What is ISO 27001?
ISO 27001 is the international standard for information security and describes the requirements for establishing, implementing, maintaining and continuously improving an Information Security Management System (ISMS). The standard applies to organisations of any size and sector. With the ISO 27001:2022 version, 93 Annex A controls are organised into four categories: organisational, people, physical and technological. Certification demonstrates that your organisation complies with international standards for information security.Why ISO 27001 now?
Information security is no longer optional — it is a market requirement. ISO 27001 certification is increasingly required in procurement processes, strengthens client and partner confidence, and provides a solid foundation for NIS2, DORA and GDPR compliance.
- Procurement: Increasingly, contracting authorities require ISO 27001 as a minimum qualification
- NIS2 compliance: ISO 27001 covers a large portion of the NIS2 security requirements
- Risk Management: A systematic approach that prevents incidents and limits damage
- Stakeholder confidence: Clients, partners and regulators trust demonstrable security
ISO 27001:2022 — What has changed?
The 2022 revision brought significant changes: from 114 to 93 Controls, a reorganisation into four thematic categories and 11 new Controls focused on cloud security, threat intelligence and data masking. Organisations still certified on the 2013 version must migrate by October 2025 (deadline passed; non-migrated certificates have expired) at the latest.
The 4 control categories in ISO 27001:2022:
Our approach: from initial assessment to certificate
We follow a proven four-phase approach that combines realistic timelines with sustainable implementation:
Organisational Controls (37) · People Controls (8) · Physical Controls (14) · Technological Controls (34) — total 93 Annex A Controls.
- Phase 1 — Gap analysis: Baseline assessment of your current security level against the ISO 27001 standard. Clear insight into the distance to certification.
- Phase 2 — Implementation: Establishing the ISMS — risk analysis, Statement of Applicability, policy, procedures and controls in conformance with Annex A.
- Phase 3 — Certification: Internal audit, management review and full guidance through the external Stage 1 and Stage 2 certification audit.
- Phase 4 — Maintenance: Continuous support for surveillance audits, recertification and continuous improvement of your ISMS.