ISO 27001 in plain words: what it asks of a business, and what certification means

ISO describes ISO/IEC 27001 as the best-known standard for information security management systems, and says it "defines requirements an ISMS must meet". An information security management system is the way a business decides which information matters, works out what could go wrong with it, chooses what to do about each risk, and checks that the answer keeps working. The standard applies to any size of organisation in any sector.

The current edition is ISO/IEC 27001:2022, the third, published in October 2022 and 19 pages long. One amendment followed in 2024, on climate action. ISO lists the 2013 edition as withdrawn.

The requirements sit in the body of the standard. NSAI sets them out under seven headings, and its summary of what certification needs a business to show is the clearest short version:

Annex A lists 93 information security controls, which NSAI groups under four themes: organisational, people, physical and technological. ISO's own examples of what they cover include access control, cryptography, staff security and incident response.

A business does not have to use all 93. It decides which apply from its own risk assessment, and records each decision, with the reasons, in a document the standard calls the Statement of Applicability. A one-room office with all its systems in the cloud may exclude physical controls that a business with its own server room needs.

ISO publishes the guidance for each control separately, as ISO/IEC 27002:2022. ISO's own summary of the difference is that ISO/IEC 27001 sets out the requirements for the management system, and ISO/IEC 27002 gives best practice for the controls.

ISO writes the standard and certifies nobody. Its certification page says plainly that ISO "does not perform certification or issue certificates", and that certification is done by external certification bodies. An accreditation body checks that a certification body is competent; in Ireland that is the Irish National Accreditation Board (INAB). ISO says accreditation is not compulsory, but a certificate from an accredited body carries independent confirmation of the certifier's competence.

NSAI, which certifies to the standard, describes the steps as an application and quotation, a stage 1 audit (a preliminary assessment), a stage 2 audit (the certification assessment), surveillance audits after that, and recertification at set intervals. ISO also asks that a certificate be quoted in full, for example "certified to ISO/IEC 27001:2022".

Certification bodies had until 31 October 2025 to move their clients to the 2022 edition. INAB's notice gives that date for every certification body it accredits, and NSAI's transition policy says its certificates to the old edition expired on that day and were withdrawn. A supplier that still shows a certificate to the 2013 edition in 2026 is showing one that has expired.

NSAI is direct about data protection: certification "does not in itself demonstrate legal compliance", though it can provide structured evidence of controls that help meet data protection obligations. The GDPR's own requirements still apply in full; our guide to the GDPR for an Irish small business covers them.

And a business with no customer asking for a certificate may not need one. Our comparison of ISO 27001, CyFun and Cyber Essentials sets out which is asked for where, and what each involves.

For a business whose customer has asked for a certificate, the order NSAI's own method follows comes down to four steps: