ISO/IEC 27001:2022
Certification ISO/IEC 27001 – Information security
Protecting confidentiality, integrity and availability of information.
What the standard is
ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection – Information security management systems – Requirements
ISO/IEC 27001:2022 sets out the requirements for an Information Security Management System (ISMS). Its main aim is to manage risk and protect the organisation's information and ICT assets in terms of confidentiality, integrity and availability.
The standard specifies requirements for establishing, implementing, maintaining and continually improving a documented system in the context of the organisation's business risks, and requires the selection of adequate and proportionate security controls (Annex A, aligned with ISO/IEC 27002:2022).
It applies to all organisations, public and private, in any sector. The transition period from the 2013 edition ended on 31 October 2025: ISO/IEC 27001:2013 certificates are no longer valid and new certificates are issued against the 2022 edition.
Availability and accredited scope for each standard and sector are confirmed in the offer.
Benefits
- Structured approach to information risks
- Answers to customer security questionnaires
- Foundation for other security and privacy requirements
- Greater staff awareness
How certification works
Request and offer, Stage 1 audit (documentation) and Stage 2 (system effectiveness), independent certification decision, then annual surveillance and three-year renewal.
See the full processDocuments typically requested before Stage 1
- Description of the management system and scope
- Up-to-date company registration extract
- Results of the latest internal audit
- Management review minutes
Frequently asked questions
What is the Statement of Applicability?+
It lists the Annex A controls, states whether they are applied and justifies their inclusion or exclusion.
Are 2013 certificates still valid?+
The transition period to the 2022 version has ended; certificates are issued against ISO/IEC 27001:2022.
Can only part of the company be certified?+
Yes, the scope can cover specific services, sites or processes, provided it is clearly defined.
Request a quote for ISO/IEC 27001
Related standards
Request a free quote
Tell us about your company: we will send a clear, no-obligation offer.