The Genesis: Origins and Evolution of ISO 20000
ISO 20000 History: The Genesis, Origins & Evolution of the Standard
ISO 20000 is the international standard for an IT Service Management System (ITSMS), and its story begins with the British Standard BS 15000, which was shaped by ITIL best practice before being adopted worldwide as ISO/IEC 20000 in 2005. Understanding the history of ISO 20000 is more than an academic exercise. It explains why the standard is structured the way it is, how it relates to frameworks like ITIL, and why it remains one of the most trusted benchmarks for organizations that deliver IT services. This article traces the genesis, origins, and evolution of ISO 20000, then explains what the standard looks like today and why it still matters for IT service providers.
- Published
- Reading time
- — min
What Is ISO/IEC 20000?
ISO/IEC 20000 is the international standard that specifies the requirements for an IT Service Management System, often abbreviated as ITSMS or simply SMS. In plain terms, it defines what an organization must do to plan, design, deliver, operate, and continually improve its IT services so that they consistently meet the needs of the business and its customers.
The standard is published in parts. Part 1 sets out the certifiable requirements, the things an IT service provider must demonstrate to earn certification. Part 2 is a code of practice that offers guidance on how to apply those requirements. Because it is a management system standard, ISO/IEC 20000 focuses on establishing repeatable, measurable processes rather than prescribing specific technologies. That makes it applicable to in-house IT departments, managed service providers, cloud vendors, and outsourcing firms alike.
Crucially, ISO/IEC 20000 is certified to organizations, specifically to the IT service providers that operate the service management system, not to individuals. When a provider says it is “ISO 20000 certified,” it means an accredited certification body has independently assessed its service management system and confirmed it meets the requirements of the standard.
The Origins of ISO 20000: BS 15000 and ITIL
Every international standard has a lineage, and the roots of ISO 20000 reach back to the United Kingdom. The direct ancestor of the standard is BS 15000, the British Standard for IT service management. BS 15000 was first published in 2000 and then revised in 2002 and 2003 as practitioners refined its approach.
BS 15000 did not appear from nowhere. It was heavily influenced by ITIL, the IT Infrastructure Library, a collection of best-practice guidance for IT service management that had been developed in the UK. ITIL described how IT services could be managed effectively through defined processes covering areas such as incident, problem, change, and service level management. BS 15000 took that body of best practice and distilled it into a formal, auditable specification, something an organization could actually be certified against.
This distinction is the key to the whole story. ITIL offered guidance on good practice, but guidance alone cannot be certified. BS 15000 turned those principles into a set of requirements, creating the template that would soon become an international standard.
Adoption as ISO/IEC 20000 in 2005
The success and clarity of BS 15000 attracted international attention. In 2005, the standard was adopted at the international level and published as ISO/IEC 20000, developed jointly under the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
The first edition mirrored the structure that had proven effective in Britain. It was released in two parts:
- ISO/IEC 20000-1:2005 — the specification, containing the formal requirements for an IT service management system that an organization could be certified against.
- ISO/IEC 20000-2:2005 — the code of practice, providing guidance and recommendations on how to meet those requirements.
With this move, IT service management gained its first truly global, certifiable standard. Organizations anywhere in the world could now be assessed against a common, internationally recognized benchmark, rather than relying on a national standard or on best-practice guidance that carried no certificate.
The 2011 Revision
Standards are living documents, and ISO/IEC 20000 was revised in 2011 to keep pace with how IT service management had matured. The revision refined and sharpened the requirements of Part 1, improving the alignment between the specification and the way modern service providers actually worked.
This update reinforced the process-based, continual-improvement philosophy at the heart of the standard. It kept ISO/IEC 20000 relevant as IT environments grew more complex and as customers demanded greater consistency, accountability, and transparency from their service providers.
The Current Version: ISO/IEC 20000-1:2018
The current edition of Part 1 is ISO/IEC 20000-1:2018. This is the version organizations are certified against today, and it represents the most recent step in the standard’s evolution.
The 2018 edition continues to define requirements for planning, designing, delivering, and improving IT services, all within a structured management system. It emphasizes leadership, risk-based thinking, and the ongoing improvement of services, reflecting the wider evolution of ISO management system standards toward a common, business-focused structure. For an IT service provider, achieving ISO/IEC 20000-1:2018 certification signals that its service management system meets a rigorous, up-to-date international benchmark.
An ISO 20000 Timeline at a Glance
The evolution of ISO 20000 is easiest to grasp as a timeline:
- 2000 — BS 15000, the British Standard for IT service management, is first published, influenced by ITIL best practice.
- 2002 / 2003 — BS 15000 is revised as the approach is refined in practice.
- 2005 — BS 15000 is adopted internationally and published as ISO/IEC 20000 (Part 1: specification; Part 2: code of practice).
- 2011 — ISO/IEC 20000 is revised, sharpening the requirements of Part 1.
- 2018 — ISO/IEC 20000-1:2018, the current version of Part 1, is published.
This progression, from national standard to global benchmark, shows how a single, well-designed specification can shape IT service management across the world.
ISO 20000 vs ITIL: Complementary, Not Interchangeable
Because ISO 20000 grew out of a standard influenced by ITIL, the two are often mentioned together, and sometimes confused. They are closely related but serve different purposes.
ITIL is a framework of best-practice guidance. It describes how IT service management can be done well, offering detailed advice, terminology, and process descriptions. However, ITIL is guidance, and an organization cannot be formally certified against it as a management system.
ISO/IEC 20000 is the certifiable standard. It sets out requirements that an IT service provider must meet, and an accredited certification body can independently audit an organization against those requirements and issue a certificate.
