ISO/IEC 27001 Hub
ISO/IEC 27001:2022 explained clause by clause, Annex A controls, the Statement of Applicability, and the certification journey.
Articles
ISO/IEC 27001:2022 Explained
ISO/IEC 27001:2022 is the current version of the international information security management system standard. Here is its structure and what changed from the 2013 version.
ISO 27001 Clauses Explained
Clauses 4-10 are the mandatory ISMS requirements every certified organization must meet -- separate from the optional Annex A controls.
Annex A Controls Explained
Annex A in the 2022 revision groups 93 controls into 4 themes. Here is what each theme covers and how organizations select controls from it.
ISO 27001 Risk Assessment
The ISO 27001 risk assessment process (Clauses 6.1.2 and 8.2) is what everything else in the standard -- Annex A selection, the SoA -- derives from.
Internal Audit Explained
Clause 9.2 requires internal audits at planned intervals. Here is how ISO 27001 internal audits actually work and why independence matters.
Nonconformity vs Observation vs OFI
Audit findings come in three tiers with different required responses. Confusing them leads to either overreacting or under-responding to audit results.
ISO 27001 Certification Journey
From gap analysis to a certificate: the realistic stages and timeline of an ISO 27001 certification project.