ISO/IEC 27001:2022
ISO/IEC 27001 certification for information security
Independent certification of your information security management system against ISO/IEC 27001:2022.
- Valid for
- 3 years
- Surveillance
- Years 1 and 2
- Verification
- Public register
Accredited and empanelled
What is ISO 27001?
ISO/IEC 27001 specifies requirements for an information security management system (ISMS): a risk-based way of deciding which security controls an organisation needs, implementing them and keeping them effective. The certificate covers a defined scope, and the Statement of Applicability records which Annex A controls apply and why.
The current edition is ISO/IEC 27001:2022, amended in 2024 for climate change. Annex A was restructured into 93 controls in four themes, organisational, people, physical and technological, with new controls such as threat intelligence, information security for cloud services, data leakage prevention and secure coding. The transition period for certificates against the 2013 edition has ended.
For SaaS companies, data centres, BPO providers and fintechs, ISO 27001 is often the first item on a customer's security questionnaire. A certificate from an accredited body, verifiable in a public register, shortens that conversation.
Who it is for
- SaaS and cloud service providers
- IT services, managed services and BPO companies
- Banks, payment companies and fintechs
- Data centres and hosting providers
- Health technology firms and health data processors
- Suppliers handling government information
What sets audit time and cost
Most organisations reach a certification decision ten to sixteen weeks after application, often with a short gap between Stage 1 and Stage 2 to resolve documentation findings and build operating evidence.
- Number of people working within the ISMS scope
- Business and IT complexity, assessed under ISO/IEC 27006-1
- Number of sites, including data centres and remote working
- Extent of outsourcing to cloud and other suppliers
- Sensitivity of information handled, such as payment or health data
- Combined audits with ISO/IEC 27701 or ISO 22301
Why it matters
What ISO 27001 gives you
- 01
Shorter security reviews
An accredited certificate answers many customer due diligence questions in one document that the customer can verify independently.
- 02
Controls chosen by risk
Security spending follows an assessed risk picture rather than a checklist, and unused controls are excluded with a recorded reason.
- 03
Clear accountability
Named owners for risks and controls, with management review, make security a governed business process rather than an IT task.
- 04
Room to extend
ISO/IEC 27701 for privacy and ISO/IEC 42001 for AI build on the same management system and can be audited alongside it.
The audit
What our auditors examine
- 01
Scope and context
Whether the ISMS scope, its interfaces and its dependencies on suppliers are defined clearly and match what you tell customers.
- 02
Risk assessment and treatment
A repeatable method with defined criteria, identified risk owners and a treatment plan approved by them.
- 03
Statement of Applicability
How each Annex A control was included or excluded, and the trace back to risk treatment.
- 04
Controls in operation
Evidence that controls run: access reviews, supplier assessments, logging and monitoring, backups, vulnerability management, secure development and incident handling.
- 05
Performance evaluation
Measurement of security objectives, an internal audit programme and management reviews that act on the results.
- 06
Planning of changes
Changes to the ISMS planned and carried out in a controlled way, a requirement added in the 2022 edition.
How certification works
Every accredited certificate follows the same three-year cycle, with each step recorded and the result published in our register.
01
Application and quote
Tell us your scope, sites and headcount. We calculate audit time under the accreditation rules and send a fixed quote and audit plan.
02
Stage 1 audit
We review your documented management system, scope and readiness, and agree the Stage 2 plan. Any gaps are reported so you can close them first.
03
Stage 2 audit
Auditors check that the system works in practice: interviews, records and observation across the scope. Nonconformities are raised in writing.
04
Certification decision
Once corrective actions are accepted, a reviewer who did not take part in the audit makes the decision. Your certificate is issued and listed in the public register.
05
Surveillance audits
Shorter audits in the first and second years after certification confirm the system is maintained and improving. The register shows your current status throughout.
06
Recertification
Before the three-year certificate expires, a recertification audit reviews the whole system and renews the certificate for another cycle.
Related standards and audits
Often certified or audited alongside this one, sometimes in a single combined audit.
ISO certification
ISO 27701
Certification of how your organisation governs personal data, as a controller, a processor or both.
ISO certification
ISO 42001
Independent certification of how your organisation governs the development, provision and use of AI systems.
ISO certification
ISO 22301
Independent certification that your organisation can keep prioritised activities running, or restore them in time, after a disruption.
Security audits
VAPT
Vulnerability scanning followed by hands-on exploitation, so you know which weaknesses an attacker could use.
Security audits
IT security audit
An information security audit to CERT-In guidelines covering the systems you name, closed with a dated audit certificate.
Industries we audit for
SaaS and cloud
Independent evidence that answers enterprise security reviews and keeps sales moving.
Banking and fintech
Audits and certifications that support the security evidence regulators, partner banks and payment networks ask for.
Healthcare and life sciences
Quality and information security certification for organisations where patient safety and patient data both matter.
Government and public sector
CERT-In empanelled audits and accredited certification for departments, public sector undertakings and their suppliers.
Guides
5 min read
ISO/IEC 27001:2022: what changed and how audits treat it
The 2022 edition reorganised Annex A into 93 controls across four themes and tightened several clauses. This guide sets out what changed, what auditors look for and how to close the gaps in a sensible order.
5 min read
Preparing for stage 1 and stage 2 certification audits
Initial certification happens in two stages: a readiness review and a full assessment of how the system works. Here is what each stage covers and how to prepare without overbuilding.
5 min read
Integrated management system audits
Organisations with more than one ISO certification can be audited against them together. This guide explains what an integrated audit shares, what still has to be assessed standard by standard, and how to prepare.
5 min read
Transferring your certification to a new certification body
You can move an accredited management system certification from one certification body to another without starting over. This guide explains who is eligible, what the pre-transfer review covers and what happens to your audit cycle.
5 min read
Surveillance and recertification: the three-year cycle
Certification is not a single event. This guide explains the three-year cycle, what each surveillance audit looks at, what puts a certificate at risk and how to plan recertification so it never lapses.
ISO 27001 questions
We audit; we do not consult.
To keep certification independent, we never design, build or fix the systems we audit, and decisions are made by people who did not take part in the audit. Read our impartiality policy.
Plan your ISO 27001 certification
Tell us your scope, sites and timeline. We reply with an audit plan and a fixed quote.