In practice, the two complement each other. Many organizations use ITIL guidance to help build and refine their service management processes, then use ISO/IEC 20000 to formally demonstrate, through independent certification, that those processes meet an internationally recognized standard. ITIL helps you get there; ISO 20000 proves you have arrived.
Why ISO 20000 Matters Today
The history of ISO 20000 explains its structure, but its present-day value is what makes it worth pursuing. For modern IT service providers, certification delivers several concrete benefits.
- Consistent, reliable service. The standard drives defined, repeatable processes that reduce variability and improve the quality of IT services.
- Independent credibility. Certification by an accredited body offers objective proof that an organization’s service management system meets a global benchmark, which is valuable in competitive tenders and customer due diligence. Our guide to ISO certification benefits explores this value in more detail.
- A culture of continual improvement. ISO/IEC 20000 embeds ongoing measurement and improvement, helping providers adapt as technology and customer expectations change.
- Better alignment with the business. By focusing on services that meet defined requirements, the standard helps IT deliver measurable value rather than just technical output.
- Compatibility with other standards. Its management-system structure makes it easier to integrate with other frameworks a provider may already operate, such as information security or quality management systems.
For any provider whose reputation depends on the dependability of its IT services, ISO 20000 remains a powerful way to demonstrate maturity and earn trust.
Getting ISO 20000 Certified With IAS
At Integrated Assessment Services (IAS), we help IT service providers pursue ISO 20000 certification against the current requirements of the standard. As an established certification body, IAS assesses your service management system independently and transparently, so your certificate carries genuine weight with customers and partners.
If you are new to the world of ISO standards, our ISO certification hub explains the broader landscape, and our system certification page covers management system standards more generally. To understand what an assessment involves from start to finish, review our certification process, our blog on the ISO certification process, and, if your team needs to build knowledge first, take a look at our training schedule. It also helps to understand the role of ISO certification bodies before you begin.
To discuss ISO 20000 certification for your organization, simply contact us and our team will guide you through the next steps. IAS is part of a global network of assessment and certification organizations, including EAS, giving clients confidence in a well-connected, internationally minded body.
Frequently Asked Questions
What is ISO 20000 in simple terms?
Where did ISO 20000 come from?
What is the current version of ISO 20000?
Is ISO 20000 the same as ITIL?
Who can be certified to ISO 20000?
How do I get ISO 20000 certified?
Contact Us
ISO 27001 Requirements
ISO 27001 Requirements: Clauses, Controls & Documents
To meet the ISO 27001 requirements, an organization must build an information security management system (ISMS) that satisfies mandatory clauses 4 to 10 of ISO/IEC 27001:2022 and implement the applicable Annex A controls, all supported by a defined set of documented information. These requirements are what an external auditor checks before a company can be certified. This guide breaks down each mandatory clause, the four Annex A control themes, and the specific documents your ISMS must produce and maintain.
- Published
- Reading time
- — min
ISO/IEC 27001:2022 is the current version of the standard. It replaced the 2013 edition, and the transition period ended on 31 October 2025 — so 2022 is now the only valid version to certify against. If you want a general introduction first, read our overview of the ISO 27001 standard. This page focuses on the concrete, auditable requirements you need to satisfy.
How the ISO 27001 Requirements Are Structured
The standard is split into two parts that work together:
- The main clauses (4–10): the mandatory management-system requirements. Every organization seeking certification must meet all of these. They cannot be excluded.
- Annex A: a reference set of 93 information security controls. You do not have to implement every control, but you must consider all of them and justify what you include or exclude in a Statement of Applicability (SoA).
Together these define what a certifiable ISMS looks like. Below we walk through each part.
Mandatory Clauses 4–10 Explained
Clauses 4 through 10 hold the requirements you must comply with. Clauses 1 to 3 (scope, references, and terms) are informative context and contain no requirements.
Clause 4 — Context of the Organization
You must determine the internal and external issues relevant to your ISMS, identify interested parties (customers, regulators, employees) and their requirements, and define the scope of the ISMS. The scope is a required document that states exactly which parts of the business, locations, assets, and technologies the ISMS covers. A well-drafted scope prevents disputes later in the audit: it tells the certification body precisely what will and will not be assessed, and it stops the ISMS from sprawling beyond what your organization can realistically manage.
Clause 5 — Leadership
Top management must demonstrate commitment to the ISMS. This clause requires a documented information security policy, clearly assigned roles and responsibilities, and evidence that leadership is actively supporting and resourcing the system rather than delegating it entirely.
Clause 6 — Planning
This is one of the most heavily assessed clauses, because it forces you to prove that your controls are driven by real risk rather than guesswork. It requires you to:
- Conduct an information security risk assessment using a defined, repeatable methodology so results are consistent each time you run it.
- Carry out information security risk treatment, selecting controls to address the risks you identify and deciding whether to treat, tolerate, transfer, or terminate each risk.
- Produce a Statement of Applicability (SoA) listing the Annex A controls, whether each is applied, and the justification.
- Create a risk treatment plan and set measurable information security objectives.
Clause 6 also introduces the requirement to plan for changes to the ISMS in a controlled way, so that updates to your systems or business do not silently undermine your security posture.
Clause 7 — Support
Clause 7 covers the resources that keep the ISMS running: competence, awareness, communication, and documented information. You must retain competence records showing that staff with security responsibilities are qualified, and control how documents and records are created, approved, and updated.
Clause 8 — Operation
Here you put the plans from Clause 6 into practice. You operate the processes needed to meet your requirements, perform risk assessments at planned intervals or when significant change occurs, and implement your risk treatment plan. You must keep records demonstrating that these processes were carried out as intended.
Clause 9 — Performance Evaluation
You must monitor, measure, analyze, and evaluate the ISMS. This clause specifically requires:
- Monitoring and measurement results that show whether controls and objectives are effective.
