ISO 27001 Certification for Your Information Security Management System

What is ISO 27001?

ISO/IEC 27001 is the international standard for information security management systems (ISMS). It sets out the requirements for a management system that protects the confidentiality, integrity and availability of information – whether it sits on servers, in the cloud or on paper. The standard is published jointly by ISO and IEC, which is why its official name is ISO/IEC 27001; in everyday use it is simply called ISO 27001.

The current edition is ISO/IEC 27001:2022, supplemented by the climate change amendment Amd 1:2024. The three-year transition period for certificates issued against the 2013 edition ended on 31 October 2025, so certification today is to the 2022 edition only.

At its core, the standard is risk-based. It does not prescribe particular technology; instead, it requires you to assess your information security risks systematically, treat them appropriately and review the effectiveness of your controls at regular intervals. It is widely used: according to the ISO Survey 2022, more than 70,000 certificates were reported across 150 countries and all economic sectors.

Who needs ISO 27001 certification?

ISO/IEC 27001 applies to organisations of any size and in any sector. Demand is highest wherever customers hand their data to someone else: IT service providers, cloud and hosting companies, data centres, software developers, consultancies, healthcare providers and suppliers whose customers ask for information security in contracts and tenders.

The standard works well for small and medium-sized businesses, because the scope and the controls follow your risks rather than the size of a large corporation – ISO has even published a practical guide for SMEs. What matters most is a well-chosen scope: it can cover the whole organisation or clearly defined sites, processes or services.

There is no general law that requires every business to hold ISO 27001 certification. In practice it often becomes a requirement because customers ask for it in contracts, or because an ISMS helps meet regulatory duties such as those under the NIS2 Directive in a structured way. Some regulated sectors have specific requirements of their own, so check the rules that apply to yours. As an internationally active certification body based in Dublin, CERTUNION audits organisations in Ireland and elsewhere – on site or remotely.

ISO/IEC 27001:2022 requirements (clauses 4 to 10)

The standard follows the Harmonized Structure that ISO uses for all management system standards. The auditable requirements are in clauses 4 to 10, which makes it straightforward to combine an ISMS with ISO 9001 quality management or other management systems.

Compared with the 2013 edition, the clauses changed only moderately; new points include planning of changes (6.3) and considering changes in the needs of interested parties in the management review (9.3). The bigger changes are in Annex A.

• Clause 4 – Context: internal and external issues, requirements of interested parties and the ISMS scope; since Amd 1:2024 also whether climate change is a relevant issue.
• Clause 5 – Leadership: top management commitment, the information security policy, roles and authorities.
• Clause 6 – Planning: risk assessment and risk treatment processes, the Statement of Applicability, information security objectives and planning of changes.
• Clause 7 – Support: resources, competence, awareness, communication and documented information.
• Clause 8 – Operation: operational control, risk assessments at planned intervals and implementation of the risk treatment plan, including externally provided processes and services.
• Clause 9 – Performance evaluation: monitoring and measurement, internal audit and management review.
• Clause 10 – Improvement: continual improvement, nonconformity and corrective action.

Annex A: 93 controls in four themes

Annex A of ISO/IEC 27001:2022 lists 93 information security controls grouped into four themes. The 2013 edition had 114 controls in 14 sections; the new edition condenses their content into 82 controls and adds 11 new ones – for example on threat intelligence, use of cloud services, ICT readiness for business continuity, configuration management, information deletion, data leakage prevention, web filtering and secure coding.

Not every control has to be implemented. Which ones you need follows from your risk treatment. The link between the two is the Statement of Applicability: it lists the necessary controls, justifies their inclusion, states whether they are implemented and justifies the exclusion of any Annex A control. Auditors treat it as one of the central documents.

• Organisational controls (37), such as policies, access control, supplier relationships and incident management.
• People controls (8), such as screening, awareness and training, and remote working.
• Physical controls (14), such as physical entry, protection of equipment and physical security monitoring.
• Technological controls (34), such as malware protection, backup, logging, cryptography and secure development.

ISO 27001 certification requirements and preparation

What gets certified is an ISMS that is in place and working – not a plan on paper. Before booking the certification audit, make sure the following building blocks are complete:

If you are unsure whether your ISMS is ready, you can book an optional pre-audit with CERTUNION. It shows where gaps remain before the certification audit – for example when the risk assessment, the controls and the Statement of Applicability do not match up.

