An ISO/IEC 27001:2022 information security management system (ISMS) must contain a defined scope, a risk assessment and treatment process, and a Statement of Applicability covering all 93 Annex A controls. It also needs records proving that clauses 4 to 10 work, and the 2022 edition is the only one you can be certified to since the 2013 transition ended on 31 October 2025.
This guide is for CISOs, compliance managers and IT leads building or rebuilding an ISMS for certification.
What does ISO/IEC 27001:2022 actually require?
ISO/IEC 27001:2022 is the third edition of the standard. ISO published it in October 2022, and its ISO page still lists it as the current edition. It sets requirements for establishing, running and improving an ISMS. It does not tell you which firewall to buy.
The requirements sit in clauses 4 to 10, which follow the same structure as ISO 9001 and other management system standards.
Clause 4 covers context, interested parties and scope, and clause 5 covers leadership and the security policy. Clause 6 covers risk assessment, risk treatment, objectives and, new in 2022, planning of changes (6.3). Clause 7 covers resources, competence, awareness and documented information. Clause 8 is operation, clause 9 is performance evaluation and clause 10 is improvement.
Annex A lists 93 information security controls drawn from ISO/IEC 27002:2022. They are grouped into four themes: organisational, people, physical and technological. The 2013 edition had 114 controls in 14 domains, as certification body SGS summarised when ISO/IEC 27002:2022 was published.
Which documents and records must an ISMS have?
The standard names a short list of documented information. Everything else is what your organisation decides it needs (clause 7.5.1 b). Auditors therefore expect the mandatory items without exception and judge the rest by whether your controls work.
The table maps the clauses that call for documented information to the evidence auditors usually sample. The evidence column is AGS's reading, not the standard's wording. Check each clause in your own copy.
| Clause | What must be documented | Evidence auditors usually sample |
|---|---|---|
| 4.3 | ISMS scope | Scope statement naming sites, services, systems and exclusions |
| 5.2 | Information security policy | Signed policy, proof it was communicated |
| 6.1.2 and 8.2 | Risk assessment process and its results | Risk method, risk register with owners and dates |
| 6.1.3 and 8.3 | Risk treatment process, Statement of Applicability, treatment results | SoA with a justification for every control, treatment plan with risk owner approval |
| 6.2 | Information security objectives | Objectives with measures, owners and deadlines |
| 7.2 | Evidence of competence | Training records, role requirements, awareness completion |
| 8.1 | Records needed to show processes ran as planned | Change records, supplier reviews, control logs |
| 9.1 | Monitoring and measurement results | Security metrics, vulnerability scan trends, access review results |
| 9.2 and 9.3 | Audit programme and results, management review results | Internal audit plan and reports, review minutes with decisions |
| 10.2 | Nonconformities and corrective actions | Corrective action log showing cause, action and effectiveness check |
How do the risk assessment and Statement of Applicability fit together?
The risk assessment is the engine of the ISMS. You identify risks to the confidentiality, integrity and availability of information in scope, assign an owner to each, and rate them against criteria you set in advance.
Risk treatment then decides what to do about each risk. Clause 6.1.3 asks you to compare the controls you chose with Annex A, so nothing necessary is missed. The Statement of Applicability (SoA) records the result. For every one of the 93 controls it states whether the control is included, why, whether it is implemented, and the reason for any exclusion.
A common audit finding is an SoA that does not match the risk register. If a control is marked "not applicable" while the register lists a risk it would treat, expect a nonconformity. Our guide to ISO 31000 and IEC 31010 covers risk methods you can use inside clause 6.1.2.
Is an ISO/IEC 27001:2013 certificate still valid?
No. The International Accreditation Forum set a three-year transition in IAF MD 26. From 30 April 2024, initial certification and recertification could only be to the 2022 edition. Certified organisations had to complete their transition by 31 October 2025, and all 2013 certificates expired or were withdrawn at that date.
The 2022 edition has one amendment. ISO/IEC 27001:2022/Amd 1:2024, published in February 2024, adds climate change to the issues and interested-party requirements you consider under clauses 4.1 and 4.2. ISO and the IAF described it in a joint communiqué as making an existing requirement explicit. Record whether climate change is relevant to your ISMS and why.
What do certification auditors check at stage 1 and stage 2?
Accredited certification bodies follow ISO/IEC 17021-1, which sets a two-stage initial audit. Stage 1 reviews your documented ISMS and readiness: scope, risk method, SoA, policy, internal audit and management review. Stage 2 tests whether the system runs in practice.
In stage 2 auditors sample controls against your SoA and ask for records. Typical requests are an access review with the accounts removed, a restore test with its result, an incident from report to closure, and a supplier security assessment. They also interview staff about the policies that apply to their role.
A certificate normally runs for three years, with surveillance audits at least once a year and a recertification audit before expiry. Before stage 1, run at least one full internal audit and one management review. Auditors cannot sample records that do not exist yet.
Where do topic-specific security policies fit?
Clause 5.2 requires one information security policy. Annex A control 5.1 adds topic-specific policies where your risks call for them, such as access control, cryptography, backup, acceptable use or mobile devices. Each needs an owner, approval and a review date.
Policies alone rarely satisfy an auditor. They look for the procedure that puts the policy into practice and the record that proves it ran. A backup policy is backed by a restore procedure and monthly restore test results. An access control policy is backed by joiner, mover and leaver records and periodic access reviews.
Sector rules can add their own control sets. Healthcare entities in Abu Dhabi, for example, also answer to ADHICS, which our ADHICS guide compares with ISO/IEC 27001. If you use AI systems in scope, see our ISO/IEC 42001 guide.
How AGS can help
AGS sells two editable Microsoft Word kits for this work:
- ISMS - ISO/IEC 27001:2022: 39 documents, including an ISMS manual, 15 procedures, a Statement of Applicability, a risk register, and gap analysis and Annex A checklists.
- Information Security Policy & ISMS Package: 65 documents, with policies, procedures, work instructions, forms, checklists, KPI sheets and risk registers for eight security topics.
Frequently asked questions
Is ISO/IEC 27002 certifiable?
No. ISO/IEC 27002:2022 is guidance on implementing the controls. Organisations are certified to ISO/IEC 27001.
Can we exclude Annex A controls?
Yes, if your risk assessment shows a control is not needed. The SoA must record the justification for each exclusion.
Do we need a separate document for every Annex A control?
No. The standard does not require one document per control. Auditors look for evidence that each included control is implemented, which can sit in shared procedures and records.
Does buying documentation mean we will be certified?
No. Templates are a starting point. Certification depends on how the ISMS is implemented and on an accredited certification body's audit.
AGS provides independent documentation toolkits. AGS is not affiliated with ISO, IEC, the IAF, any certification body or any regulator named in this guide, and buying a kit is not certification.
Reviewed October 2026. Facts checked against the sources current at publication.