- An internal audit program and documented internal audit results.
- Management review conducted by top management, with recorded outputs and decisions.
For a deeper look at how these evaluations are conducted, see our guide to the ISO 27001 audit.
Clause 10 — Improvement
The ISMS must continually improve. When something goes wrong, you must record the nonconformity, take corrective action, and document what you did to prevent recurrence. This closes the Plan-Do-Check-Act loop that runs through the whole standard.
Annex A Controls (2022)
Annex A of ISO/IEC 27001:2022 contains 93 controls organized into four themes:
- Organizational controls — 37 controls. Policies, roles, supplier relationships, threat intelligence, incident management, and information transfer.
- People controls — 8 controls. Screening, terms of employment, awareness and training, disciplinary process, and responsibilities after termination.
- Physical controls — 14 controls. Secure areas, equipment protection, physical entry, clear desk and clear screen, and secure disposal.
- Technological controls — 34 controls. Access control, cryptography, secure development, malware protection, logging and monitoring, and network security.
You review every control against your risk assessment and document your decisions in the Statement of Applicability. Controls that address your risks are implemented; controls you exclude must have a stated reason. The 2022 restructure reorganized the controls into these four themes and added new controls covering areas such as threat intelligence, information security for cloud services, and secure coding — reflecting how the threat landscape has changed since the previous edition.
It is worth stressing what Annex A is not: it is not a checklist you tick off in isolation. Each control only earns its place in your ISMS because a risk justified it. This is why the risk assessment in Clause 6 and the Annex A controls are so tightly linked — the assessment tells you which controls you need, and the SoA records that reasoning for the auditor.
ISO 27001 Documentation Requirements
A common question is which documents are mandatory. Auditors expect to see the following documented information as evidence that your ISMS meets the requirements:
- ISMS scope (Clause 4).
- Information security policy (Clause 5).
- Information security risk assessment process and its results (Clause 6).
- Information security risk treatment process (Clause 6).
- Statement of Applicability (Clause 6).
- Risk treatment plan (Clauses 6 and 8).
- Information security objectives (Clause 6).
- Competence records (Clause 7).
- Monitoring and measurement results (Clause 9).
- Internal audit program and audit results (Clause 9).
- Management review results (Clause 9).
- Nonconformity and corrective action records (Clause 10).
Beyond these, you keep whatever additional records your own processes and selected Annex A controls generate — for example access logs, training records, or supplier agreements. Think of this list as your core ISO 27001 documentation checklist.
A Simple ISO 27001 Requirements Checklist
Use this as a high-level starting point when preparing your ISMS:
- Define and document the ISMS scope.
- Secure leadership commitment and publish an information security policy.
- Choose a risk assessment methodology and complete a risk assessment.
- Produce a risk treatment plan and Statement of Applicability.
- Implement the applicable Annex A controls.
- Set measurable security objectives and assign competent people.
- Run internal audits and a management review.
- Record nonconformities and corrective actions.
- Undergo the certification audit with an accredited body.
Common Challenges in Meeting the Requirements
Organizations most often struggle with the same handful of requirements:
- Scope that is too broad or too vague. An unclear scope makes the whole ISMS harder to run and expands the audit unnecessarily.
- A risk assessment that does not connect to controls. Auditors look for a clear line from each identified risk to the control that treats it. Missing that traceability is a frequent nonconformity.
- Documentation that exists but is not maintained. A policy written once and never reviewed does not satisfy the intent of the standard. Records must reflect current practice.
- Weak evidence for Clause 9. Internal audits and management reviews are mandatory, yet many organizations under-document them. Keep dated records of what was reviewed and what was decided.
- Treating certification as a one-time project. Clause 10 requires continual improvement, and surveillance audits check that the ISMS keeps evolving.
Addressing these early makes the certification audit far smoother and reduces the risk of findings that delay your certificate.
How the Requirements Lead to Certification
Meeting these requirements is what makes an organization ready for a certification audit. Note that ISO 27001 is certified to organizations, not to individuals — professionals earn qualifications through training, but the certificate belongs to the company. To understand the assessment stages, review our ISO 27001 certification process and the broader ISO audit procedure. Organizations ready to move forward can explore ISO 27001 certification in the USA.
How IAS Supports Your ISO 27001 Journey
Integrated Assessment Services (IAS) provides ISO 27001 certification within its applicable UQAS accreditation scope. Where a JAS-ANZ-accredited certification route is applicable, IAS supports certification through its group company Empowering Assurance Systems (EAS). For ISO 27001 lead auditor training, IAS markets applicable CQI and IRCA Certified courses in association with EAS; EAS evaluates candidate eligibility, conducts the training and assessment, and manages the applicable course certification. For ISO 27001 internal auditor training, the course and certificate should be described according to the specific program being offered. Contact us to confirm the applicable route.
Frequently Asked Questions
What are the mandatory clauses of ISO 27001?
How many Annex A controls does ISO 27001:2022 have?
What documents are mandatory for ISO 27001?
Is the Statement of Applicability required?
Do I have to implement all 93 Annex A controls?
Which version of ISO 27001 should we certify against?
Contact Us
ISO 27001 Certification Cost
ISO 27001 Certification Cost: What Drives the Price
There is no single fixed price for ISO 27001 certification — the cost depends on factors such as your organization’s size, the scope of your Information Security Management System (ISMS), the complexity of your information systems, and the number of audit days your certification body requires. Rather than a flat fee, ISO/IEC 27001:2022 certification is priced against the effort needed to assess your ISMS and confirm it meets the standard. This guide explains what determines the cost of ISO 27001 certification and how to budget for it, so you can request an accurate quote and plan with confidence.