• a defined and documented scope with clear interfaces to suppliers
• an information security policy backed by top management, and named responsibilities
• a completed risk assessment with a risk treatment plan and a Statement of Applicability
• implemented controls, trained staff and measurable information security objectives
• at least one internal audit and one management review with documented results

ISO 27001 certification cost and timeline

With CERTUNION, ISO 27001 certification comes as an annual package together with the platform for your management system. There are three annual packages, priced per year: €789 for one standard (up to 25 employees), €1,499 for up to three standards (up to 100 employees) and €1,949 for all five standards (any number of employees).

The annual price includes the platform with all its modules and that year’s audit: the initial certification in the first year – we issue the certificate once the audit has been passed – and the surveillance audits in the second and third years. The contract runs for three years; in the fourth year, recertification follows at a 20% discount. All prices are exclusive of VAT and apply exclusively to business customers, not to consumers. Travel and accommodation costs for on-site audits are charged as incurred.

The number of audit days depends on how your ISMS is set up – mainly on the number of people working within the scope, the number and type of sites (including data centres and remote work), the complexity of your IT and processes, the share of outsourced processes and cloud services, and whether you want a pre-audit.

The certification process itself – from enquiry to certificate – usually takes four to eight weeks, depending on the size and complexity of your organisation. Building the ISMS is a separate matter: how long it takes depends on your starting point and can only be estimated reliably after an initial assessment. Also plan internal time for interviews, evidence and closing any findings.

View the annual package price list (in German)

What documentation does ISO 27001 require?

ISO/IEC 27001 does not require a manual in any particular format, but it does require documented information at specific points, including:

On top of that comes whatever you decide is necessary for your ISMS to be effective – policies on access, backup or suppliers, for example. A few well-maintained documents carry more weight in an audit than extensive templates nobody uses.

• ISMS scope (4.3) and information security policy (5.2)
• risk assessment and risk treatment processes (6.1.2, 6.1.3)
• Statement of Applicability (6.1.3 d) and information security objectives (6.2)
• evidence of competence (7.2) and documentation needed for operational control (8.1)
• results of risk assessments and risk treatment (8.2, 8.3)
• monitoring and measurement results (9.1), audit programme and audit results (9.2), management review results (9.3)
• nonconformities and corrective actions (10.2)

Benefits of ISO 27001 certification

A certified ISMS creates clarity: you know which information is critical, which risks exist and who is responsible for what. The certificate makes that work visible to customers and partners – it builds trust with organisations that entrust you with their data, improves your chances in tenders and supplier assessments, reduces the effort of answering security questionnaires and gives you orderly processes for incidents and business continuity.

Certification does not prevent attacks. It does show that your organisation knows its risks, selects controls deliberately and reviews their effectiveness regularly – and that an independent body has checked this.

ISO 27001, NIS2, GDPR and related frameworks

Article 21 of the NIS2 Directive (EU) 2022/2555 requires entities in scope to take cybersecurity risk-management measures, including risk analysis, incident handling, business continuity, supply chain security, cryptography, access control and training. Many of these overlap with ISO/IEC 27001 and Annex A, and Article 25 asks Member States to encourage the use of European and international standards. A certificate still does not replace a review of the national law transposing NIS2, for example on incident reporting.

The same applies to the GDPR: Article 32 requires appropriate technical and organisational measures for the security of processing. An ISMS helps you implement and evidence these measures systematically, but it does not cover data protection duties such as lawful bases, transparency or data subject rights.

Because ISO/IEC 27001 uses the Harmonized Structure, it combines well with ISO 9001 (quality), ISO 22301 (business continuity) or ISO 50001 (energy) in an integrated management system with a shared policy, risk approach, internal audit and management review.

The Certification Process

1. 01

   Enquiry

   Tell us about your organisation, your sites and the intended scope of your ISMS. The initial conversation is without obligation.

2. 02

   Analysis and package choice

   We clarify the scope, the number of people within it, sites and outsourced processes, and you choose the right annual package.

3. 03

   Pre-audit (optional)

   If you wish, we first check where your ISMS stands – for example whether risk treatment and the Statement of Applicability are consistent.

4. 04

   Certification audit

   On site or remotely, our auditors review documentation, risk assessment and the Statement of Applicability, and test how effective the controls are in practice through interviews and sampling.

5. 05

   Certificate

   Once the audit has been passed, CERTUNION issues the certificate for the defined scope. It is usually valid for three years.

6. 06

   Surveillance audits

   Annual surveillance audits check that your ISMS remains effective – including when new risks, systems or suppliers come along.

Frequently asked questions