Frequently asked questions about ISO/IEC 27001

From each FAQ, you can go to the page section with the full rule.

Disclaimer

This page gives general information. It is not legal advice.

What is ISO/IEC 27001:2022?

ISO/IEC 27001:2022, short name "ISO 27001", is an International Standard of ISO and IEC with requirements for an information security management system (ISMS). The third edition is of October 2022, and Amendment 1:2024 applies to it. The standard is voluntary, but an organization that claims conformity cannot exclude a requirement of Clauses 4 to 10 (Clause 1). The normative Annex A applies through information security risk treatment (6.1.3). See Structure of the standard.

Is ISO 27001 mandatory?

No. ISO/IEC 27001 is voluntary, and the EU AI Act, NIS2 Directive, and GDPR do not make the standard or certification necessary. An organization that claims conformity must conform to each requirement of Clauses 4 to 10 (Clause 1).

NIS2 has these other points:

• Article 21(1): "where applicable, relevant European and international standards".
• Recital (79): "the ISO/IEC 27000 series" for physical and environmental security, as an example, not a binding rule.
• Article 5: a Member State can set provisions "ensuring a higher level of cybersecurity", if these provisions agree with its obligations in Union law.
• Article 26: organizations in scope check the law of each Member State with jurisdiction.

See ISO/IEC 27001 and EU law.

What changed in ISO 27001:2022 compared with the 2013 edition?

The 2022 third edition replaces ISO/IEC 27001:2013 and includes its two technical corrigenda. The ISO catalog page shows the 2013 edition as withdrawn. The Foreword gives one primary change: the text agrees with ISO/IEC 27002:2022 and the harmonized structure of management system standards. Annex A has 93 controls in four themes, and Table A.1 does not identify new controls. Amendment 1:2024, "Climate action changes", applies to the 2022 edition. See The standard and its edition.

Is the Statement of Applicability mandatory in ISO 27001?

Yes. ISO/IEC 27001 Clause 6.1.3 d) requires the organization to make a Statement of Applicability as part of information security risk treatment. It gives the necessary controls, the justification for their inclusion, if the organization implements each necessary control, and the justification for each Annex A exclusion. A conformity claim cannot exclude this requirement or a different requirement of Clauses 4 to 10 (Clause 1). See The Statement of Applicability.

Do you have to implement all 93 Annex A controls?

No. The organization implements the controls that its risk treatment makes necessary (ISO/IEC 27001, 6.1.3). Controls can come from other sources and can include controls that Annex A does not contain (NOTEs 1 and 3). The organization must compare them with the normative Annex A to make sure that no necessary control is missing (6.1.3 c).

The Statement of Applicability must give justification for each Annex A control exclusion, also when the organization excludes a full theme (6.1.3 d). Physical controls can apply to organizations that use only cloud services. Clauses 4 to 10 cannot be excluded from a conformity claim (Clause 1). See Risk treatment and Justification for each exclusion.

How does ISO 27001 certification work?

A certification body with an accreditation that includes ISO/IEC 27001 audits the ISMS of the organization, and then it can certify the ISMS. ISO/IEC 27001 sets no certification procedure, and certification is optional. ISO/IEC 27006-1:2024 gives more requirements for certification bodies that audit and certify an ISMS. For the general management system audit cycle, see The certification audit cycle.

How long does ISO 27001 certification take?

ISO/IEC 27001 sets no time to certification and no minimum period of operation before an audit. The organization must do internal audits at planned intervals (9.2.1), and top management must review the ISMS at planned intervals (9.3.1). The organization sets these intervals, and the certification body sets the time of its audits. See The certification audit cycle.

What is the difference between ISO 27001 and ISO 42001?

ISO/IEC 27001 gives ISMS requirements, and ISO/IEC 42001 gives AI management system requirements. One standard does not require the other. Their harmonized structure lets the organization use one management system, but each standard keeps its requirements:

• Each has a normative Annex A and requires a statement of applicability (6.1.3 d) and 6.1.3 f)). Only ISO/IEC 27001 requires the Statement of Applicability to show if the organization implements each necessary control.
• ISO/IEC 42001 requires an AI system impact assessment (6.1.4, 8.4).
• One internal audit for the two standards must give information on conformity with each standard (9.2.1).
• Top management must review each management system (9.3.1).

