Security · Certifiable standard
ISO/IEC 27001:2022, the information security management system
The international standard for an information security management system, and the one clients ask about most.
- Type
- Certifiable standard
- Group
- Security
- We help with
- ISO 27001 and GRC
- Issued by
- Accredited body
What it is.
ISO/IEC 27001:2022 (including Amendment 1:2024 on climate action) specifies requirements for an information security management system (ISMS): a structured way to manage information security risks. Organisations can be certified against it by an accredited certification body.
ITCCS is a consultant, not a certification body. Certification is issued by an accredited certification body after an independent audit.
Who usually needs it
- Organisations answering client security questionnaires
- IT, ITES and SaaS firms selling to larger clients
- Any organisation wanting a structured security programme
Related founder credential
ISO/IEC 27001:2022 Lead AuditorHeldWhat it covers.
- 01
The ISMS
Scope, leadership, risk assessment and treatment, objectives, internal audit and improvement.
- 02
93 Annex A controls
Grouped into four themes: organisational (37), people (8), physical (14) and technological (34).
- 03
Certification cycle
A certificate is valid for three years, with annual surveillance audits.
How we help with ISO/IEC 27001
We start with a gap analysis against clauses 4 to 10 and the 93 Annex A controls, then build the ISMS around your real risks rather than a template pack. The Statement of Applicability, risk treatment plan and internal audit are written for your scope, and we stay with you through the Stage 1 and Stage 2 audits run by your certification body.
Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You apply those relevant to your risks.
Three years, with annual surveillance audits by the certification body.
No. ITCCS is a consultant. Certification is issued by an accredited certification body after an independent audit.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal
This page is general guidance, not legal advice. Last reviewed October 2026.