ISO/IEC 27001, information security management

A certifiable standard for running an information security management system: how an organisation decides what it must protect, judges the risks to it, and keeps the arrangements under review. Clauses 4 to 10 carry the requirements an auditor certifies against; Annex A is the set of 93 controls to select from.

No law that this site knows of requires an organisation to be certified against this standard. Check whether a regulator, a contract or a customer does. In practice it is other people who ask for it: a customer's procurement questionnaire, a public tender, an investor carrying out diligence, or a parent company standardising its suppliers. The trigger is commercial, and it usually arrives with a contractual deadline rather than a statutory one.

The edition is ISO/IEC 27001:2022, including Amendment 1:2024 (climate action changes). Certification is assessed against clauses 4 to 10, which set out how an organisation decides what it must protect, judges the risks, treats them and keeps the arrangements under review. Annex A is the control set it selects from, and the selection has to be justified in a Statement of Applicability. Certification covers the management system, including how you chose and applied Annex A controls.

The 2022 edition replaced the 2013 one. Under the transition rule the accreditation bodies apply, certificates issued against the 2013 edition ceased to be valid after 31 October 2025, so any current certificate is a 2022 one. A 2013 certificate in a supplier pack today is expired rather than merely old.

For a regulated entity in the European Union, the certificate settles nothing on its own. Neither the network and information security regime nor the financial sector's operational resilience regulation accepts a certificate in place of compliance: both are satisfied by what the organisation actually does, and a supervisor can ask for evidence a certificate does not carry. When the Library publishes mappings between these frameworks, they will be leads to check against both texts, never a finding that one satisfies another.

In the United States the certificate is recognised but less often the thing asked for. A United States customer buying a software or hosting service will more commonly ask for a SOC 2 report, and a supplier selling on both sides of the Atlantic is often asked for both.