See ISO/IEC 27001 and ISO/IEC 42001.

How does Modulos support ISO 27001?

Modulos gives ISO/IEC 27001 as two Frameworks with the name ISO 27001: OFF-9 for the Organization and MFF-9 for AI Systems. OFF-9 holds Clauses 4 to 10 without 8.2 and 8.3. MFF-9 holds 8.2, 8.3, and the four Annex A themes. Modulos recommends it for each AI System in the scope of the ISMS. Clauses 8.2 and 8.3 and the Annex A themes have no Requirement if you use only OFF-9.

Clauses 8.2 and 8.3 apply to the full ISMS. MFF-9 does not replace the decisions of the organization about necessary controls and its Statement of Applicability (6.1.3). Certification is not in the Frameworks. See The Requirements and Recommended AI System structure.

What must the ISO 27001 ISMS scope cover?

The organization determines the boundaries and applicability of its ISMS to set its scope (ISO/IEC 27001, 4.3). It must consider external and internal issues (4.1), interested parties' requirements (4.2), and interfaces and dependencies between its work and other organizations' work. The scope must be available as documented information. Clause 4.3 does not require the scope to name functions, locations, or assets. There is one ISMS for the organization, not one scope for each AI system. See The scope of the ISMS.

What must the ISO 27001 Statement of Applicability contain?

ISO/IEC 27001 Clause 6.1.3 d) requires four items: necessary controls, justification for inclusion, if the organization implements each necessary control, and justification for each Annex A exclusion. Necessary controls can come from Annex A or other sources. The organization makes the Statement of Applicability in its risk treatment process after the risk assessment. Other data, such as the function that operates a control or a value of "planned", is optional. See The Statement of Applicability.

Does the Statement of Applicability list every Annex A control?

Yes, each Annex A control is necessary or has a justification for its exclusion in the Statement of Applicability (ISO/IEC 27001, 6.1.3 d). A control is not necessary only because it is in Annex A. The organization determines controls for its risk treatment options, then compares them with Annex A to make sure that no necessary control is missing (6.1.3 c). Annex A is not complete, and the Statement of Applicability can include controls from other sources (NOTEs 1 and 3). See The Statement of Applicability.

What is the difference between a Stage 1 and a Stage 2 audit?

Stage 1 and Stage 2 are the two parts of the initial certification audit by a certification body (IAF MD 5:2023). ISO/IEC 27001 does not define these parts and sets no certification procedure. IAF MD 5 names Stage 1 and Stage 2 to calculate audit time for quality, environmental, and occupational health and safety management systems. ISO/IEC 27006-1:2024 gives requirements for ISMS certification bodies that add to ISO/IEC 17021-1. Speak to your certification body to get its audit plan for each part. See The certification audit cycle.

How often are ISO 27001 surveillance audits?

IAF MD 5:2023 gives surveillance audit time each year during the initial three-year management system certification cycle, then a recertification audit. Its scope is quality, environmental, and occupational health and safety management systems. ISO/IEC 27001 sets no certification cycle or audit dates. ISO/IEC 27006-1:2024 gives more requirements for ISMS certification bodies, with ISO/IEC 17021-1.

Speak to the certification body to get its surveillance audit plan. Surveillance audits are not the organization's internal audits at planned intervals (9.2.1). See The certification audit cycle.

What do ISO 27001 Clauses 4 to 10 require?

ISO/IEC 27001 Clauses 4 to 10 give the ISMS requirements. A conformity claim cannot exclude one of them (Clause 1). Annex A controls apply through risk treatment, with justification for each exclusion (6.1.3). The clause sequence sets no implementation sequence (Introduction 0.1):

• Clause 4: issues, interested parties, scope, ISMS.
• Clause 5: top management, policy, roles.
• Clause 6: risks and opportunities, risk assessment and risk treatment, Statement of Applicability, objectives, planned changes.
• Clause 7: resources, competence, awareness, communication, documented information.
• Clause 8: operational planning and control, risk assessment and risk treatment.
• Clause 9: monitoring, measurement, internal audit, management review.
• Clause 10: continual improvement, nonconformity, corrective action.

