01Trust
Win trust and close deals
The certificate is shorthand for "we take security seriously." It shortens security reviews, unblocks enterprise procurement, and answers the questionnaire before it's asked.
ISO 27001:2022, explained
ISO 27001 is the international standard for an information security management system. It has two halves — seven management clauses that run the system, and 93 Annex A controls you draw from to treat risk. This guide covers both, plus what changed in 2022 and how certification actually works.
A.5.23
Annex A
Information security for use of cloud services
One of 93 controls
A cloud provider
Terms changed — new sub-processor added
Detected 2 days ago
Annex A themes
4
93 controls in total
Illustrative — not vendor data
One standard, two halves
Clauses 4–10 are the mandatory system. Annex A is the risk-based catalogue you pick from. Together, they make an ISMS.
MandatoryThe system
7 management clauses (4–10)
The requirements that run the ISMS — you meet every one.
- 4Context of the organisation
- 5Leadership
- 6Planning
- 7Support
- 8Operation
- 9Performance evaluation
- 10Improvement
Risk-basedThe controls
93 Annex A controls · 4 themes
A catalogue you pick from — your risk assessment decides which apply.
Organizational 37
People 8
Physical 14
Technological 34
You won't use all 93 — your Statement of Applicability records which controls are in scope, and why.
2022Current edition
7Management clauses (4–10)
93Annex A controls
4Control themes
3 yrsCertificate cycle
Overlaps with
GDPR
NIS2
DORA
SOC 2
Cyber Essentials
Shared controls and evidence — not a substitute for any of them.
What ISO 27001 is
ISO/IEC 27001 is the world's best-known standard for an information security management system (ISMS) — the policies, processes, roles and controls an organisation uses to manage information risk deliberately rather than ad hoc. It was first published in 2005 and last revised in October 2022, with a short amendment in 2024 (Amendment 1, "climate action changes") adding a requirement to consider whether climate change is a relevant issue for the ISMS.
Two things make it powerful. First, it is risk-based: instead of a fixed checklist, you assess the risks to your information and choose controls that fit. Second, it is certifiable: an accredited certification body audits your ISMS and issues a certificate that customers, regulators and partners recognise. Certification is renewed on evidence: an auditor asks not only whether a control exists on paper but whether you can show it operating over time.
Why it matters
The certificate is a business tool as much as a security one.
02Risk
Manage risk on purpose
A repeatable cycle to identify, assess and treat information risk — so security decisions are made deliberately and revisited, not left to chance.
03Compliance
Support GDPR, NIS2 and more
A structured ISMS underpins many regulatory obligations. It doesn't replace them, but it provides the governance, records and controls they expect.
04Advantage
Turn security into an edge
Fewer incidents, faster audits, and a credential competitors may not have — security becomes a reason to choose you, not a cost centre.
The management clauses (4–10)
Clauses 4 to 10 are the mandatory requirements — the machinery of the ISMS. Unlike Annex A, none of these are optional.
4
Context of the organisation
Define what the ISMS is for and where its boundaries sit.
4.1Understanding the organisation and its context
4.2Understanding the needs and expectations of interested parties
4.3Determining the scope of the ISMS
4.4Information security management system
5
Leadership
Top management owns the ISMS, sets policy and assigns roles.
5.1Leadership and commitment
5.2Information security policy
5.3Organizational roles, responsibilities and authorities
6
Planning
Assess risk, set objectives and plan changes.
6.1Actions to address risks and opportunities
6.2Information security objectives and planning to achieve them
6.3Planning of changes
7
Support
The resources, people, awareness and records the ISMS needs.
7.1Resources
7.2Competence
7.3Awareness
7.4Communication
7.5Documented information
8
Operation
Run the risk assessment and treatment in practice.
8.1Operational planning and control
8.2Information security risk assessment
8.3Information security risk treatment
9
Performance evaluation
Measure, audit and review whether the ISMS works.
9.1Monitoring, measurement, analysis and evaluation
9.2Internal audit
9.3Management review
10
Improvement
Fix what falls short and keep the system getting better.
10.1Continual improvement
10.2Nonconformity and corrective action
Annex A: the 93 controls
Annex A is the catalogue you draw from to treat risk — grouped into four themes in 2022. You don't implement all of them: your risk assessment decides which apply, and the Statement of Applicability records what you included and why.
A.5
37
Organizational
Policies, roles, supplier and cloud security, incident management and business continuity.