- Published
- Reading time
- — min
Because every organization has a different footprint, the most reliable way to learn how much ISO 27001 certification will cost you is to describe your scope and ask for a tailored proposal. The sections below break down the main cost drivers so you understand exactly what shapes that number.
What Determines the Cost of ISO 27001 Certification?
The cost of ISO 27001 certification is not arbitrary. Certification bodies and internal budgets both respond to a consistent set of variables. Understanding these helps you estimate spend before you ever receive a quote.
1. Organization Size (Employees and Sites)
Size is one of the biggest drivers of ISO 27001 certification cost. Auditors need to sample people, processes, and locations, so the number of employees and the number of physical or logical sites directly affect how many audit days are required. A small single-office team will need far fewer audit days than a multi-site enterprise with thousands of staff. This is also why the ISO 27001 certification cost for a small business is generally lower than for a large, distributed organization. If you operate across several locations, ask whether a multi-site sampling approach applies to your ISMS, as this can reduce the total number of days compared with auditing every site in full.
2. Scope of the ISMS
Scope defines what the certificate actually covers — which departments, services, locations, and information assets are included. A tightly defined scope (for example, a single product team or data center) keeps audit effort and cost down. A broad scope covering the whole organization increases both. Defining a clear, defensible scope is one of the most effective ways to control the cost of ISO 27001 certification. For help setting boundaries, see our guide to ISO 27001 requirements.
3. Complexity of Your Information Systems
Two organizations of the same headcount can have very different cost profiles. A company running many interconnected systems, cloud platforms, custom software, and third-party integrations presents more for an auditor to review than one with a simple, consolidated environment. Higher complexity means more evidence to examine and typically more audit time.
4. Number of Annex A Controls in Scope
ISO/IEC 27001:2022 includes a set of Annex A controls that organizations select based on their risk assessment. The number of controls you apply — and how they are implemented — influences the depth of the audit. An organization that needs a wide range of controls to address its risks will generally see a higher assessment effort than one with a narrower, well-justified control set.
5. Current Security Maturity
Your starting point matters. If you already have strong policies, documented processes, risk assessments, and security controls in place, you are closer to audit-ready and your internal preparation cost will be lower. If you are starting largely from scratch, expect to invest more in building the ISMS before certification. Maturity affects internal cost far more than the certification-body fee, but both feed into your total spend. Organizations that have previously implemented other management systems — or that already follow recognized security frameworks — often reach audit readiness faster, which reduces the time and effort needed before Stage 1.
6. Gap Analysis and Consultancy (Optional)
Many organizations begin with a gap analysis to compare their current state against the standard, and some engage consultants to help implement the ISMS. These services add cost but can reduce risk, shorten timelines, and lower the chance of nonconformities at audit. Whether you use them — and how much support you need — is a discretionary but meaningful line in your budget.
7. Certification Body Fees (Stage 1 + Stage 2 Audit)
The certification audit itself is delivered in two stages. Stage 1 reviews your documentation and readiness; Stage 2 assesses how your ISMS operates in practice. Fees are largely driven by the number of audit days, which in turn depend on your size, scope, and complexity. This is the core external cost of certification. When comparing proposals, take time to verify the certification body and the accreditation named on the certificate. Because audit days are calculated from your organization’s profile rather than a fixed rate card, two companies rarely receive identical quotes — which is why a scope-based proposal is far more useful than a generic price estimate. To understand what happens during assessment, read our overview of the ISO 27001 audit and the full ISO 27001 certification process.
8. Ongoing Surveillance and Recertification
ISO 27001 certification is not a one-time expense. The certificate is typically maintained over a three-year cycle that includes annual surveillance audits, followed by a recertification audit at the end of the cycle. When budgeting, account for these recurring costs — not just the initial certification. Surveillance audits are usually shorter than the initial Stage 2 audit but should be planned for every year.
9. Internal Costs (Staff Time, Tools, and Training)
Beyond the certification body’s fees, your organization carries internal costs that are easy to underestimate:
- Staff time to build, document, and operate the ISMS.
- Security tools and technology needed to implement controls.
- Training so employees understand the standard and their responsibilities — including specialist courses such as ISO 27001 Lead Auditor training for those running internal audits.
These internal investments often exceed the certification-body fee, especially for organizations building an ISMS for the first time.
How to Budget for ISO 27001 Certification
Because the ISO 27001 audit cost and overall certification cost are shaped by so many variables, the smartest approach is to plan around factors rather than chase a single headline number:
- Define your scope first. A clear scope is the single biggest lever on cost.
- Assess your maturity. Know how much implementation work stands between you and audit readiness.
- Separate one-time and recurring costs. Budget for the initial certification plus annual surveillance and three-year recertification.
- Account for internal effort. Staff time, tools, and training are real costs, not afterthoughts.
- Request a tailored quote. Share your size, scope, and system complexity to get an accurate figure.
For a broader view of how certification pricing works across standards, see our article on ISO certification cost.
Is ISO 27001 Certification Worth the Cost?
While ISO 27001 certification requires investment, it is best viewed against the value it delivers: a structured approach to protecting information, stronger resilience against security incidents, easier compliance with client and regulatory expectations, and a credible signal of trust to customers and partners. For many organizations, certification becomes a requirement to win contracts — turning the cost into an enabler of new business rather than a pure expense. Learn more about the standard on our ISO 27001 certification page.
Get an Accurate ISO 27001 Certification Quote
The only reliable way to estimate ISO 27001 certification cost is to have your scope and requirements reviewed. IAS can assess the organization size, ISMS scope, sites and complexity and prepare a proposal for certification within its applicable UQAS accreditation scope. Where the JAS-ANZ-accredited route is applicable, IAS supports certification through its group company EAS. Contact IAS for a scope-based quotation.
Frequently Asked Questions
How much does ISO 27001 certification cost?
