{"id":4433,"date":"2021-10-22T09:02:54","date_gmt":"2021-10-22T09:02:54","guid":{"rendered":"https:\/\/ias-certification.com\/ca\/?p=4433"},"modified":"2026-06-11T05:29:36","modified_gmt":"2026-06-11T05:29:36","slug":"iso-27001-requirements","status":"publish","type":"post","link":"https:\/\/ias-certification.com\/ca\/blog\/iso-27001-requirements\/","title":{"rendered":"ISO 27001 Requirements"},"content":{"rendered":"

ISO 27001 Requirements<\/h1>
<\/div><\/div><\/div>\n
<\/span><\/span><\/div>\n

About ISO 27001 requirements<\/span><\/strong><\/h2>\n

Looking to obtain ISO 27001 certification but unsure exactly what is required? This guide explains the key documents and processes you will need to prepare your organization for certification.<\/p>\n

About ISO 27001<\/span><\/strong><\/h3>\n

ISO\/IEC 27001<\/a> <\/span><\/strong><\/span>– currently the 2022 edition – is the international standard for an information security management system (ISMS) and its continual improvement. It sets out control mechanisms organizations can use to protect their customers’ and clients’ personal information from security risks and attacks. Implementing it builds customer confidence in your operations and security.<\/p>\n

\"ISO<\/h2>\n

ISO 27001 documentation<\/span><\/strong><\/h3>\n

ISO 27001 does not impose a single, one-size-fits-all security approach, because every organization faces unique information security concerns. Instead, the standard requires you to develop the processes and policies that suit your context – and by demonstrating these, you show successful implementation. The key documents include the following.<\/p>\n

Scope of the ISMS<\/span><\/strong><\/h3>\n

This document outlines the operations the Information Security Management System (ISMS)<\/a><\/span><\/strong><\/span> will cover and the boundaries that apply. It describes the products and services your company offers and where (regionally, across Canada, across North America, or worldwide), and specifies which parts of the organization – processes, locations, departments, and divisions – are within the ISMS.<\/p>\n

Information Security Policy and objectives: <\/strong>A statement that your organization’s objective is to handle data securely, in line with applicable laws and ethical obligations, and with a commitment to continual improvement.<\/p>\n

Risk assessment and treatment methodology: <\/strong>How you identify information security risks and how you plan to mitigate and resolve them when they arise.<\/p>\n

Statement of Applicability (SoA)<\/span><\/strong><\/h3>\n

The Statement of Applicability explains which of the 93 information security controls in Annex A of ISO\/IEC 27001:2022 you apply, and why. (The 2022 revision reorganized Annex A into 93 controls across four themes – Organizational, People, Physical, and Technological – replacing the 114 controls in 14 categories used by the 2013 version.) In the SoA you:\u00a0<\/em><\/p>\n