A.5.7 Threat intelligence
A.5.23 Information security for use of cloud services
A.6
8
People
Screening, awareness and training, responsibilities, and remote working arrangements.
A.6.3 Information security awareness, education and training
A.6.7 Remote working
A.7
14
Physical
Secure areas, equipment protection, clear desk and screen, and secure disposal.
A.7.4 Physical security monitoring
A.8
34
Technological
Access control, cryptography, logging and monitoring, and secure development.
A.8.9 Configuration management
A.8.28 Secure coding
Browse all 93 controls as a table
Organizational controls 37
| 2022 | Control | 2013 |
|---|---|---|
| 5.1 | Policies for information security | 5.1.1, 5.1.2 |
| 5.2 | Information security roles and responsibilities | 6.1.1 |
| 5.3 | Segregation of duties | 6.1.2 |
| 5.4 | Management responsibilities | 7.2.1 |
| 5.5 | Contact with authorities | 6.1.3 |
| 5.6 | Contact with special interest groups | 6.1.4 |
| 5.7 | Threat intelligence | — |
| 5.8 | Information security in project management | 6.1.5, 14.1.1 |
| 5.9 | Inventory of information and other associated assets | 8.1.1, 8.1.2 |
| 5.10 | Acceptable use of information and other associated assets | 8.1.3, 8.2.3 |
| 5.11 | Return of assets | 8.1.4 |
| 5.12 | Classification of information | 8.2.1 |
| 5.13 | Labelling of information | 8.2.2 |
| 5.14 | Information transfer | 13.2.1, 13.2.2, 13.2.3 |
| 5.15 | Access control | 9.1.1, 9.1.2 |
| 5.16 | Identity management | 9.2.1 |
| 5.17 | Authentication information | 9.2.4, 9.3.1, 9.4.3 |
| 5.18 | Access rights | 9.2.2, 9.2.5, 9.2.6 |
| 5.19 | Information security in supplier relationships | 15.1.1 |
| 5.20 | Addressing information security within supplier agreements | 15.1.2 |
| 5.21 | Managing information security in the ICT supply chain | 15.1.3 |
| 5.22 | Monitoring, review and change management of supplier services | 15.2.1, 15.2.2 |
| 5.23 | Information security for use of cloud services | — |
| 5.24 | Information security incident management planning and preparation | 16.1.1 |
| 5.25 | Assessment and decision on information security events | 16.1.4 |
| 5.26 | Response to information security incidents | 16.1.5 |
| 5.27 | Learning from information security incidents | 16.1.6 |
| 5.28 | Collection of evidence | 16.1.7 |
| 5.29 | Information security during disruption | 17.1.1, 17.1.2, 17.1.3 |
| 5.30 | ICT readiness for business continuity | — |
| 5.31 | Legal, statutory, regulatory and contractual requirements | 18.1.1, 18.1.5 |
| 5.32 | Intellectual property rights | 18.1.2 |
| 5.33 | Protection of records | 18.1.3 |
| 5.34 | Privacy and protection of PII | 18.1.4 |
| 5.35 | Independent review of information security | 18.2.1 |
| 5.36 | Compliance with policies, rules and standards for information security | 18.2.2, 18.2.3 |
| 5.37 | Documented operating procedures | 12.1.1 |
People controls 8
| 2022 | Control | 2013 |
|---|---|---|
| 6.1 | Screening | 7.1.1 |
| 6.2 | Terms and conditions of employment | 7.1.2 |
| 6.3 | Information security awareness, education and training | 7.2.2 |
| 6.4 | Disciplinary process | 7.2.3 |
| 6.5 | Responsibilities after termination or change of employment | 7.3.1 |
| 6.6 | Confidentiality or non-disclosure agreements | 13.2.4 |
| 6.7 | Remote working | 6.2.2 |
| 6.8 | Information security event reporting | 16.1.2, 16.1.3 |
Physical controls 14
| 2022 | Control | 2013 |
|---|---|---|
| 7.1 | Physical security perimeters | 11.1.1 |
| 7.2 | Physical entry | 11.1.2, 11.1.6 |
| 7.3 | Securing offices, rooms and facilities | 11.1.3 |
| 7.4 | Physical security monitoring | — |
| 7.5 | Protecting against physical and environmental threats | 11.1.4 |
| 7.6 | Working in secure areas | 11.1.5 |
| 7.7 | Clear desk and clear screen | 11.2.9 |
| 7.8 | Equipment siting and protection | 11.2.1 |
| 7.9 | Security of assets off-premises | 11.2.6 |
| 7.10 | Storage media | 8.3.1, 8.3.2, 8.3.3, 11.2.5 |
| 7.11 | Supporting utilities | 11.2.2 |
| 7.12 | Cabling security | 11.2.3 |
| 7.13 | Equipment maintenance | 11.2.4 |