Why does ISO 27001 certification cost vary so much between organizations?
What is the ISO 27001 certification cost for a small business?
Does ISO 27001 certification cost include annual fees?
What is the ISO 27001 audit cost based on?
How can I reduce my ISO 27001 certification cost?
Contact Us
ISO 27001 Certification Process
ISO 27001 Certification Process: A Step-by-Step Guide
The ISO 27001 certification process is a structured journey in which your organization defines the scope of its Information Security Management System (ISMS), assesses and treats information security risks, implements controls, and then passes an independent two-stage audit (Stage 1 and Stage 2) that leads to a certification decision. Once certified, your organization maintains its status through annual surveillance audits and a full recertification every three years. This guide walks through each step so you know exactly what to expect—from first planning meeting to certificate.
- Published
- Reading time
- — min
ISO/IEC 27001:2022 is the current version of the international standard for information security management. If your business collects, processes, or stores sensitive data, certification demonstrates to customers, regulators, and partners that you manage that information responsibly. Below, we break the journey into clear, sequential steps and answer the questions organizations ask most often.
What Is ISO 27001 and Who Gets Certified?
ISO/IEC 27001 is the leading international standard for building and running an Information Security Management System (ISMS). It takes a risk-based approach: rather than prescribing a fixed checklist, it asks you to identify the information security risks that matter to your business and apply appropriate controls to reduce them.
Certification is awarded to organizations, not individuals. A company, business unit, or defined site can be certified once it demonstrates a working ISMS that meets the standard’s requirements. Individuals earn competence through training and qualifications instead—more on that later.
The standard references 93 Annex A controls organized into four themes (organizational, people, physical, and technological). You select the controls relevant to your risks and document your choices in a Statement of Applicability (SoA). For a detailed look at what the standard demands, see our guide to the ISO 27001 requirements, and for budgeting guidance, review the typical ISO 27001 certification cost.
The ISO 27001 Certification Process: Step by Step
The path to certification follows a logical sequence. Here are the ISO 27001 certification steps most organizations take.
Step 1. Secure Management Support and Define the Scope
Every successful ISMS starts with leadership commitment. Top management must back the project, assign responsibilities, and allocate resources. With that support in place, define the scope of your ISMS: which parts of the organization, locations, systems, and information assets the certification will cover. A clear, well-reasoned scope keeps the project focused and prevents wasted effort later.
Step 2. Perform a Gap Analysis
A gap analysis compares your current information security practices against the requirements of ISO/IEC 27001:2022. It reveals what you already have in place and what still needs to be built or documented. Think of this as your roadmap: it tells you how much work lies ahead and helps you plan realistic timelines and budgets. Many organizations use the gap analysis findings to prioritize their implementation activities.
Step 3. Conduct a Risk Assessment
Because ISO 27001 is risk-based, the risk assessment is the heart of the process. Identify the information security risks facing the assets within your scope—threats, vulnerabilities, and the potential impact if something goes wrong. Assess each risk consistently using a defined methodology so results are repeatable and comparable. This step produces a prioritized picture of where your organization is most exposed.
Step 4. Build Your Risk Treatment Plan and Select Annex A Controls
Once risks are assessed, decide how to treat each one: reduce it, avoid it, transfer it, or accept it. Where you choose to reduce risk, select appropriate controls from the 93 controls in Annex A. Document your decisions in the Statement of Applicability (SoA), which lists each control, whether it applies, and your justification for including or excluding it. The SoA and the risk treatment plan are cornerstone documents that auditors will examine closely.
Step 5. Build and Document the ISMS
With risks and controls decided, build out the ISMS itself. This means writing the policies, procedures, and records the standard requires—information security policy, roles and responsibilities, and operational documentation that shows how your controls work in practice. Keep documentation practical and aligned to how your organization actually operates; auditors look for evidence that the ISMS reflects real activity, not paperwork created for show.
Step 6. Implement and Operate the ISMS
Put the ISMS into daily practice. Roll out the controls, communicate policies across the organization, and deliver awareness training so staff understand their information security responsibilities. Let the system run long enough to generate records—logs, meeting minutes, incident reports, and control evidence. This operating period is important: the audit later looks for proof that your ISMS is not just designed but genuinely working.
Step 7. Carry Out an Internal Audit
An internal audit checks your own ISMS against the standard’s requirements before an external body ever visits. It surfaces nonconformities and improvement opportunities while you still have time to fix them. Internal auditors should be competent and impartial—many organizations train staff through an ISO 27001 internal auditor training course so they can perform these audits credibly.
Step 8. Hold a Management Review
Leadership then reviews the ISMS’s performance: audit results, risk status, incidents, objectives, and opportunities for improvement. The management review confirms that the ISMS remains suitable, adequate, and effective, and that resources and priorities are still aligned. It closes the internal preparation loop and signals readiness for external assessment.
Step 9. Stage 1 Audit — Documentation and Readiness Review
Now the external certification body steps in. The Stage 1 audit is a documentation and readiness review. The auditor examines your ISMS documentation—scope, policies, risk assessment, risk treatment plan, and Statement of Applicability—to confirm the system is designed correctly and that you are ready for the deeper Stage 2 assessment. Any gaps identified here give you a chance to correct course before the main audit.
Step 10. Stage 2 Audit — Implementation and Effectiveness
The Stage 2 audit evaluates whether your ISMS is actually implemented and effective. The auditor gathers evidence on site (or remotely) by reviewing records, interviewing staff, and observing controls in action. They verify that what your documentation promises is happening in practice. If nonconformities are raised, you address them with corrective action. For a fuller explanation of what happens during each assessment, see our guide to the ISO 27001 audit and our general ISO audit procedure.
