ISO 27001 requirements

The ISO/IEC 27001:2022 standard  sets out the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS). This page goes through every clause and explains what the standard asks of you.

Like other modern ISO management system standards, ISO 27001 follows the High Level Structure (HLS) . This means its structure is identical to that of ISO 9001 and ISO 14001. That makes it easier to combine several certifications.

The structure of ISO 27001: High Level Structure

The structure is based on the PDCA cycle:

The clauses of ISO 27001

ISO 27001 has ten clauses. Clauses 1 to 3 are introductory. The requirements you must meet are in clauses 4 to 10. The table below shows what each clause covers. We then discuss each clause in detail.

Below, we go through clauses 4 to 10 one by one.

Clause 4: Context of the organisation

Clause 4 asks you to understand your own organisation and its environment. Before you can decide how to protect information, you need to understand the context you operate in.

4.1 Understanding the organisation and its context

Every organisation operates in a unique context. ISO 27001 asks you to identify the internal and external factors that are relevant to your ISMS.

External factors are things outside your organisation that affect your information security. Think of laws and regulations such as the AVG  (Dutch General Data Protection Regulation), the threat landscape that keeps changing, the expectations of customers and partners, and technological developments. The NCSC  (Dutch National Cyber Security Centre) regularly publishes analyses of current threats that you can use as input.

Internal factors are characteristics of your own organisation: your company culture, your IT infrastructure, the skills of your staff, your organisational structure, and your strategic objectives. A start-up with ten developers has a different context from a hospital with thousands of employees.

In practice, you document this context in a short analysis. It does not need to be a long report. However, you must be able to show that you have considered these factors and that your ISMS reflects them.

4.2 Understanding interested parties and their needs

Information security affects many parties. ISO 27001 asks you to identify who your interested parties are and what they expect from you in terms of information security.

Typical interested parties are customers who expect their data to be managed securely, employees who expect their personal data to be protected, regulators who expect you to comply with laws and regulations, shareholders who value continuity and reputation, and partners who depend on the availability of your services.

For each interested party, you determine what requirements they have. These can be contractual requirements, legal requirements or implicit expectations. These requirements form input for your risk assessment and your security controls.

4.3 Determining the scope of the ISMS

The scope describes what your ISMS applies to: which parts of your organisation, which locations, which systems and processes are covered?

You can choose a broad scope that covers the whole organisation, or a narrower scope that focuses on specific activities or departments. Many organisations start with a limited scope, for example their cloud platform or their software development activities, and expand it later.

When you determine the scope, you must take into account the context and the requirements of interested parties. The scope must be logical and credible. You cannot arbitrarily exclude parts that are clearly relevant to the information security of what is in scope.

The scope must be documented and available. The auditor will use the scope as the starting point for the audit.

4.4 The ISMS

Finally, clause 4 requires you to actually establish, implement, maintain and continually improve an ISMS. This is the core of the standard: not just writing a policy, but having a working system that manages your information security in a structured way.

Clause 5: Leadership

Clause 5 focuses on the role of management. ISO 27001 makes clear that information security is not an IT matter that you can hand over to the IT department. It requires active involvement from the top.

5.1 Leadership and commitment

Top management must show leadership and commitment. This does not only mean signing the information security policy. It means being genuinely involved in the ISMS.

Specifically, the standard requires that management ensures the necessary resources are available, that information security objectives are set and integrated into business processes, that the ISMS achieves its intended results, and that employees are encouraged to contribute to the effectiveness of the ISMS.

During the audit, the auditor will ask about management involvement. This can be shown, for example, by minutes of management decisions on information security, the allocation of budget and staff, and active participation in the management review.

5.2 Information security policy

Top management must establish an information security policy. This policy sets out the intentions and direction of the organisation for information security.

The policy must be suitable for the organisation and its context, provide a framework for setting objectives, include a commitment to meet applicable requirements, and include a commitment to continually improve the ISMS.

The policy must be communicated to employees and, where appropriate, to other interested parties. It must be available as documented information.

