ISO/IEC 27001 certification is awarded against a management system, not a checklist. Auditors look for documented information that shows your ISMS is defined, operated and improved. Here is what that usually means in practice.
ISO 27001:2022 in brief
ISO/IEC 27001 specifies requirements for an information security management system (ISMS). Clauses 4 to 10 define how the system is run. Annex A lists 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). The 2022 edition replaced the 2013 version, and certificates against the old version have now expired.
Certification is carried out by an accredited certification body in two stages: a Stage 1 documentation review and a Stage 2 audit of how the ISMS operates. Certificates usually run for three years, with surveillance audits in between.
Documented information the standard requires
- Scope of the ISMS (clause 4.3)
- Information security policy (5.2)
- Information security risk assessment process (6.1.2)
- Information security risk treatment process (6.1.3)
- Statement of Applicability (6.1.3 d)
- Information security objectives (6.2)
- Evidence of competence (7.2)
- Documented information needed for operational planning and control (8.1)
- Results of risk assessments (8.2) and risk treatment (8.3)
- Monitoring and measurement results (9.1)
- Internal audit programme and results (9.2)
- Management review results (9.3)
- Nonconformities and corrective actions (10.2)
The Statement of Applicability
The Statement of Applicability (SoA) lists every Annex A control, whether it applies to you, why, and whether it is implemented. It is the document auditors use to plan their testing, so keep it accurate and versioned.
Annex A evidence auditors often sample
- Organisational: policies and approvals, asset inventory, supplier agreements and reviews, incident records, legal and contractual requirements register
- People: screening records, terms of employment, awareness training, disciplinary process, offboarding
- Physical: office access controls, visitor logs, clear desk practices, equipment disposal
- Technological: access reviews, privileged account management, MFA, logging, backups and restore tests, vulnerability management, secure development and change records
Keeping the ISMS alive between audits
- Schedule the recurring work: risk reviews, access reviews, internal audits and management reviews.
- Assign each control and document an owner.
- Keep evidence versions, so you can show what was true at the time.
- Record decisions and their rationale, especially risk acceptance.
- Track nonconformities through to corrective action.
Requirements and auditor expectations vary by scope and certification body. Use the standard and your certification body’s guidance as the authority.
Where ControlQuay fits
ControlQuay does not certify organisations. When customers send you security questionnaires before or after certification, we answer them in 1–3 working days for CHF 490, using your ISMS documents and Statement of Applicability as evidence. See how it works.
Published 2 October 2026 by ControlQuay. General information, not legal or audit advice.