Compliance & Assurance
ISO 27001
ISO/IEC 27001:2022 Information Security Management System
By Clear Infosec · Last reviewed: August 2026
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS), a risk-based set of policies, controls, and processes for protecting information.
What is ISO 27001?
ISO/IEC 27001 defines the requirements for establishing, operating, and continually improving an ISMS. The 2022 revision organizes controls in Annex A into four themes (organizational, people, physical, and technological) totaling 93 controls.
Certification is issued by an accredited certification body after a two-stage audit. It is a management-system certification, so it evidences a working risk-management process, not a one-time test result.
Who does ISO 27001 apply to?
Any organization that wants to manage information security risk in a structured, auditable way. It is common for technology providers, financial services, healthcare, and any business that must give customers or regulators assurance over how information is protected.
Key security expectations
- A defined ISMS scope, information security policy, and risk assessment and treatment methodology.
- A Statement of Applicability (SoA) justifying which Annex A controls apply.
- Operating controls across access, cryptography, operations, supplier relationships, and incident management.
- Technical vulnerability management and secure development practices (Annex A 8.8, 8.25 to 8.29).
- Internal audits, management reviews, and continual improvement.
How an assessment works
- 1 Scope and gap analysis against the standard and Annex A controls.
- 2 Risk assessment and risk treatment plan.
- 3 Control implementation and evidence collection.
- 4 Internal audit and management review.
- 5 Stage 1 (documentation) and Stage 2 (implementation) certification audit by an accredited body.
Typical evidence
Testing and ISO 27001: ISO 27001 expects technical vulnerability management and secure testing. Penetration testing and vulnerability assessment provide evidence for controls such as A.8.8 (management of technical vulnerabilities) and A.8.29 (security testing in development and acceptance).
How Clear Infosec helps with ISO 27001
Related Clear Infosec services that support ISO 27001:
Risk Assessment & Compliance Readiness
Know your risk. Be audit-ready.
IT GRC, TPRM & Audit Preparation
Govern risk, vendors, and audits in one place.
Policy & Procedure Development
Policies that fit your business and pass audit.
Security Architecture Reviews
Secure by design, across network and application.
Vulnerability Assessment & Penetration Testing
Find and prove real risk before attackers do.
Frequently asked questions
Does ISO 27001 require penetration testing?
ISO 27001 does not mandate a specific penetration test, but it requires managing technical vulnerabilities and secure testing (Annex A 8.8 and 8.29). Penetration testing and vulnerability assessments are the common way organizations produce that evidence.
Is ISO 27001 a certification or an attestation?
It is a certification. An accredited certification body audits your ISMS and issues a certificate, typically valid for three years with annual surveillance audits.
How long does ISO 27001 readiness take?
It depends on scope and maturity. A readiness and gap assessment identifies the work required; organizations often need several months to implement and operate controls before the certification audit.
This page is general information, not legal or regulatory advice. Requirements are defined by the authoritative body linked above.
Preparing for ISO 27001?
Talk to Clear Infosec about a readiness assessment, gap analysis, or testing aligned to ISO 27001.
Contact us