| 7.14 | Secure disposal or re-use of equipment | 11.2.7 |
Technological controls 34
| 2022 | Control | 2013 |
|---|---|---|
| 8.1 | User endpoint devices | 6.2.1, 11.2.8 |
| 8.2 | Privileged access rights | 9.2.3 |
| 8.3 | Information access restriction | 9.4.1 |
| 8.4 | Access to source code | 9.4.5 |
| 8.5 | Secure authentication | 9.4.2 |
| 8.6 | Capacity management | 12.1.3 |
| 8.7 | Protection against malware | 12.2.1 |
| 8.8 | Management of technical vulnerabilities | 12.6.1, 18.2.3 |
| 8.9 | Configuration management | — |
| 8.10 | Information deletion | — |
| 8.11 | Data masking | — |
| 8.12 | Data leakage prevention | — |
| 8.13 | Information backup | 12.3.1 |
| 8.14 | Redundancy of information processing facilities | 17.2.1 |
| 8.15 | Logging | 12.4.1, 12.4.2, 12.4.3 |
| 8.16 | Monitoring activities | — |
| 8.17 | Clock synchronization | 12.4.4 |
| 8.18 | Use of privileged utility programs | 9.4.4 |
| 8.19 | Installation of software on operational systems | 12.5.1, 12.6.2 |
| 8.20 | Networks security | 13.1.1 |
| 8.21 | Security of network services | 13.1.2 |
| 8.22 | Segregation of networks | 13.1.3 |
| 8.23 | Web filtering | — |
| 8.24 | Use of cryptography | 10.1.1, 10.1.2 |
| 8.25 | Secure development life cycle | 14.2.1 |
| 8.26 | Application security requirements | 14.1.2, 14.1.3 |
| 8.27 | Secure system architecture and engineering principles | 14.2.5 |
| 8.28 | Secure coding | — |
| 8.29 | Security testing in development and acceptance | 14.2.8, 14.2.9 |
| 8.30 | Outsourced development | 14.2.7 |
| 8.31 | Separation of development, test and production environments | 12.1.4, 14.2.6 |
| 8.32 | Change management | 12.1.2, 14.2.2, 14.2.3, 14.2.4 |
| 8.33 | Test information | 14.3.1 |
| 8.34 | Protection of information systems during audit testing | 12.7.1 |
The supplier-relationship cluster (5.19–5.23)
Five Organizational controls sit together and cover the risk that lives in an organisation you do not run. Each has its own page.
Annex A 5.19
Information security in supplier relationships
Control 5.19 requires organisations to define and apply information security controls consistently across every supplier relationship, sized to the access and risk each supplier represents, before and throughout the engagement.
Annex A 5.20
Addressing information security within supplier agreements
Control 5.20 ensures every supplier that handles the organisation's information, or accesses its systems, is bound by explicit, documented information-security obligations in the agreement itself — so each obligation is a term the supplier can be held to, not an expectation you are relying on.
Annex A 5.21
Managing information security in the ICT supply chain
Control 5.21 exists to keep information security requirements intact as they pass down the chain of ICT product and service suppliers, so that risk introduced by subcontractors and component suppliers is identified and managed rather than assumed away at the first tier.
Annex A 5.22
Monitoring, review and change management of supplier services
Control 5.22 requires organisations to regularly monitor, review, evaluate and manage change in a supplier's information security practices and service delivery, so that the level of security and service agreed in the supplier agreement is maintained as the supplier's service, sub-suppliers and posture evolve.
Annex A 5.23
Information security for use of cloud services
Control 5.23 requires organisations to establish processes for the acquisition, use, management and exit of cloud services, in line with their information security requirements, so that information security for cloud use is specified and managed.
What changed in 2022
A once-in-a-decade overhaul — and it lands almost entirely in Annex A, the controls.
The seven management clauses barely moved — one new requirement (6.3, planning of changes) and some renumbering in clauses 9 and 10. Annex A — the controls — was consolidated, reorganised and modernised. Here's the before and after.