Step 11. Certification Decision
After Stage 2, the applicable certification decision process reviews the audit findings. If the ISMS meets the requirements and any nonconformities are resolved, certification may be issued for the defined scope. IAS provides certification within its applicable UQAS accreditation scope. Where the JAS-ANZ-accredited route is applicable, the certification activity is conducted through IAS’s group company EAS, within EAS’s approved scope.
Step 12. Surveillance Audits and Recertification
Certification is not a one-time event. The certificate is typically valid for three years, during which the certification body conducts annual surveillance audits to confirm your ISMS continues to operate and improve. At the end of the three-year cycle, a full recertification audit renews your certificate. Maintaining certification means treating your ISMS as a living system—continually monitoring, reviewing, and improving it.
To understand the wider service that supports this journey, you can also review our ISO 27001 certification page.
How Long Does the ISO 27001 Certification Process Take?
Timelines vary with the size and complexity of your organization and how mature your existing controls are. A small business with good practices already in place may move through the process in a few months, while a larger enterprise building an ISMS from scratch can take a year or more. The gap analysis in Step 2 is the best way to estimate your own timeline, because it shows how much implementation work stands between you and the Stage 1 audit.
Preparing Your Team for the Process
A capable team makes the process smoother. Beyond internal auditor skills, organizations often develop lead auditors and ISMS specialists through structured courses. Explore ISO 27001 lead auditor training to build in-house expertise, and check the current training schedule for upcoming sessions. Well-trained people help you implement controls correctly, run credible internal audits, and sustain the ISMS after certification.
Ready to begin? Contact us to discuss where your organization stands and map out your route to ISO/IEC 27001:2022 certification.
Frequently Asked Questions
What are the main steps in the ISO 27001 certification process?
What is the difference between the Stage 1 and Stage 2 audits?
Do I need an internal audit before external certification?
What is a Statement of Applicability (SoA) and why does it matter?
How long is an ISO 27001 certificate valid?
Is ISO 27001 certification awarded to individuals or organizations?
Contact Us
ISO 27001 Audit
ISO 27001 Audit: Types, Stages, and How to Prepare
An ISO 27001 audit is a systematic, evidence-based review of your Information Security Management System (ISMS) to confirm it conforms to the requirements of ISO/IEC 27001:2022. In practice, “audit” covers several related activities: the internal audit your own organization runs under clause 9.2, the two-part certification audit (Stage 1 and Stage 2) carried out by an independent certification body, and the ongoing surveillance and recertification audits that keep your certificate valid over its three-year cycle. Understanding how each audit works — and what an auditor actually looks for — is the difference between a smooth assessment and a list of nonconformities.
- Published
- Reading time
- — min
This guide explains each audit type, what auditors check against clauses 4 to 10 and the applicable Annex A controls, how to prepare, and the auditor competence that sits behind a credible result. For the full certification journey from application to certificate, see our ISO 27001 certification process guide.
Why the ISO 27001 audit matters
The audit is the mechanism that turns a documented ISMS into a trusted one. Anyone can write a security policy; an audit tests whether that policy is implemented, followed, and effective. For your organization, audits surface gaps before an attacker or a regulator does, drive continual improvement, and provide the independent assurance that customers and partners increasingly demand in contracts and vendor questionnaires.
It is worth being precise about what gets certified. ISO 27001 certification is awarded to organizations, not to individuals. People earn qualifications — through ISO 27001 lead auditor training or ISO 27001 internal auditor training — so they can competently plan and conduct audits, but the certificate itself belongs to the ISMS of the organization that meets the standard.
The different types of ISO 27001 audit
There are two broad families of ISO 27001 audit: internal (first-party) audits that you run on yourself, and external (third-party) audits conducted by an accredited certification body. The external family then breaks into Stage 1, Stage 2, surveillance, and recertification assessments.
1. ISO 27001 internal audit (clause 9.2)
The internal audit is a mandatory requirement of ISO 27001. Clause 9.2 requires your organization to conduct internal audits at planned intervals to determine whether the ISMS conforms both to the organization’s own requirements and to the requirements of the standard, and whether it is effectively implemented and maintained.
Two principles matter here. First, internal audits must be planned against a program that considers the importance of the processes and the results of previous audits. Second, auditors must be selected to ensure objectivity and impartiality — auditors should not audit their own work. A member of the security team can audit HR or IT operations, but ideally should not audit the controls they personally designed and run. Many organizations build this independence by training several staff through internal auditor training so they can audit across departments.
The internal audit is your dress rehearsal. Done honestly, it finds the weaknesses a certification auditor would find — while you still have time to fix them.
2. Stage 1 certification audit (documentation and readiness review)
Once your ISMS has been operating for a reasonable period, an accredited certification body conducts the Stage 1 audit. This is a documentation and readiness review. The auditor confirms that the mandatory ISMS documentation exists and is coherent: the ISMS scope, the information security policy, the risk assessment and risk treatment methodology, the Statement of Applicability (SoA), the risk treatment plan, and records of internal audit and management review.
Stage 1 has two purposes: to verify that you are ready for the more rigorous Stage 2, and to plan that assessment. The auditor also checks that your SoA justifies the inclusion or exclusion of each of the 93 Annex A controls, organized across the four themes — organizational, people, physical, and technological. A weak or contradictory SoA is one of the most common Stage 1 findings.
3. Stage 2 certification audit (implementation and effectiveness)
The Stage 2 audit is where certification is genuinely earned. Conducted on-site or remotely, it assesses whether your ISMS is actually implemented and effective — not just documented. The auditor gathers objective evidence by sampling records, observing processes, and interviewing staff, then evaluates conformity against clauses 4 to 10 of the standard and every Annex A control you declared applicable in your SoA.