What documented information does ISO 27001 require?

ISO/IEC 27001 requires the documented information in Clauses 4 to 10 and the information that the organization determines is necessary for ISMS effectiveness (7.5.1). The quantity can be different for each organization. Items include:

• Scope (4.3), policy (5.2), risk processes and Statement of Applicability (6.1.2, 6.1.3), objectives (6.2), competence (7.2).
• Information "to the extent necessary" to show processes occurred as "planned" (8.1).
• Risk assessment and risk treatment results (8.2, 8.3), monitoring and measurement results (9.1).
• Evidence of audit program implementation and results (9.2.2), review results (9.3.3), nonconformities, actions, and corrective-action results (10.2).
• Annex A documented information where a control is necessary, for example A.5.31 and A.5.37.

See Documented information in Clauses 4 to 10.

How often does ISO 27001 require a risk assessment?

ISO/IEC 27001 sets no period. The organization must assess information security risks at planned intervals and when a significant change is "proposed" or occurs (8.2). It must use the criteria of 6.1.2 a) and retain the results as documented information. Internal audits and management reviews also occur at planned intervals that the organization sets (9.2.1, 9.3.1). Risk assessment results are a management review input (9.3.2 f). See When to do the risk assessments, audits, and reviews again.

Who approves the ISO 27001 risk treatment plan?

The risk owners give approval for the ISO/IEC 27001 risk treatment plan and accept the residual information security risks (6.1.3 f). The risk assessment process identifies the risk owners (6.1.2 c). The organization must get their approval and acceptance, then implement the plan and retain the risk treatment results as documented information (8.3). See Clause 6 — Planning.

What must an ISO 27001 management review cover?

Top management must review the ISO/IEC 27001 ISMS at planned intervals for continued suitability, adequacy, and effectiveness (9.3.1). The required inputs (9.3.2) are:

• Previous actions' "status" (a).
• Changes in "relevant" issues (b) and interested parties' needs and expectations (c).
• Performance feedback: trends in nonconformities, corrective actions, monitoring, measurement, audit results, and objectives' "fulfilment" (d).
• Interested parties' feedback (e).
• Risk assessment results and risk treatment plan "status" (f).
• Continual improvement opportunities (g).

Results must include decisions on continual improvement opportunities and necessary ISMS changes, with documented information available as evidence (9.3.3). See Clause 9 — Performance evaluation.

How many controls are in ISO/IEC 27001:2022 Annex A?

ISO/IEC 27001:2022 Annex A has 93 controls: 37 organizational (A.5), 8 people (A.6), 14 physical (A.7), and 34 technological controls (A.8). Annex A is normative, but it is not necessary for the organization to implement all 93 controls. It compares the necessary controls for its risk treatment with Annex A and gives justification for each exclusion in its Statement of Applicability (6.1.3). See The four themes.

Is ISO 27001 Annex A normative or informative?

ISO/IEC 27001 Annex A is normative, but this does not make each control necessary. The organization determines the controls for its risk treatment options and compares them with Annex A to make sure that no necessary control is missing (6.1.3 b and c). It can make controls or use other sources, because Annex A is not complete (NOTEs 1 and 3). Each Annex A exclusion requires justification in the Statement of Applicability (6.1.3 d). ISO/IEC 42001 Annex A is also normative. See How Annex A applies through risk treatment.

What are the four themes of ISO 27001 Annex A?

The ISO/IEC 27001 Annex A themes are organizational (A.5, 37 controls), people (A.6, 8), physical (A.7, 14), and technological (A.8, 34). Examples are policies and supplier relationships (A.5), training and remote working (A.6), equipment and storage media (A.7), and cryptography and secure development (A.8). Access control, identity management, authentication information, and access rights (A.5.15 to A.5.18) are organizational controls. See The four themes for the controls in each theme.

How does ISO 27001 Annex A relate to ISO/IEC 27002?

ISO/IEC 27001:2022 Annex A controls come directly from ISO/IEC 27002:2022, Clauses 5 to 8, and are aligned with that standard. ISO/IEC 27002 gives guidance and “best practices”, while ISO/IEC 27001 gives requirements. Organizations can get certification to ISO/IEC 27001, but cannot get certification to ISO/IEC 27002. See Annex A and ISO/IEC 27002:2022.

