The international standard for building, maintaining and certifying an Information Security Management System. The benchmark for demonstrating security maturity to clients, regulators and insurers.
ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). It provides a systematic framework for managing sensitive information, ensuring confidentiality, integrity and availability through a risk-based approach. It is widely recognised as the gold standard for information security governance worldwide.
The standard is built around Clauses 4–10, which define the mandatory requirements for establishing, implementing, maintaining and continually improving an ISMS. Annex A provides 93 reference controls across four themes: organisational, people, physical and technological.
Any organisation that handles sensitive data — whether customer information, intellectual property, financial records or health data. It is increasingly required by enterprise clients, government procurement, insurers and investors as a minimum bar for security assurance. In Australia, ISO 27001 is often used alongside the Essential Eight and APRA CPS 234 to demonstrate a mature security posture.
Clauses 4–10 form the auditable core of ISO 27001. Each clause must be satisfied to achieve certification.
Define the scope of your ISMS, identify internal and external factors, and understand stakeholder requirements.
Senior management must demonstrate commitment, establish an information security policy, and assign roles and responsibilities.
Conduct risk assessments, define risk treatment plans, and produce a Statement of Applicability mapping Annex A controls.
Ensure adequate resources, competence, awareness, communication and documented information to support the ISMS.
Implement the risk treatment plan, execute operational controls, and conduct regular risk assessments.
Monitor, measure and evaluate ISMS effectiveness. Conduct internal audits and management reviews.
Address nonconformities, implement corrective actions, and drive continual improvement of the ISMS.
93 reference controls across organisational, people, physical and technological themes. Select based on your risk assessment.
The 2022 revision reorganised Annex A from 114 controls in 14 domains to 93 controls in 4 themes, added 11 new controls (including threat intelligence, data masking and secure coding), and strengthened requirements around change planning, stakeholder needs and performance evaluation. Organisations must have completed migration from the 2013 version by October 2025.
We deliver ISO 27001 readiness assessments, gap analyses, ISMS development, policy creation, risk treatment planning and internal audit support. Whether you are pursuing initial certification or transitioning from the 2013 standard, we provide hands-on delivery — not just documentation.
Discuss Your ISO 27001 JourneyBook a free 30-minute call with Doug. No obligation — just an honest conversation about your compliance posture and what it would take to close the gaps.
Book a Discovery Call