An information security policy does not have to be a long document. One or two pages is often enough, as long as it captures the essentials. More important than length is that the policy genuinely reflects the organisation’s vision, and is not a standard text copied from the internet.

5.3 Roles, responsibilities and authorities

Top management must ensure that responsibilities and authorities for relevant roles are assigned and communicated.

Specifically, someone must be responsible for ensuring the ISMS conforms to the requirements of the standard, and for reporting on the performance of the ISMS to top management. This does not have to be a full-time role, but it must be clear who does it.

In practice, many organisations appoint an Information Security Officer (ISO) or Chief Information Security Officer (CISO). In smaller organisations, this role can be combined with other functions.

Clause 6: Planning

Clause 6 looks ahead. What risks and opportunities are there, what do we want to achieve, and how do we handle changes?

6.1 Actions to address risks and opportunities

This is one of the most distinctive parts of ISO 27001. The standard requires a formal information security risk assessment.

You must carry out a risk assessment that treats the confidentiality, integrity and availability of information as its starting point. This assessment must be repeatable and produce consistent results.

The process includes identifying risks, analysing their likelihood and impact, evaluating risks to decide which treatment is needed, and selecting suitable treatment options. Treatment options are: reduce the risk by taking controls, accept the risk, transfer the risk (for example through insurance), or avoid the risk by stopping the activity.

The risk assessment must be documented, and the results must be accepted by the risk owners. These are the people in the organisation who are responsible for the relevant assets or processes.

ISO 27005  provides detailed guidance on risk management within the context of ISO 27001. Other methods can also be used, such as OCTAVE, FAIR, or the risk method of the NCSC .

6.1.3 Risk treatment and the Statement of Applicability

For each risk you want to reduce, you must select security controls. Annex A of ISO 27001 contains a reference list of 93 security controls, organised into four categories: organisational, people, physical and technological controls.

You are not required to implement all 93 controls. However, for each control you must justify why you do or do not apply it. You record this in the Statement of Applicability (SoA), a mandatory document that is unique to ISO 27001.

The SoA contains an overview of all Annex A controls. For each control, it states whether it has been selected, the justification for including or excluding it, and its implementation status. The SoA is an important document for the auditor. It shows how you have interpreted the standard.

Read more about the security controls on the Annex A page, and about writing the Statement of Applicability.

6.2 Information security objectives and plans to achieve them

You must set information security objectives. These objectives must be consistent with the information security policy, be measurable (where practical), take into account the security requirements and the results of the risk assessment, and be monitored and communicated.

Examples of objectives are: achieving a certain percentage of security awareness among employees, reducing the number of security incidents, achieving a set uptime for critical systems, or resolving vulnerabilities within a set time.

For each objective, you must plan what will be done, which resources are needed, who is responsible, when it must be completed, and how the results will be evaluated.

6.3 Planning of changes

When you make changes to the ISMS, this must happen in a planned way. Ad hoc changes without oversight lead to inconsistencies and vulnerabilities.

Clause 7: Support

Clause 7 covers the supporting elements needed for an effective ISMS: resources, competence, awareness, communication and documented information.

7.1 Resources

The organisation must provide the resources needed for the ISMS. This includes financial resources, but also people, technology and infrastructure.

7.2 Competence

Employees whose work affects information security performance must be competent. The organisation must determine which competences are needed, ensure that employees have those competences (through education, training or experience), and keep evidence of their competence. The competence matrix with example shows how you can keep track of this.

This applies not only to security specialists, but to anyone whose work has an impact on information security, from developers to system administrators, and from management to end users.

7.3 Awareness

All relevant employees must be aware of the information security policy, their contribution to the effectiveness of the ISMS, and the consequences of not meeting the requirements.

Security awareness training is an important part of this. It can range from periodic e-learning modules to workshops, and from phishing simulations to posters and newsletters. The aim is for information security to become part of the culture, not just a set of rules.

