Question 1

What is ISO 27001:2022?

Accepted Answer

ISO 27001:2022 is the latest version of the international standard for information security management systems. It replaces ISO 27001:2013 and includes updated controls in Annex A, reorganised into four themes: Organisational, People, Physical, and Technological controls.

Question 2

When do I need to transition from ISO 27001:2013 to 2022?

Accepted Answer

Organisations certified to ISO 27001:2013 must transition to the 2022 version by 31 October 2025. After this date, all ISO 27001:2013 certificates will be invalid. We recommend starting your transition as early as possible to ensure a smooth process.

Question 3

What are the main changes in ISO 27001:2022?

Accepted Answer

The main changes include a restructured Annex A with 93 controls (down from 114) organised into four themes, 11 new controls addressing areas like threat intelligence, cloud security, and data masking, and enhanced requirements for understanding interested parties' requirements.

Question 4

How much does ISO 27001 certification cost?

Accepted Answer

The cost varies significantly based on organisation size, scope, and current security maturity. It includes consulting fees, implementation costs, internal audit costs, and certification body fees. Contact us for a tailored quote based on your specific situation.

Question 5

Do I need ISO 27001 if I already have SOC 2?

Accepted Answer

While there is significant overlap between SOC 2 and ISO 27001, they serve different purposes and audiences. ISO 27001 is internationally recognised, while SOC 2 is more prevalent in North America. Many organisations pursue both to satisfy global customer requirements.

Question 6

What is the scope of ISO 27001?

Accepted Answer

The scope defines which parts of your organisation, information assets, processes, and locations are covered by the ISMS. Defining the right scope is critical — too narrow and it may not satisfy customer requirements, too broad and it becomes unnecessarily complex and costly.

Question 7

What is a Statement of Applicability (SoA)?

Accepted Answer

The SoA is a key document in ISO 27001 that lists all Annex A controls, states whether each is applicable, provides justification for inclusion or exclusion, and describes how applicable controls are implemented. It is one of the most important documents reviewed during certification audits.

Question 8

How often are surveillance audits conducted?

Accepted Answer

After initial certification, surveillance audits are conducted annually (typically at 12 and 24 months). A full re-certification audit is conducted every three years. These audits ensure your ISMS remains effective and continuously improved.

Question 9

What is the role of risk assessment in ISO 27001?

Accepted Answer

Risk assessment is fundamental to ISO 27001. It involves identifying information security risks, analysing their likelihood and impact, evaluating them against your risk criteria, and determining appropriate treatment options. The risk assessment drives your selection of controls and your overall security strategy.

Question 10

Can ISO 27001 be integrated with other management systems?

Accepted Answer

Yes, ISO 27001 is designed to be integrated with other ISO management system standards such as ISO 9001 (Quality), ISO 22301 (Business Continuity), and ISO 42001 (AI). The common high-level structure makes integration straightforward and reduces audit burden.

ISO 27001:2022 FAQ