Expect the auditor to trace threads end to end: from a risk identified in your assessment, to the control chosen to treat it, to evidence that the control operates as intended. Access reviews, change records, incident logs, supplier assessments, backup and restore tests, and awareness training records are all typical sampling points. If the auditor finds nonconformities, they are classified as major or minor; majors must be resolved before a certificate can be recommended.
4. Surveillance audits
Certification is not a one-time event. After your certificate is issued, the certification body conducts surveillance audits, usually annually, to confirm that the ISMS remains conforming and continues to improve. Surveillance audits are narrower than the full Stage 2 assessment — the auditor samples a subset of the ISMS each visit — but they always review core areas such as internal audit, management review, corrective actions, complaints, and any changes to scope or risk.
5. Recertification audit
Because an ISO 27001 certificate is valid for three years, a recertification audit takes place before it expires. This is a comprehensive reassessment, similar in depth to Stage 2, that evaluates the continued conformity and effectiveness of the whole ISMS and considers its performance across the full certification cycle. A successful recertification renews the certificate for another three years.
What an ISO 27001 auditor checks
Across all of these audits, the auditor is testing the same fundamental question in different depths: does the ISMS meet the requirements, and does it work? Concretely, an auditor examines:
- Clauses 4 to 10 — context of the organization, leadership, planning (including risk assessment and treatment), support, operation, performance evaluation, and improvement.
- Applicable Annex A controls — the subset of the 93 controls your SoA declares relevant, with evidence that each operates.
- The Statement of Applicability — that every control is justified as included or excluded and mapped to your risk treatment.
- Records and evidence — sampled, not exhaustively reviewed, to form a representative picture of conformity.
- Effectiveness, not just existence — whether controls achieve their intended information security outcomes.
Auditors do not check every record; they sample. That means consistent, well-organized evidence matters more than volume. A tidy control that produces reliable records will outperform an elaborate control with patchy documentation.
How to prepare for an ISO 27001 audit
Preparation is mostly about closing the gap between what your documents say and what your people do. A practical checklist:
- Run a genuine internal audit first. Treat clause 9.2 seriously and audit the full ISMS against clauses 4 to 10 and your applicable controls. Use an ISO 27001 audit checklist built from the standard and your SoA.
- Clean up your SoA and risk treatment plan. Ensure every Annex A control has a clear applicability decision and a rationale that matches your risk assessment.
- Complete a management review. Leadership must demonstrably review ISMS performance, resources, and improvement opportunities.
- Close corrective actions. Open nonconformities from previous internal audits should be resolved, with evidence of root-cause analysis.
- Organize your evidence. Make records for access control, incident management, supplier security, backups, and training easy to retrieve — auditors sample, and slow retrieval erodes confidence.
- Brief your people. Staff should be able to explain, in their own words, the parts of the ISMS they own. Interviews are a core evidence source at Stage 2.
For the broader picture of how assessments are planned and conducted across management systems, our ISO audit procedure overview is a useful companion.
The ISO 19011 approach and auditor competence
ISO 27001 audits are conducted in line with the principles of ISO 19011, the international guidance for auditing management systems. ISO 19011 sets out the discipline behind a credible audit: integrity, fair presentation, due professional care, confidentiality, independence, and an evidence-based approach. It also frames the audit as a managed program — planning, conducting, reporting, and following up — rather than a single visit.
Competence is central to that approach. An audit is only as reliable as the auditor performing it, which is why formal training matters. Individuals who will lead certification-style assessments typically complete ISO 27001 lead auditor training, while those maintaining an in-house program take ISO 27001 internal auditor training. You can view upcoming sessions on the IAS training schedule.
Certification and training roles should be described accurately and separately. IAS provides certification within its applicable UQAS accreditation scope and markets applicable Lead Auditor training in association with EAS. EAS holds JAS-ANZ accreditation for applicable certification activities and is a CQI and IRCA Approved Training Partner for applicable certified Lead Auditor courses. EAS handles the applicable candidate evaluation, training and assessment for those programs. Keeping these roles distinct supports clear communication about impartiality and responsibility.
If you are ready to plan your ISMS assessment or enroll your team in auditor training, contact us to discuss the right path. You can also explore full ISO 27001 certification in the USA or browse the wider range of standards on our ISO certification hub.
Frequently Asked Questions
What is the difference between an internal audit and a certification audit for ISO 27001?
What happens in a Stage 1 versus a Stage 2 ISO 27001 audit?
How often are ISO 27001 surveillance audits conducted?
What does an ISO 27001 auditor check?
Who can conduct an ISO 27001 internal audit?
How do I prepare my ISMS to pass an ISO 27001 audit?
Contact Us
ISO 27001 Standard
What Is the ISO 27001 Standard? A Complete Overview
The ISO 27001 standard is the international standard for information security management, specifying the requirements for an Information Security Management System (ISMS) — a risk-based framework organizations use to protect the confidentiality, integrity, and availability of their information. Published by ISO and IEC, it gives businesses of any size a structured, auditable way to identify security risks, apply the right controls, and prove to customers and regulators that information is being managed responsibly. This overview explains what the standard covers, how it is structured, what the Annex A controls are, who it applies to, and why it matters.
- Published
- Reading time
- — min
ISO 27001 Standard: An Overview
ISO/IEC 27001 is the only widely recognized international standard that sets out formal requirements for an ISMS. Rather than dictating a fixed checklist of technologies, it establishes a management-system approach: you understand your organization’s context, assess information security risks, decide how to treat those risks, and continually improve. Because it is risk-based, the standard adapts to a two-person startup or a global enterprise alike.
The current version is ISO/IEC 27001:2022, published in October 2022. It replaced the previous ISO 27001:2013 edition, and the transition period for older 2013 certificates ended on 31 October 2025. As a result, ISO/IEC 27001:2022 is now the only current and valid version of the standard — any organization certifying today does so against the 2022 edition.
