ISO 27001

The normative core is clauses 4-10, written in the harmonized structure used by all ISO management system standards; clauses 0-3 are introduction, scope, normative reference (ISO/IEC 27000) and terms. Annex A is also normative, but its 93 controls only become obligations through clause 6.1.3: the organisation determines the controls needed to treat its assessed risks, compares them with Annex A to verify that nothing necessary has been omitted, and records the result in the Statement of Applicability. Annex A is explicitly not exhaustive, so controls from other sources (CIS Controls, sector rules, customer contracts) can and often should be added.

The 2022 revision changed more than the annex. Clause 4.2 now asks which interested-party requirements will be addressed through the ISMS, 4.4 refers to the processes and their interactions, 6.3 requires changes to the ISMS to be planned, 8.1 requires criteria for processes, and management review (9.3.2) must consider changes in the needs and expectations of interested parties. Amendment 1:2024 added to clause 4.1 that the organisation must determine whether climate change is a relevant issue, and a note to 4.2 that interested parties can have climate-related requirements. Under IAF MD 26, certificates against the 2013 edition had to be transitioned by 31 October 2025.

The standard demands specific documented information rather than a fixed document set: the scope, the policy, the risk assessment and treatment processes, the SoA, objectives, evidence of competence, operational planning records, risk assessment and treatment results, monitoring results, the audit programme and audit results, management review results, and records of nonconformities and corrective actions. Certification is carried out by bodies accredited under ISO/IEC 17021-1 and ISO/IEC 27006 (in Denmark by DANAK); the initial audit runs in two stages, and nonconformities are graded major or minor, with a major one blocking certification until it is corrected.

Frequent failure modes are over-narrow scopes, a risk method whose results cannot be reproduced, SoA exclusions justified with "not relevant" but no risk rationale, and internal audits performed by the people who run the controls, which undermines the objectivity required by 9.2. Compared with NIS2 the standard is voluntary and silent on legal deadlines such as the 24-hour early warning; compared with the NIST CSF it prescribes a management system rather than a catalogue of outcomes; and compared with ISO/IEC 27002 it states what must be done, while 27002 explains how each control can be implemented.