ISO 27001:2022 for CISOs: what changed and how to get certified
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It doesn't prescribe technology. It defines how to run security as a management process: understand your context, assess risk, choose controls, measure, and improve. For many B2B companies it has become the price of admission to enterprise deals and public tenders.
How the standard is structured
- Clauses 4–10: the management system. Context, leadership, planning (risk assessment and treatment), support, operation, performance evaluation (internal audit and management review) and improvement. All of these are mandatory.
- Annex A: the control catalogue. You select controls based on your risks and justify every inclusion and exclusion in the Statement of Applicability (SoA).
What changed in the 2022 revision
Annex A went from 114 to 93 controls, regrouped into four themes:
| Theme | Controls |
|---|---|
| Organizational | 37 |
| People | 8 |
| Physical | 14 |
| Technological | 34 |
There are 11 new controls: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
The transition period for ISO 27001:2013 certificates ended on 31 October 2025. A 2024 amendment also asks organizations to consider whether climate change is a relevant issue when defining their context.
A realistic certification roadmap
- Define the scope: which services, sites and teams. A tight, well-defined scope is the fastest path.
- Gap analysis against the clauses and Annex A.
- Risk assessment and treatment plan: a documented method, a risk register with owners, and an approved treatment plan.
- Statement of Applicability covering all 93 controls.
- Policies and procedures that reflect how you actually work.
- Implement and collect evidence: auditors ask for proof, not intentions.
- Internal audit and management review: both are required before certification.
- Certification audit: Stage 1 reviews documentation, Stage 2 reviews implementation.
- Keep it alive: annual surveillance audits and recertification every three years.
For a mid-sized organization, 6–12 months from kickoff to certificate is typical.
Common mistakes
- Treating it as an IT project. Without leadership, HR, procurement and legal, you will struggle in the audit.
- Template policies. Auditors ask how a policy is applied, and generic documents are spotted quickly.
- Scope creep. Start with your core service and expand later.
- Audit-only ISMS. If the system only comes alive before audits, it won't reduce risk and won't survive surveillance audits.
Quick readiness checklist
- Scope defined and approved by leadership
- Risk methodology and a current risk register
- SoA covering all 93 controls
- Signed information security policy, communicated to staff
- Documented awareness training
- Internal audit and management review completed
- Accredited certification body selected
This guide is general information. The normative text is the standard itself, available from ISO and national standards bodies.