A key point that often causes confusion: ISO 27001 certifies organizations, not individuals. A company earns certification for its ISMS after an independent audit. Individuals build their competence through training and qualifications such as Lead Auditor or Internal Auditor courses, which are separate from an organization’s certificate.
What Is an Information Security Management System (ISMS)?
An Information Security Management System (ISMS) is the heart of the ISO 27001 standard. It is not a single piece of software or a firewall — it is a coordinated set of policies, procedures, people, and technical measures that work together to manage information security in a systematic, repeatable way.
The ISMS is built around three core objectives, often called the CIA triad:
- Confidentiality — ensuring information is accessible only to those authorized to see it.
- Integrity — safeguarding the accuracy and completeness of information and processing methods.
- Availability — ensuring authorized users can access information and associated assets when needed.
Instead of reacting to incidents one at a time, an ISMS asks the organization to look at all its information assets, assess what could go wrong, and put proportionate controls in place. It then requires ongoing monitoring, internal audits, and management review so the system keeps pace with new threats — a cycle of continual improvement.
How the ISO 27001 Standard Is Structured
The ISO 27001 standard has two main parts: the mandatory management-system clauses and Annex A.
Mandatory clauses (4–10)
Clauses 4 through 10 contain the requirements every certified organization must meet. In plain terms, they cover:
- Clause 4 — Context of the organization: understanding internal and external issues, interested parties, and defining the ISMS scope.
- Clause 5 — Leadership: top management commitment, an information security policy, and clear roles and responsibilities.
- Clause 6 — Planning: risk assessment, risk treatment, and setting security objectives.
- Clause 7 — Support: resources, competence, awareness, communication, and documented information.
- Clause 8 — Operation: carrying out the risk assessment and implementing the risk treatment plan.
- Clause 9 — Performance evaluation: monitoring, measurement, internal audit, and management review.
- Clause 10 — Improvement: handling nonconformities, corrective action, and continual improvement.
These clauses are where the “management system” lives. For a clause-by-clause breakdown of exactly what each one demands, see our detailed guide to the ISO 27001 requirements.
Annex A controls
Alongside the clauses, Annex A provides a catalog of information security controls that organizations draw on to treat the risks they identify. Annex A is not a list you must implement in full — you select the controls that apply to your risks and justify your choices.
The Annex A Control Themes (2022)
In the 2022 edition, Annex A was restructured. It now contains 93 controls grouped into four themes:
- Organizational controls (37) — policies, roles, supplier relationships, threat intelligence, and information security in project management.
- People controls (8) — screening, terms of employment, awareness and training, and remote-working responsibilities.
- Physical controls (14) — secure areas, equipment protection, clear desk and clear screen, and secure disposal.
- Technological controls (34) — access control, cryptography, secure development, logging, and protection against malware.
This four-theme structure replaced the 14-domain layout used in the 2013 edition, making the controls easier to navigate and map to modern security practices.
The Statement of Applicability (SoA)
Because organizations choose which Annex A controls apply, the standard requires a Statement of Applicability (SoA). The SoA lists all Annex A controls, states whether each is included or excluded, and explains why. It is one of the most scrutinized documents in a certification audit, because it ties your control selection directly back to your risk assessment.
Who Is the ISO 27001 Standard For?
The ISO 27001 standard is deliberately sector-agnostic. It applies to any organization that handles information worth protecting, including:
- Technology and SaaS companies that store customer data and need to satisfy security questionnaires.
- Financial and professional services handling sensitive client and transaction information.
- Healthcare providers managing patient records and privacy obligations.
- Government contractors and suppliers required to demonstrate strong information security.
- Any business that wants to reduce cyber risk and build customer trust.
Whether you are a small managed-service provider or a multinational, the standard scales to your scope, your risks, and your resources.
Why the ISO 27001 Standard Matters
Adopting the ISO 27001 standard delivers benefits that go well beyond a certificate on the wall:
- Reduced risk of breaches: a structured risk-treatment process helps you find and close gaps before they are exploited.
- Customer and market trust: certification is increasingly a prerequisite in vendor onboarding and tenders, especially with enterprise buyers.
- Regulatory alignment: the ISMS framework supports compliance with data protection and privacy obligations.
- Operational resilience: clear roles, procedures, and incident handling reduce downtime and confusion when something goes wrong.
- Continual improvement: built-in audits and reviews keep your security posture current instead of letting it drift out of date.
In a landscape where a single incident can damage reputation and revenue, a recognized, independently audited framework gives stakeholders confidence that information security is being taken seriously.
The ISO 27000 Family of Standards
ISO 27001 does not stand alone. It sits within the broader ISO/IEC 27000 family of information security standards that support and expand on it. For example, ISO/IEC 27002 provides implementation guidance for the Annex A controls, while other standards in the family address risk management, cloud services, and privacy. When people refer to “the ISO 27001 standard,” they usually mean the certifiable requirements standard — ISO 27001 itself — supported by these companion documents.
How Organizations Get Certified
At a high level, an organization implements its ISMS, runs internal audits, and then engages an accredited certification body for an independent, two-stage audit. Passing leads to certification, followed by periodic surveillance audits to confirm the ISMS stays effective. If you want the full journey, our guides to the ISO 27001 certification process and the ISO 27001 audit walk through each stage.
To build the internal competence needed to run and audit an ISMS, teams often pursue ISO 27001 Lead Auditor training or ISO 27001 Internal Auditor training. When you are ready to pursue the certificate itself, IAS offers ISO 27001 certification for organizations across the USA. IAS delivers accredited certification and training through its global network, and works alongside partner bodies such as EAS to support clients worldwide. To discuss your scope and next steps, contact us and our team will guide you through the options.