7.4 Communication

You must decide what is communicated internally and externally about the ISMS, when, to whom and how. This covers both routine communication (such as awareness updates) and communication about incidents.

7.5 Documented information

ISO 27001 requires specific documented information. This includes documents that the standard explicitly requires, such as the scope, the policy, the risk assessment, the SoA and the objectives. You must also keep records that provide evidence that processes are followed and results are achieved.

Documentation must be controlled: you must ensure version control, approval procedures, availability for those who need it, and protection against unauthorised changes.

The standard does not prescribe how you document. A wiki, a SharePoint, a GRC tool, or even a well-organised folder structure can meet the requirements, as long as the information is findable, up to date and controlled.

Clause 8: Operation

Clause 8 covers actually carrying out what you have planned.

8.1 Operational planning and control

You must plan, implement and control the processes needed to meet the ISMS requirements and to carry out the actions arising from the risk assessment.

This means you do not only make plans. You also carry them out, document what you do, and check that it works as intended.

8.2 Carrying out the risk assessment

The risk assessment you planned in clause 6 must actually be carried out and documented. This is not a one-off exercise. You must repeat the assessment at planned intervals and whenever significant changes occur.

8.3 Implementing the risk treatment

The security controls you have selected must be implemented. The risk treatment plan must be carried out, and its progress must be documented.

Clause 9: Performance evaluation

Clause 9 focuses on measuring and evaluating whether your ISMS is effective.

9.1 Monitoring, measurement, analysis and evaluation

You must determine what you want to monitor and measure, when and how, and who is responsible. The results must be analysed and evaluated.

This can include technical monitoring (such as the number of security incidents or the status of patches), but also evaluation of processes (such as whether risk assessments are carried out on time) and the effectiveness of awareness programmes.

9.2 Internal audit

You must carry out internal audits at planned intervals. These check whether the ISMS meets the requirements of the standard and your own requirements, and whether it is effectively implemented and maintained.

The internal auditor must be independent of what is being audited. You may not audit your own work. For smaller organisations, this often means bringing in an external party, or having employees from different departments audit each other.

The results of the internal audit must be documented and reported to management.

9.3 Management review

Top management must review the ISMS at planned intervals. The management review must consider the status of actions from previous reviews, changes in internal and external factors, feedback on security performance, audit results, and opportunities for improvement.

The output of the management review includes decisions on improvement opportunities and any necessary changes to the ISMS. The results must be documented.

Clause 10: Improvement

The tenth and final clause is about getting better continually.

10.1 Continual improvement

You must continually improve the suitability, adequacy and effectiveness of the ISMS. This is not a task you finish. It is an ongoing attitude.

10.2 Nonconformities and corrective actions

When a nonconformity occurs, you must react by controlling and correcting it, dealing with the consequences, evaluating the cause, determining whether similar nonconformities exist or could occur, and taking corrective action where needed.

You must evaluate the effectiveness of the corrective actions. Everything must be documented: the nature of the nonconformity, the actions taken, and the results.

The relationship between ISO 27001 and Annex A

Annex A of ISO 27001 contains a catalogue of 93 security controls, organised into four categories:

• Organisational controls (37 controls): policies, procedures, roles and responsibilities
• People controls (8 controls): screening, awareness, disciplinary processes
• Physical controls (14 controls): physical access security, equipment, environment
• Technological controls (34 controls): access management, cryptography, network security

These controls are not requirements in their own right. You only need to apply them where they are relevant to your risk profile. However, you must consider each control and justify why you do or do not apply it.

Read more about the specific controls on the Annex A page.

More information

• The ISMS: the heart of ISO 27001 explained
• Risk analysis: how do you carry out a risk assessment?
• Annex A: the 93 security controls
• Step-by-step plan: from zero to certificate
• The audit process: what can you expect?
• Mandatory documents: which documents does the standard require?
• Information security policy: what should it contain and how do you write it?
• Recent changes: the 2025 transition and what changes
• ISO 9001 requirements: compare with the quality standard