ISO/IEC 27001 does not prescribe a security product but a management system: a recurring cycle through which an organisation plans, implements, reviews and improves its information security. At its core is risk assessment. Which information needs protection, which threats exist, which controls are appropriate, and who is responsible?
Structure of the standard
Clauses 4 to 10 contain the requirements for the management system: context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. Annex A of the 2022 edition lists 93 controls in four themes: organisational, people, physical and technological. The organisation records which apply in its statement of applicability, with reasons also for excluded controls.
Certification
An accredited certification body audits the ISMS in a two-stage audit. The certificate is valid for three years, with annual surveillance audits. The transition period from the 2013 to the 2022 edition ended on 31 October 2025; valid certificates have since been based on the new edition.
Relation to NIS2, TISAX and the Swiss ISA
Neither NIS2 nor Switzerland’s Information Security Act requires ISO certification. An ISO 27001 ISMS does, however, cover a large part of the risk management duties and makes evidence much easier. TISAX, the automotive industry standard, is based on ISO 27001 and adds sector-specific requirements.
When ISO 27001 pays off
Certification pays off when customers require it, when a company supplies regulated sectors or when it wants to demonstrate its security organisation externally. For smaller companies, an ISMS following the standard’s principles without certification can be a sensible intermediate step. Which duties apply to your company is clarified by a compliance assessment.