2013 edition
114 controls
14 domains
Sprawling, with real blind spots around cloud and modern threats.
2022 edition
93 controls incl. 11 new
4 themes + 5 attributes (in 27002)
Leaner, tagged, and built for how organisations work today.
Why it matters
01
It closes modern gapsThe 11 new controls cover cloud services, threat intelligence, data-leakage prevention and secure coding — risks the 2013 list missed.
02
It's easier to runFour themes and attribute tags replace 14 overlapping domains, so scoping, filtering and reporting are simpler.
03
It's already the only versionThe transition window for 2013 certificates closed on 31 October 2025, so every valid accredited certificate is now against the 2022 edition — including any a supplier shows you.
How certification actually works
A two-stage external audit, then a three-year cycle kept alive by evidence — not a one-time box tick.
01
Gap analysis
Measure your current practice against the standard and scope the work.
02
Build the ISMS
Scope, risk assessment, Statement of Applicability, controls and the evidence trail.
03
Audit yourself
Run an internal audit and a management review before anyone external looks.
04
Certification audit
Stage 1 reviews documents; Stage 2 tests that the ISMS actually operates.
05
Certify & maintain
Certificate valid 3 years, with annual surveillance audits and recertification at year three.
Evidence for the supplier controls, between audits
Annex A hands you the supplier and cloud controls — A.5.19 through A.5.23 — but keeping them evidenced between audits is the hard part. Venpo tracks the vendors you care about, re-reads their Terms, Privacy Policy, DPA and sub-processor list on a schedule, and gives you a dated redline and a plain-English summary of every change it finds — a dated record of the supplier-side changes 5.22 asks you to manage.
Supplier monitoring
· recent public changes
RECENT
TwilioA.5.22
Some sub-processors moved out of the main list
ramp.comA.5.22
Customer data can now be processed by xAI and Fireworks AI
ramp.comA.5.22
Your data can now go beyond the U.S.
CloudbedsA.5.22
Customer support data can now be processed by OpenAI
Evidence for Annex A.5.19–5.23 · Supplier & cloud services
Frequently asked questions
Is ISO 27001 mandatory?
No — certification is voluntary. In practice it is often required by enterprise customers, government tenders and some regulators, so many organisations treat it as a commercial necessity.
What's the difference between ISO 27001 and ISO 27002?
ISO 27001 is the certifiable standard — it defines the management-system requirements (clauses 4–10) and the Annex A control set. ISO 27002 is guidance that explains how to implement each of those controls. You certify against 27001; you consult 27002.
Do I have to implement all 93 Annex A controls?
No. You select the controls that treat your assessed risks and justify any exclusions in the Statement of Applicability. You must consider all 93, but you only implement the ones that apply to you.
How long does certification take?
Typically three to twelve months, depending on the size of the organisation, the scope of the ISMS, and how much security governance already exists.
How long is the certificate valid?
Three years. A certification body runs annual surveillance audits during that period and a full recertification audit at the end of the cycle.
What changed between the 2013 and 2022 versions?
Annex A was reorganised from 114 controls in 14 domains to 93 controls in four themes, with 11 new controls. The companion guidance standard, ISO/IEC 27002:2022, also tags every control with five attributes — control type, information security properties, cybersecurity concepts, operational capabilities and security domains — which makes filtering and reporting far easier. The transition window for 2013 certificates closed on 31 October 2025.
Does ISO 27001 make us GDPR compliant?
Not automatically. A well-run ISMS supports GDPR — Annex A control 5.34 covers privacy and protection of PII — and ISO/IEC 27701 adds a full privacy management system on top, though since its 2025 revision that standard is standalone and no longer requires ISO 27001 certification first. Either way, ISO certification and legal compliance are separate things: a certificate is evidence of a working system, not a finding of GDPR compliance.
Who can issue the certificate?
An accredited certification body. Accreditation by a national body is what makes the certificate credible; a certificate from an unaccredited assessor carries far less weight.
Start free · No credit card
Know when a supplier's terms move — before the audit does.
Certification is renewed on evidence. Venpo re-reads your vendors' Terms, Privacy Policies, DPAs and sub-processor lists on a schedule and keeps a dated redline of every change — so your supplier and cloud controls have a trail to show, instead of a scramble before the audit.
This guide is an educational summary of ISO/IEC 27001:2022 and is not affiliated with or endorsed by ISO. Always work from the official text for certification.