Where information is stored, who can access it, how outsourced services are managed, and who responds to incidents are everyday information-security questions. An ISMS connects risk treatment, controls, and evidence of implementation.
Current edition and transition
The current basis is ISO/IEC 27001:2022 with Amendment 1:2024. The 2022 edition replaced the 2013 edition and retains clauses 4–10 and a risk-based approach. Its principal changes include restructuring Annex A controls and clarifying change planning, process interactions, roles, objectives, and management review. ISO/IEC 27001 specifies ISMS requirements; ISO/IEC 27002:2022 provides implementation guidance for information-security controls.
The transition deadline for accredited organizations certified to the 2013 edition was 31 October 2025 under IAF MD 26:2023. The historical transition period has ended. Organizations still operating the former edition should confirm current requirements and application arrangements with their certification body. A certificate does not prove that every system is free of vulnerabilities or that all privacy and cybersecurity laws have been met.
Amendment 1:2024 asks organizations to determine whether climate change is a relevant issue and notes that interested parties may have climate-related requirements. Assess relevant scenarios, such as heat, flooding, power supply, or alternate-site resilience; this does not automatically require every organization to conduct a carbon inventory.
Annex A and risk treatment
The 2022 edition reorganized Annex A from 114 controls in 14 domains into 93 controls across four themes. The reduced count does not justify deleting existing measures without review. The four themes are organizational, people, physical, and technological controls. Eleven controls were added, covering areas such as threat intelligence, cloud services, ICT readiness for business continuity, physical monitoring, configuration, information deletion, data masking, data leakage prevention, monitoring activities, web filtering, and secure coding.
Select controls based on assessed risks and treatment decisions. The Statement of Applicability (SoA) records necessary controls, their implementation status, and reasons for inclusion or exclusion. Keep it consistent with the risk-treatment plan and operating evidence. ISO/IEC 27002 attributes can help sort or view controls; they do not create a mandatory SoA field by themselves.
Practical implementation stages
- Confirm the ISMS scope, information assets, locations, dependencies, and interested-party requirements.
- Define risk criteria and assess confidentiality, integrity, availability, legal duties, and business impact for relevant information and processes.
- Select treatment actions and applicable Annex A controls; document decisions in the risk plan and SoA.
- Assign owners and resources, implement controls, and retain evidence such as access reviews, supplier checks, backup tests, incident exercises, and training.
- Monitor performance and changes, investigate incidents, and update risks when systems, suppliers, or business purposes change.
- Conduct internal audit and management review, close corrective actions, and coordinate certification arrangements with an independent certification body.
Information to prepare
ISMS scope and system diagrams; information-asset and supplier registers; risk assessments and treatment plans; access, backup, incident, and training records; current SoA; and relevant legal or contractual obligations. Share sensitive examples only after access and retention arrangements are agreed.
Service scope
Support may be discussed for scope and gap review, risk assessment facilitation, SoA alignment, training, internal audit, and audit preparation. Deliverables, timing, and fees are agreed after needs are understood. Certification decisions remain with the independent certification body.