Appearance
ISO/IEC 27001:2022 — Information Security Management System (ISMS)
ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements", is an International Standard of ISO and IEC for an information security management system (ISMS) in an organization. ISO/IEC JTC 1/SC 27 prepared it, and ISO and IEC released the third edition in October 2022.
Key facts
Publisher
ISO and IEC, joint standard of ISO/IEC JTC 1/SC 27
Edition
Third edition, October 2022
Amendment
Amd 1:2024, "Climate action changes", February 2024
Type
Voluntary management system standard
Requirements
Clauses 4 to 10. A conformity claim cannot exclude one of them (Clause 1).
Annex A
Normative, with 93 controls in four themes
Certification
Optional, by a certification body. The standard sets no certification procedure.
Modulos Frameworks
OFF-9 (Organization level) and MFF-9 (AI System level)
The standard and its edition
ISO/IEC 27001:2022 is the third edition of the standard. It replaces ISO/IEC 27001:2013, the second edition, which "has been technically revised", and it includes the two technical corrigenda of the 2013 edition. The Foreword gives one primary change: the text agrees with ISO/IEC 27002:2022 and with the harmonized structure of management system standards. The ISO catalog page shows the 2013 edition and its corrigenda as withdrawn.
The ISO catalog page also shows one amendment to the 2022 edition: ISO/IEC 27001:2022/Amd 1:2024, "Climate action changes", of February 2024. For its changes to 4.1 and 4.2, which the IAF/ISO Joint Communiqué of 22 February 2024 gives, see Clause 4.
"ISO 27001" is a short name for ISO/IEC 27001:2022, and the two Modulos Frameworks have this name. When an organization names a certificate, the ISO catalog page tells it to use the full name of the standard, for example "certified to ISO/IEC 27001:2022".
Clause 2 gives one normative reference, ISO/IEC 27000, and Clause 3 uses the terms and definitions of ISO/IEC 27000. ISO/IEC 27002:2022 gives guidance for the Annex A controls, but an organization cannot get certification to it (Annex A and ISO/IEC 27002:2022).
Organizations that the standard applies to
ISO/IEC 27001 has general requirements for use by all organizations, large or small, of all types, and of each "nature" (Clause 1). Clause 1 gives two groups of requirements. The first group is to establish, implement, maintain, and continually improve an ISMS in the context of the organization. The other group is for information security risk assessment and risk treatment, adapted to the organization.
ISO/IEC 27001 is a voluntary standard (Foreword), and certification is a decision of each organization that implements it (ISO catalog page). But an organization that claims conformity cannot exclude a requirement of Clauses 4 to 10 (Clause 1). These are requirements of the standard, not of law (ISO/IEC 27001 and EU law).
The Introduction (0.1) tells you that the use of an ISMS is a strategic decision of an organization. The ISMS keeps the confidentiality, integrity, and availability of information through a risk management process. It also helps interested parties to be sure that the risk management of the organization is sufficient. Internal and external groups can use the standard to examine if the organization can conform to its information security requirements.
For the organization, top management, and the other persons and groups in the clauses, see Clauses 4 to 10.
Structure of the standard
ISO/IEC 27001:2022 has a Foreword, an Introduction, 10 clauses, one normative annex, and a bibliography. Clauses 4 to 10 contain the requirements for the ISMS.
| Part | Contents | Page |
|---|---|---|
| Foreword and Introduction (0.1, 0.2) | The edition and its primary change, the function of an ISMS, and compatibility with other management system standards (0.2) | This page |
| Clauses 1 to 3 | The scope of the standard, the normative reference, and the terms and definitions of ISO/IEC 27000 | This page |
| Clauses 4 to 10 | The requirements of the ISMS, from 4 Context of the organization to 10 Improvement. The scope of the ISMS is in 4.3, and the Statement of Applicability is in 6.1.3 d) | Clauses 4 to 10, The scope of the ISMS, The Statement of Applicability |
| Annex A (normative), "Information security controls reference" | Table A.1 with 93 controls in four themes: organizational controls (A.5, 37), people controls (A.6, 8), physical controls (A.7, 14), and technological controls (A.8, 34). The organization uses them through risk treatment (6.1.3) | Annex A |
| Bibliography | Other standards, for example ISO/IEC 27002:2022 and ISO 31000:2018 | None |
Use with ISO/IEC 42001 and ISO/IEC 27701
ISO/IEC 27001 uses the harmonized structure of management system standards (Foreword). For this structure, the Introduction (0.2) refers to Annex SL of the ISO/IEC Directives. Annex SL gives the same clause names and the same text, with "common terms" and "core definitions". Thus ISO/IEC 27001 keeps compatibility with other management system standards that use this structure (0.2).
ISO/IEC 42001:2023 gives requirements for an AI management system (AIMS). ISO/IEC 27701:2025, the second edition of October 2025, gives requirements for a privacy information management system (PIMS). Its Foreword tells you that it is a "stand-alone" management system standard, and ISO/IEC 27001 is not one of its normative references (Clause 2). The two standards use the same structure of Clauses 4 to 10 as ISO/IEC 27001. But each has requirements that ISO/IEC 27001 does not have, for example:
- ISO/IEC 42001 adds the AI system impact assessment (6.1.4, 8.4). In its Clause 4.1, the organization also determines its roles for its AI systems.
- In ISO/IEC 27701:2025, Clause 4.1 adds a requirement to determine if the organization is a PII controller (or a joint PII controller) or a PII processor.
