 5.16Control 5.17Control 5.18Control 5.19Control 5.20Control 5.21Control 5.22Control 5.23: Information security for use of cloud services (new in 2022)Control 5.24Control 5.25Control 5.26Control 5.27Control 5.28Control 5.29Control 5.30: ICT readiness for business continuity (new in 2022)Control 5.31Control 5.32Control 5.33Control 5.34Control 5.35Control 5.36Control 5.376 · PEOPLE8CONTROLSControl 6.1Control 6.2Control 6.3Control 6.4Control 6.5Control 6.6Control 6.7Control 6.87 · PHYSICAL14CONTROLSControl 7.1Control 7.2Control 7.3Control 7.4: Physical security monitoring (new in 2022)Control 7.5Control 7.6Control 7.7Control 7.8Control 7.9Control 7.10Control 7.11Control 7.12Control 7.13Control 7.148 · TECHNOLOGICAL34CONTROLSControl 8.1Control 8.2Control 8.3Control 8.4Control 8.5Control 8.6Control 8.7Control 8.8Control 8.9: Configuration management (new in 2022)Control 8.10: Information deletion (new in 2022)Control 8.11: Data masking (new in 2022)Control 8.12: Data leakage prevention (new in 2022)Control 8.13Control 8.14Control 8.15Control 8.16: Monitoring activities (new in 2022)Control 8.17Control 8.18Control 8.19Control 8.20Control 8.21Control 8.22Control 8.23: Web filtering (new in 2022)Control 8.24Control 8.25Control 8.26Control 8.27Control 8.28: Secure coding (new in 2022)Control 8.29Control 8.30Control 8.31Control 8.32Control 8.33Control 8.34NEW IN 2022 · 115.7 Threat intelligence5.23 Security of cloud services5.30 ICT readiness for continuity7.4 Physical security monitoring8.9 Configuration management8.10 Information deletion8.11 Data masking8.12 Data leakage prevention8.16 Monitoring activities8.23 Web filtering8.28 Secure coding
One square per control. The 2022 version merged the 114 controls of the 2013 version into 93, grouped in four themes instead of fourteen domains, and added eleven new ones.
Key dates

The 2013 version is gone.

OCT 20222022 version publishedFEB 2024Climate amendment addedOCT 20252013 certificates expire TODAY · NOV 2026
  1. OCT 20222022 version published
  2. FEB 2024Climate amendment added
  3. OCT 20252013 certificates expire

The 2024 amendment asks organisations to consider whether climate change is a relevant issue for their ISMS. Any certificate still showing the 2013 version is no longer valid.

The road to certification

Six steps, two audits.

  1. Weeks 1–2

    Scope and gap check

    Which teams, sites and systems are in scope, and where you stand against every clause and control.

  2. Weeks 2–4

    Risk assessment

    What could go wrong, how likely and how bad, and the controls you choose to treat each risk.

  3. Weeks 3–10

    Policies and controls

    Policies people actually follow, and controls that run: access reviews, backups, logging, supplier checks.

  4. Weeks 6–14

    Evidence

    Controls running long enough to leave records an auditor can test.

  5. Weeks 12–16

    Internal audit and review

    A dress-rehearsal audit, then a management review signed off by your leaders.

  6. Certification body

    Stage 1 and Stage 2

    Stage 1 checks your documents and readiness; Stage 2 tests that the ISMS works in practice.

See the full picture on our compliance and GRC service, including ISO 27001 compared with SOC 2.
Who needs it

Usually asked for when you sell to big customers.

  • Enterprise or government customers ask for it in tenders and security questionnaires
  • You handle customer data as a SaaS, IT services or BPO company
  • You want one recognised proof of security for India, the Gulf and Europe
  • You need a solid base for DPDP, SOC 2 or ISO 42001 work

Is it mandatory? For most companies, no law requires it. Customers, tenders and sector regulators often do.

Our own ISO/IEC 27001 certification is in progress. We will say so plainly until it is issued.

Questions

ISO 27001 questions, answered.

Q01Is ISO 27001 mandatory in India?
Not by law for most companies. In practice, many enterprise customers, government tenders and regulated partners ask for it, and it is the most widely recognised proof that you manage information security properly.
Q02What changed in the 2022 version?
The controls were reorganised from 114 in 14 domains into 93 in four themes: organisational, people, physical and technological. Eleven controls are new, including threat intelligence, cloud security, data leakage prevention and secure coding. The management system clauses were updated too.
Q03How long does certification take?
Most small and mid-sized companies are ready for the Stage 1 audit in 6 to 16 weeks with our help. The certification body then runs Stage 1 and Stage 2, usually a few weeks apart. The certificate lasts three years, with surveillance audits in years two and three.
Q04What does it cost?
Our readiness work is a fixed fee after a free scoping call, and the certification body charges separately for audits. Both depend on the number of people, sites and systems in scope, how much is already in place, and how many controls apply.
Q05ISO 27001 or SOC 2?
ISO 27001 is a certificate recognised worldwide; SOC 2 is an auditor’s report that US buyers often prefer. They overlap heavily, so many companies build one set of controls and get both. Our SOC 2 guide explains the difference.
Q06Do you issue the certificate?
No. An accredited certification body does. We prepare you, run the internal audit, and support you through the certification audits.
Sources

Checked against the official text.

This guide is general information, not legal advice. Rules and dates change, so check the official text and ask your lawyer before making decisions for your company. We update this page when the rules change.

Next hops

Related guides and services

Request a quote

Scope it in two minutes.

Tell us what you need protected. A security engineer, not a salesperson, replies with a fixed-price proposal.

Start your quote hello@hanulsec.com
  • Reply within one business day
  • Free 30-minute scoping call
  • Mutual NDA before any detail is shared
  • Fixed price, free retest of fixed findings