How should I set up AI Systems for ISO 27001 in Modulos?

Modulos recommends OFF-9 on the organization AI System and MFF-9 on each AI System in the ISMS scope. Determine the scope first (ISO/IEC 27001, 4.3). The standard has one ISMS for the organization. The two levels are the Modulos structure.

MFF-9 applies the organization's risk treatment and Statement of Applicability to one AI System, but does not replace its decisions about necessary controls (6.1.3). If your organization has no organization AI System, contact Modulos support before you add OFF-9. See Recommended AI System structure.

Where is the Statement of Applicability in Modulos?

ORF-205 (Information security risk treatment) in OFF-9 is the Requirement for ISO/IEC 27001 Clause 6.1.3, with the Statement of Applicability in 6.1.3 d). The organization makes the Statement of Applicability. It gives necessary controls, justification for inclusion, if the organization implements each necessary control, and justification for each Annex A exclusion. Necessary controls can come from Annex A or other sources. See The Requirements and The Statement of Applicability.

What does ISO 27001 in Modulos not cover?

OFF-9 and MFF-9 have no Requirement for certification. They also have no Requirement that is only for controls from sources other than Annex A. Certification is optional. ISO/IEC 27001 sets no certification procedure. You select the certification body, which does the certification audits.

The organization can make controls or use other sources (6.1.3 NOTE 1). Its Statement of Applicability includes all necessary controls (6.1.3 d, ORF-205). MFF-9 theme Requirements are for Annex A only. See Items with no Control.

If you use only OFF-9, 8.2 and 8.3 have no Requirement. These clauses require risk assessment and risk treatment also for risks that are not related to one AI System. See Recommended AI System structure.

Can I use ISO 27001 with ISO 42001 and ISO 27701 in Modulos?

Yes. Modulos has different Frameworks for ISO/IEC 42001 (OFF-10, MFF-10) and ISO/IEC 27701 (OFF-12, MFF-13). Each Organization Framework attaches to the organization AI System. One management system can follow two or more standards, but must conform to each standard's requirements (ISO/IEC 27001, Introduction 0.2). The ISO/IEC 27001 internal audit must give information on conformity with that standard (9.2.1), and top management must review the ISMS (9.3.1). See Other management system standards in Modulos and Control overlap.

Does ISO 27001 cover AI systems?

An AI system's information is in the ISO/IEC 27001 ISMS only if it is in the scope that the organization determines (4.3). The standard has no requirement special to AI systems. Its risk assessment identifies risks to information in scope (6.1.2 c). The ISMS keeps confidentiality, integrity, and availability through risk management (Introduction 0.1). There is one ISMS for the organization, not one for each AI system.

ISO/IEC 42001 is a different standard for an AI management system. See Information security of AI systems in an ISMS.

Should we get ISO 27001 before ISO 42001?

ISO/IEC 27001 and ISO/IEC 42001 do not require each other. The organization selects the sequence. ISO/IEC 42001 has only ISO/IEC 22989 as a normative reference (Clause 2). Informative Annex D.2 tells the organization that it can implement an ISMS in conformity with ISO/IEC 27001. This applies if it finds the same full method necessary for its information security objectives as for its AI management system.

The harmonized structure helps joint use, but each standard requires internal audit and management review (9.2.1, 9.3.1). Conformity with one does not show conformity with the other. See ISO/IEC 27001 and ISO/IEC 42001.

Does ISO 27001 cover EU AI Act requirements for high-risk AI systems?

No. The EU AI Act does not name ISO/IEC 27001 or ISO/IEC 42001. Its obligations are different for providers and deployers, with dates from which they apply:

• Articles 15(5) and 16(a): cybersecurity requirements, with measures against AI-specific attacks where "appropriate", and provider conformity obligations for Section 2 of Chapter III. Annex A does not name these attacks. See High-risk AI systems.
• Article 73(1): providers of "high-risk AI systems placed on the Union market" report serious incidents to market surveillance authorities of the Member States where the incident occurred. Article 73 sets time limits and different rules for some systems in (9) and (10). See Reports of serious incidents.

Annex A incident management does not replace these reports. See ISO/IEC 27001 and the EU AI Act.