An organization can operate one management system for two or more management system standards, if the system conforms to the requirements of each standard (0.2). For the items of Clause 9 that only ISO/IEC 27001 has, see Clause 9.
ISO/IEC 27001 and ISO/IEC 42001 do not make each other necessary (ISO/IEC 27001 and ISO/IEC 42001). To compare the two standards, see ISO 42001 and ISO 27001. For ISO/IEC 27701, see the ISO/IEC 27701 pages. In Modulos, each standard has different Frameworks (Other management system standards in Modulos).
Certification
ISO/IEC 27001 sets no certification procedure and no time to certification, and certification is optional. A certification body with an accreditation that includes ISO/IEC 27001 audits the ISMS, and then it can certify the ISMS. ISO/IEC 27006-1:2024 gives more requirements for these certification bodies. For the general audit cycle of management system certification, with Stage 1 and Stage 2, surveillance audits, and recertification audits, see The certification audit cycle.
ISO/IEC 27001 and EU law
The EU AI Act, the NIS2 Directive, and the GDPR do not make ISO/IEC 27001 or its certification necessary.
| Law | Related text | More information |
|---|---|---|
| NIS2 Directive, Directive (EU) 2022/2555, Article 21(1) (a binding provision) | Article 21(1) is about the cybersecurity risk-management measures of "essential and important entities". These measures must give a level of security "appropriate to the risks posed", "Taking into account the state-of-the-art and, where applicable, relevant European and international standards, as well as the cost of implementation". | NIS2 Cybersecurity Measures (Article 21(2)) and NIS2 Incident Reporting (Article 23) |
| NIS2 Directive, recital (79) (a recital is not binding) | The cybersecurity risk-management measures "should therefore also address the physical and environmental security of network and information systems", "in line with European and international standards, such as those included in the ISO/IEC 27000 series". | NIS2 Cybersecurity Measures |
| GDPR, Regulation (EU) 2016/679 | The GDPR does not name ISO/IEC 27001. | GDPR Controller Obligations and Breach Notification (Articles 32 and 33) |
| EU AI Act, Regulation (EU) 2024/1689 | The EU AI Act does not name ISO/IEC 27001. It has different obligations, persons, and dates, for example the cybersecurity of high-risk AI systems (Article 15(5)) and reports of serious incidents (Article 73). Conformity with an Annex A control is not conformity with such an obligation. | ISO/IEC 27001 and the EU AI Act |
NIS2 is a directive. Article 5 lets a Member State make or keep provisions "ensuring a higher level of cybersecurity", if these provisions agree with its obligations in Union law. If the organization is in the scope of NIS2, check the law of each Member State that has jurisdiction for the organization (Article 26).
ISO/IEC 27001 in Modulos
Modulos gives ISO/IEC 27001 as two Frameworks: OFF-9 at the Organization level and MFF-9 at the AI System level. The page Operationalizing in Modulos gives the set-up, the Requirement table, and the steps.
Where to go next
ISMS scope, Statement of Applicability, and certification
The scope of the ISMS, the contents of the Statement of Applicability, and the certification audit cycle.
Clauses 4 to 10
The requirements of Clauses 4 to 10, with their persons, intervals, and documented information.
Annex A
The 93 controls in four themes, and how the organization uses them through risk treatment.
Integration with AI governance
ISO/IEC 27001 and ISO/IEC 42001, the Annex A controls for AI, and the EU AI Act.
Operationalizing in Modulos
The Frameworks OFF-9 and MFF-9, the steps, and the Requirement table.
ISO 42001 vs ISO 27001
The two management system standards, side by side.
Control overlap
The Controls that two or more Modulos Frameworks use.
Frequently asked questions about ISO/IEC 27001
See Frequently asked questions about ISO/IEC 27001 for each FAQ and its full rule.
Sources of this page
- ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements", third edition, October 2022 (ISO catalog page). Parts used:
- the table of contents, the Foreword, the Introduction (0.1, 0.2), and Clauses 1 to 3
- the clause names of Clauses 4 to 10, and 4.3, 6.1.3, 8.2, 8.3, 9.2.1, and 9.3.1
- Annex A with Table A.1, and the Bibliography.
- ISO/IEC 27001:2022/Amd 1:2024, "Climate action changes", February 2024 (ISO catalog page).
- IAF/ISO Joint Communiqué, "IAF/ISO Joint Communiqué on the addition of Climate Change considerations to Management Systems Standards", 22 February 2024: section 2.1 and the table of standards (IAF).
- ISO/IEC 27002:2022, third edition, February 2022 (ISO catalog page).
- ISO/IEC 27006-1:2024, first edition, March 2024 (ISO catalog page).
- ISO/IEC 42001:2023, first edition, December 2023: Clause 2, 4.1, 6.1.3 f), 6.1.4, 8.4, 9.2.1, and Annex A (normative).
- ISO/IEC 27701:2025, second edition, October 2025: the first page, the Foreword, Clause 2, and 4.1.
- IAF MD 5:2023, "Determination of Audit Time of Quality, Environmental, and Occupational Health & Safety Management Systems", of 14 June 2023: clauses 0.1, 0.3, 5, and 6 (IAF).
- NIS2 Directive, Directive (EU) 2022/2555: Articles 5, 21(1), and 26, and recital (79) (EUR-Lex).
- EU AI Act, Regulation (EU) 2024/1689, consolidated version of 27 July 2026: Articles 15(5) and 73 (EUR-Lex).
- GDPR, Regulation (EU) 2016/679: Articles 32 and 33.
Disclaimer
This page gives general information and is not legal advice. It does not replace the audit of a certification body.