ISO & IEC / Requirements
ISO/IEC 27001:2022 + Amd 1:2024 The ISMS requirements
ISO/IEC 27001 establishes the requirements for running and continually improving an ISMS. Its management system clauses frame governance and risk treatment, while Annex A provides 93 reference controls to check for possible omissions.
The place in the system
Where it fits
This is the certifiable ISMS anchor; organizations determine necessary controls through risk treatment and compare them with Annex A rather than implementing all 93 automatically.
Practical interpretation
How to use this reference
These are editorial starting points, not copied requirements or an implementation checklist from the standard.
Questions and actions
- Define the ISMS scope and the information, services and parties it covers.
- Make risk treatment decisions and record the resulting control applicability.
- Review objectives, internal audit findings and improvement decisions on a repeatable cycle.
Evidence to look for
- ISMS scope and objectives
- Risk treatment decisions and statement of applicability
- Internal audit and management review records
Illustrative example
What it could look like
A services company needs a consistent way to govern customer information across several teams. It sets an ISMS scope, chooses controls based on assessed risks and checks whether those controls keep working.
Boundary to keep clear
Certification is to the scoped management system, not a guarantee that every incident is prevented or that every Annex A control is applicable.
Source and edition check
Open the official record
Research checked 2026-10-20. Catalogue status and edition can change; the official publisher record controls. Full standard text is not reproduced here.