ISO/IEC 27001:2022 (information security management systems), explained

ISO/IEC 27001:2022, "Information security, cybersecurity and privacy protection — Information security management systems — Requirements," is the third edition of ISO/IEC's certifiable standard for an information security management system (ISMS), published 25 October 2022 by ISO/IEC JTC 1/SC 27 and carrying ICS codes 35.030 and 03.100.70. It superseded the second edition, ISO/IEC 27001:2013, which ISO's own catalogue marks as withdrawn on the same date — 2022-10-25 — alongside that edition's two corrigenda. ISO's committee page lists the current edition at 19 pages and CHF 155 through the ISO and IEC webstores; ISO/IEC 27001 is copyrighted and must be purchased from ISO, a national member body (e.g. BSI in the UK, ANSI in the US) or an authorized reseller — no free full-text mirror is authorized, so this guide summarizes publicly available catalogue and committee information rather than quoting the standard's operative text at length. ISO/IEC 27001:2022 also has one published amendment, Amendment 1:2024 ("climate action changes"), per ISO's own catalogue — a change applied across ISO's management-system-standard portfolio from 2024, not specific to information security.

ISO/IEC 27001 follows the Harmonized Structure (formerly called "Annex SL") that ISO's own Technical Management Board Joint Technical Coordination Group mandates for all ISO/IEC management system standards, to keep their core clause numbering and terminology consistent. Per the governing ISO/TMBG communiqué, this structure "defines the terminology, high-level structure (HLS) and core text to enhance the consistency of ISO's and IEC's portfolio of management system standards" and "does form the basis for harmonization of over 40 individual management system standards." In ISO/IEC 27001:2022 this yields seven requirements clauses: 4 Context of the organization, 5 Leadership, 6 Planning, 7 Support, 8 Operation, 9 Performance evaluation, and 10 Improvement — the same clause skeleton used by ISO 9001 (quality) and ISO 14001 (environmental management), which is why an organization already certified to one can typically integrate a second ISO management system without rebuilding its documentation structure from scratch.

Annex A lists the controls an ISMS can select from (via the standard's Statement of Applicability process) to treat identified risks; it does not describe each control in implementation detail — that full guidance lives in the companion standard ISO/IEC 27002:2022. Per UKAS (the UK's national accreditation body), ISO/IEC 27001:2022's "Annex A has been aligned with the controls defined in ISO/IEC 27002:2022, which contains 93 controls (11 of which are new) organised in 4 themes," and notes that "in addition to the 11 new controls, 24 have been merged and 58 have been updated" relative to the prior control set. ISO/IEC 27002:2022's own clause numbering lays out those 93 controls across four ranges: 5.1-5.37 (Organizational controls, 37), 6.1-6.8 (People controls, 8), 7.1-7.14 (Physical controls, 14) and 8.1-8.34 (Technological controls, 34). The prior, 2013-based control set is widely reported (though not confirmed against a fetchable ISO/UKAS/BSI page in this guide's research) as having organized 114 controls into 14 clauses — treat that specific comparison as a commonly cited secondary figure rather than a directly quoted ISO statement.

ISO/IEC 27002:2022 ("Information security, cybersecurity and privacy protection — Information security controls") was published first, in February 2022, roughly eight months ahead of ISO/IEC 27001:2022 in October 2022. ISO's own scope statement for 27002 says it "provides a reference set of generic information security controls including implementation guidance" designed for use "within the context of an information security management system (ISMS) based on ISO/IEC 27001" — in practice, 27001's Annex A gives only the control titles grouped by theme, while 27002 carries the full Control/Purpose/Guidance text an organization implements against. Certification itself is performed by accredited, independent certification bodies rather than by ISO: per the UK Accreditation Service (UKAS), "certification is the third-party confirmation via audit of an organisation's systems or products, whilst accreditation is independent third-party recognition that an organisation has the competence and impartiality to perform specific technical activities such as certification" — summarized as accreditation bodies "check the checkers." The typical cycle, reflected in accreditation-body guidance, is a two-stage initial audit, a certificate valid for three years, surveillance audits in years one and two, and a recertification audit in year three. Note for anyone tracking the accreditation landscape as of this guide's 2026 publication: the International Accreditation Forum (IAF) ceased independent operation on 1 January 2026, merging with ILAC into the Global Accreditation Cooperation Incorporated (Global ACI) — current certification-cycle guidance should be checked against Global ACI rather than the now-archival IAF.

Not as a named, binding mechanism in either law's own operative text, based on this guide's research. The Cyber Resilience Act's conformity-presumption mechanism (Article 27) runs through harmonised standards published in the EU Official Journal, which have not been adopted for the CRA as of this guide's research, and the CRA's own text does not name ISO/IEC 27001. ENISA has published an unofficial analytical mapping of CRA requirements against existing standards that includes ISO/IEC 27001:2022, but explicitly cautions that it found "no single standard that can, alone, satisfy all requirements listed" in the CRA's Annex I, flagging for ISO/IEC 27001 specifically that it "does not cover specific technical measures for defence in depth, encryption at rest, or sandboxing." NIS2's operative articles (e.g. Article 21) use only generic language encouraging "the use of European and international standards," without naming ISO/IEC 27001; a non-binding recital (Recital 79) does cite "European and international standards, such as those included in the ISO/IEC 27000 series" as illustrative. ENISA has separately published technical implementation guidance mapping NIS2's risk-management measures to ISO/IEC 27001:2022 and 27002:2022, while stating the mapping "should not be interpreted as a measure of equivalency." In the UK, energy-sector guidance from Ofgem (the NIS Regulations competent authority for that sector) names ISO 27001 as an example "output-based framework" operators may map against the NCSC Cyber Assessment Framework — useful context for an OT/energy audience, though it is sector guidance, not a certification mandate. Treat any claim that ISO/IEC 27001 certification alone satisfies CRA or NIS2 obligations as unconfirmed, and verify against the specific regulator or notified body involved.