ISO 27001 certificationInformation Security Management

The Statement of Applicability is a required document under clause 6.1.3. It lists the controls you have determined are necessary, states whether each of the 93 Annex A controls is included or excluded with a justification, and shows whether the included controls are implemented. Auditors use it as a central reference when sampling and testing controls.

In the 2022 edition the controls are grouped into four themes: 37 organisational controls, 8 people controls, 14 physical controls and 34 technological controls. Eleven controls were new compared with 2013, including threat intelligence, information security for use of cloud services, data masking, data leakage prevention and secure coding. ISO/IEC 27002:2022 gives guidance on each control.

No. The transition period agreed by the International Accreditation Forum ended on 31 October 2025, after which certificates issued against ISO/IEC 27001:2013 were no longer valid. Organisations that did not complete the transition need a certification audit against the 2022 edition. If you are in this position, contact us to discuss your current system.

Yes, where your risk assessment and context show a control is not needed. For example, a fully remote organisation without offices may justify excluding some physical controls, though controls for remote working and equipment will still apply. Each exclusion must be justified in the Statement of Applicability. You cannot, however, exclude any requirement from clauses 4 to 10.

No. Cyber Essentials is a UK government-backed scheme covering a defined set of basic technical controls, and is required for certain central government contracts. ISO 27001 is a broader, risk-based management system covering governance, people, physical and technological security. Many organisations hold both, and the two can complement each other well.

Not by itself. An ISMS can provide much of the security of processing that UK GDPR requires, but data protection law also covers lawful basis, transparency, data subject rights and accountability, which are outside the scope of ISO 27001. Some organisations extend their ISMS with ISO/IEC 27701 for privacy information management.

You need to have completed your risk assessment, Statement of Applicability, an internal audit and a management review, with controls operating long enough to generate records. Most organisations at that point complete Stage 1 and Stage 2 within six to twelve weeks of booking. Larger or more complex scopes require longer audits.

Parts of an ISO 27001 audit can be performed remotely where the ISMS is largely cloud-based and evidence can be reviewed securely. Physical locations within scope, such as offices or data rooms, may still need an on-site visit. We decide the approach during planning, taking into account your scope and the reliability of the remote technology.