ISO 27001
Everything ISO 27001 asks of you, on one page.
ISO 27001 has two parts that people mix up. Clauses 4 to 10 are requirements: every one applies, with no opting out. Annex A is a reference list of controls, which you compare against your risks and record in the Statement of Applicability (SoA). This page lists both and points to the guide that covers each piece in depth.
Back to ISO 27001 services01 · How it is built
Mandatory clauses, then a control reference
Clauses 0 to 3 introduce. Clauses 4 to 10 require. Annex A informs your choice.
- Requirement clauses
- 7
- Clauses 4 to 10, all mandatory
- Annex A controls
- 93
- In four themes, chosen by risk
- Statement of Applicability
- 1
- Where the two parts meet
The clauses follow the common structure ISO uses for management system standards, so anyone who has run ISO 9001 will recognise the shape. The security content lives in the risk work of clauses 6 and 8 and in the controls you select.
02 · Clause by clause
Clauses 4 to 10 in plain words
One row per clause: the obligation and the evidence that usually shows it.
| Clause | What it obliges you to do | Typical evidence |
|---|---|---|
| 4 Context of the organization | Understand the issues and interested parties that shape your security, decide the scope, and run an ISMS | Context and interested-party register, scope statement |
| 5 Leadership | Top management leads visibly: sets the policy, assigns roles, provides backing | Approved security policy, role assignments, sponsor minutes |
| 6 Planning | Assess and treat risk by a repeatable method, set security objectives, plan changes to the ISMS | Risk method, risk register, treatment plan, SoA, objectives |
| 7 Support | Provide resources, ensure competence and awareness, communicate, and control documents | Training records, competence evidence, document control |
| 8 Operation | Carry out the plans, repeat risk assessment at intervals and on change, and implement treatment | Operating records, updated risk assessments, treatment progress |
| 9 Performance evaluation | Measure what matters, run internal audits, and hold management reviews | Metrics, audit programme and reports, review minutes |
| 10 Improvement | Fix nonconformities at the root, and keep improving the system | Corrective action log with root cause and verification |
- Clause 4Clause 4: context of the organisationYour context, interested parties and the boundary of the ISMS.
- Clause 5Clause 5: leadershipWhat top management must do, say and be able to show.
- Clause 6Clause 6: planningRisks, objectives and planned change, as the standard sequences them.
- Clauses 6 and 8Risk assessment and treatmentA method that is repeatable, with the records an auditor reads.
- Clause 7Clause 7: supportResources, competence, awareness and communication.
- Clause 8Clause 8: operationRunning the risk work you planned, and keeping the evidence.
- Clause 9Clause 9: performance evaluationMeasuring, auditing and reviewing the system.
- Clause 10Nonconformity and corrective actionFrom a finding to a fix that holds, with root cause.
03 · Key sub-requirements
The sub-requirements that generate most of the work
A few sub-clauses carry most of the effort and most audit findings.
- 4.3 Scope
- The boundary of the ISMS, including where it meets things outside it.
- 6.1.2 and 6.1.3 Risk assessment and treatment
- The method, the results, the chosen treatments and the SoA.
- 7.5 Documented information
- What you keep in writing, and how you create, approve and control it.
- 9.2 Internal audit
- A planned programme, objective auditors, and reported results.
- 9.3 Management review
- Leadership looks at defined inputs and makes recorded decisions.
- Writing the ISMS scope statementHow to draw the line and word it so an auditor accepts it.
- Documented informationWhat to write, how to control it, and how little is enough.
- The ISO 27001 internal auditWho may audit, what to test, and how to report.
- The management reviewThe inputs and outputs the standard lists, and a workable agenda.
04 · Annex A and the SoA
Where Annex A fits
You compare your chosen controls against Annex A, so nothing necessary is missed.
Annex A is not a checklist to implement in full. Your risk treatment decides which controls you need. You then check that list against Annex A and record, for each of the 93 controls, whether it applies, why, and whether it is in place. That record is the Statement of Applicability. Excluding a control is allowed when you can justify it.
| Theme | Controls | Covers |
|---|---|---|
| Organizational | 37 | Policies, roles, suppliers, incidents, continuity, legal |
| People | 8 | Screening, terms, awareness, discipline, leaving, remote work |
| Physical | 14 | Sites, equipment, media, utilities |
| Technological | 34 | Access, endpoints, networks, logging, code, change |
- The Statement of ApplicabilityHow to build the document auditors open first.
- Annex A organizational controlsThe 37 controls of the first theme, grouped by what they do.
- Annex A people controlsThe 8 controls on hiring, training, and leaving.
- Annex A physical controlsThe 14 controls on sites, equipment and media.
- Annex A technological controlsThe 34 controls on systems, networks, code and data.
05 · Common misreadings
Four misreadings that cost time
Most come from treating the standard as a control checklist.
- Implementing all 93 controls by default. Controls follow risk. Unjustified controls add cost without adding assurance.
- Skipping clauses to focus on controls. Auditors test clauses 4 to 10 first. A strong firewall does not replace a management review.
- Treating the SoA as a one-off. It must stay true as controls change.
- Confusing ISO 27002 with requirements. ISO 27002 is guidance on the controls; you certify against ISO 27001 only.
Sources: ISO/IEC 27001:2022 clause and Annex A titles and structure (public information only; the standard's text is not reproduced); ISO/IEC 27002:2022 as the companion guidance standard.
Questions about the requirements
Can we exclude a clause if it does not fit our business?
No. Clauses 4 to 10 all apply.
Exclusions are possible only for Annex A controls, and only with a justification in the SoA. The management system clauses apply to every certified organisation.
How many documents do the clauses require?
Fewer than many templates suggest.
The standard names specific documented information, such as the scope, policy, risk method and results, SoA, and audit and review results. The mandatory documents guide lists them. Anything beyond is your choice.
Did a 2024 amendment change the requirements?
A small addition on climate change in clause 4.
An amendment published in 2024 asks organisations to consider whether climate change is a relevant issue when they review context and interested parties. It does not add controls.
Which clause causes the most findings?
It varies, but risk work and internal audit are frequent.
Findings commonly cluster around risk assessment that does not match the business, internal audits that are not objective or complete, and an SoA that does not match reality.
See which requirements you already meet.
An ISO 27001 gap analysis walks every clause and the SoA with your team and marks what is done, partial or missing.