certification
ISO 27001
A voluntary standard for running security as a management system. No law requires it. Customers often do, and it gives the laws a structure to hang on.
at a glance
- what it is
- An international standard, ISO/IEC 27001:2022, with one amendment listed by ISO.
- who it covers
- Whoever chooses it, or whose customer contract requires it.
- who checks
- A certification body, against a scope you define.
- penalties
- None under law. You can lose the certificate or the contract.
- legal weight
- NIS2 says to take standards into account. That does not make a certificate proof of compliance.
basis NIS2 Art. 21(1)
does it apply to you?
A few questions, answered in your browser, tell you which rules are yours. Nothing is sent anywhere.
find my ruleswhat the standard adds: a loop
- 1scopewhat is in, what is out
- 2risk assessmentand how you treat each risk
- 3controlschosen from annex A, exclusions explained
- 4internal auditdoes it run?
- 5management reviewwhat changes
every year, with a certification body checking the cycle
basis ISO/IEC 27001:2022, structure as commonly published. Not re-read at source.
the whole job, in order
Phases, with who carries each step and the proof it leaves. Open a phase to see its steps.
- decide whether to certify, and what for
Find out who needs the certificate, what they would accept instead and which part of the company it should cover.
- check where you stand
Compare what you do today with what the standard asks, and turn the differences into a list of work.
- build the management system
Write the rules, run the risk work and put the controls in place for everything inside the scope.
- audit yourself and review with management
Check that the system runs as written, and put the results in front of management.
- pass the external audit
Choose a certification body, go through its audit and deal with what it finds.
- keep it alive each year
Run the system through the year, repeat the audit and review, and meet the certification body's follow-up.
what a certificate does and does not show
Read this before a customer asks you for one.
anyone, voluntarily; customers and tenders often ask
a security management system, assessed by a certification body
what it asks, and ways to meet it
The rule says what must be true in the company. It names no tools or methods: you choose them, and the people implementing it and the board answer for the choice. Under each requirement are the controls that usually deliver it. That grouping is our reading of the rule, not a list from the act.
- also in the plan
the long read
The full explanation, section by section, with the sources.