ISO/IEC 27001:2022 is the international standard that defines the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The 2022 revision modernizes the standard and aligns it with current technological and threat landscapes.
Below is a detailed breakdown of all the core requirements outlined in Clauses 4–10 of the standard, plus an overview of the Annex A controls.
Identify internal and external issues relevant to your purpose and that affect your ability to achieve the intended ISMS outcomes.
Determine stakeholders (e.g., customers, regulators, partners) and their requirements regarding information security.
Define the boundaries of the ISMS considering external/internal issues, interfaces, and dependencies.
Establish, implement, maintain, and continually improve the ISMS according to the ISO 27001 requirements.
Top management must actively lead and support the ISMS.
Create and communicate a high-level policy that is appropriate, supports the ISMS, and is regularly reviewed.
Assign roles and responsibilities for information security clearly.
Plan actions to address issues identified in Clause 4.
6.1.2 Information Security Risk Assessment – Establish and maintain a risk assessment process.
6.1.3 Information Security Risk Treatment – Establish and apply a treatment plan based on the risk assessment.
Set measurable information security objectives and determine how to achieve them.
Provide the resources necessary for the ISMS.
Ensure staff are competent based on education, training, or experience.
Employees should be aware of the ISMS policy, their roles, and the implications of not conforming.
Determine what needs to be communicated, when, with whom, and by what methods.
7.5.1 General – Maintain necessary documentation for the ISMS.
7.5.2 Creating and Updating – Ensure proper document control.
7.5.3 Control of Documented Information – Protect information from loss, unauthorized access, or corruption.
Plan and implement the processes needed to meet ISMS requirements and control risks.
Perform risk assessments at planned intervals or when significant changes occur.
Implement and manage the controls selected during risk treatment.
Determine what to monitor, how, and when. Analyze and evaluate results to assess ISMS effectiveness.
Conduct regular audits to ensure ISMS conformity and effectiveness.
Top management must periodically review the ISMS to ensure its continuing suitability, adequacy, and effectiveness.
React to nonconformities, take corrective actions, and evaluate the effectiveness of those actions.
Continually improve the suitability, adequacy, and effectiveness of the ISMS.
