ISO/IEC 27001 requirements explained: video brief

Two parts that work together

ISO/IEC 27001:2022 has two parts. Clauses 4 to 10 set out the management system requirements on the harmonised structure shared with ISO 9001 and ISO 22301, and none may be excluded when claiming conformity. Annex A, which is normative, lists reference controls that you must compare with the controls your risk treatment selects. This short film sets out both parts and the link between them.

The clauses ask for context and scope, including the interested parties and their security requirements; leadership that sets the information security policy and assigns roles and authorities; planning that assesses risks with criteria, owners, consequences and likelihood and treats them by selecting controls; support through resources, competence, awareness, communication and controlled documented information; operation of the planned processes and risk treatment; performance evaluation through monitoring, internal audit and management review; and improvement through corrective action.

Where the Statement of Applicability fits

Risk treatment is where the two parts meet. Controls are selected to treat the assessed risks, compared with Annex A so that nothing necessary is overlooked, and recorded in the Statement of Applicability together with a treatment plan the risk owners approve. In practice the evidence looks like a scope statement naming services, sites, systems and interfaces, a register of client, legal and contractual requirements, an approved policy and an ISMS lead and risk owners with authority.

ISO/IEC 27001:2022 is the current edition, and Amendment 1:2024 adds the requirement to determine whether climate change is a relevant issue; Annex A is unchanged by it. The transition from the 2013 edition ended on 31 October 2025, so a valid accredited certificate now references the 2022 edition. Certification is assessed and decided by an independent, accredited certification body.

The requirements are deliberately general so that a software company, a BPO and a public-sector supplier can each apply them to their own risks. What an auditor tests is whether your selection of controls follows from your risk assessment, and whether those controls exist and work.