ISO 27001 Implementation Guide

ISO 27001 is built around an Information Security Management System (ISMS). The ISMS is not just a set of controls. It is a management system covering policy, governance, risk treatment, monitoring, and continuous improvement. Clauses 4-10 of the standard define the management system requirements. Annex A defines the 93 reference controls (in the 2022 revision) that you select from based on risk.

The certification audit tests both. Clauses 4-10 are mandatory. Annex A is selective: you justify which controls apply and which do not in the Statement of Applicability.

Treat ISO 27001 as a management system project, not a controls project. Cross-reference the ISO 27001 framework reference for clause-by-clause requirements.

Clause 4 requires you to define the scope of your ISMS and understand the organizational context. This is not an afterthought. The scope determines what gets audited.

Scope decisions:

• Organizational scope: Which legal entities, business units, and geographies?
• Information assets: Which products, services, and data flows?
• Locations: Which offices, data centers, cloud regions?
• Interfaces: How does the ISMS scope connect to out-of-scope parts of the organization?

Context analysis (clause 4.1) requires you to identify internal and external issues that affect the ISMS: regulatory environment, customer requirements, threat landscape, business strategy. Document these as inputs to risk assessment.

Clause 4.2 requires identifying interested parties (customers, regulators, employees, vendors) and their requirements. The output of clauses 4.1 and 4.2 feeds clause 4.3 (scope) and clause 6.1 (risk assessment).

Risk assessment (clause 6.1.2) is the engine of the ISMS. It identifies risks to the confidentiality, integrity, and availability of information assets. Without risk assessment, you cannot justify control selection.

The risk assessment methodology must be documented and consistent. Common approaches:

• Asset-based: Identify assets, then threats and vulnerabilities for each
• Process-based: Identify processes, then risks to each process
• Scenario-based: Identify threat scenarios, then assess likelihood and impact

Each risk is rated for likelihood and impact, and the combined rating determines treatment priority. Risks above the risk acceptance threshold need treatment: avoid, mitigate (apply controls), transfer (insurance, contracts), or accept (with justification).

The output is a risk treatment plan listing each risk, the chosen treatment, and the controls applied. This plan feeds the Statement of Applicability.

Annex A in ISO 27001:2022 contains 93 reference controls organized into four themes:

• A.5 Organizational controls: 37 controls covering policies, governance, supplier relationships
• A.6 People controls: 8 controls covering training, screening, agreements
• A.7 Physical controls: 14 controls covering facility security and asset handling
• A.8 Technological controls: 34 controls covering access, cryptography, monitoring, vulnerability management

You select controls based on the risk treatment plan. Not every Annex A control applies to every organization. The Statement of Applicability (SoA) documents which controls you applied, why, and which you excluded with justification.

Common exclusions: A.7.4 (physical security monitoring) for fully remote organizations, A.8.30 (outsourced development) for organizations that build everything in-house. Every exclusion needs documented rationale.

The certification audit happens in two stages, conducted by an accredited certification body (CB):

1. Stage 1 (documentation review): 1-3 days. Auditor reviews ISMS documentation: scope, policies, risk assessment, SoA, internal audit results, management review records. Identifies gaps before stage 2.
2. Stage 2 (operational audit): 3-10 days depending on scope. Auditor tests whether the ISMS is operating: walk-throughs, evidence sampling, control testing.

If both stages pass, certification issues for three years with annual surveillance audits in years 2 and 3, and a recertification audit in year 4.

First-year program timeline: 6-12 months from kickoff to certification. The bottlenecks are documentation depth, internal audit completion, and management review evidence. Plan internal audit and management review at least three months before stage 2 to give time for any corrective actions.