Menu
Key facts
- Controls
- 93 Annex A controls (ISO/IEC 27001:2022, down from 114 in the 2013 version)
- Recertification cycle
- 3-year certificate
- Ongoing oversight
- Annual surveillance audits in years 1 and 2
- Public registry
- IAF CertSearch ↗
- Common gap categories
- Risk assessment (clause 6.1); Access control (A.5 and A.8); Supplier relationships (A.5.19–A.5.22); Cryptography (A.8.24); Logging and monitoring (A.8.15–A.8.16)
- Related standards
What is ISO 27001?
An international standard (ISO/IEC 27001:2022) published by ISO and IEC, scoped to an organization's Information Security Management System (ISMS). The 2022 version updated Annex A controls from 114 to 93.
Is ISO 27001 a certification or an attestation?
ISO 27001 is a certification. A physical certificate with three-year validity is issued by an accredited certification body (e.g., BSI, Bureau Veritas, Schellman, A-LIGN). Annual surveillance audits are required to maintain it.
Who needs ISO 27001?
Tech companies selling to European enterprise or government buyers, organizations subject to GDPR accountability expectations, or any vendor whose customers expect a recognized international ISMS standard rather than a US-specific framework.
What does ISO 27001 cost and how long does it take?
Certification body audit fees of $10K–$80K. All-in first-year cost (consultant, tooling, internal time) typically $50K–$220K for mid-market organizations.
Audit body fees and total program cost diverge sharply. Quote both numbers when budgeting; one is the auditor invoice, the other is everything else.