ISO/IEC 27001 Certification for Information Security Management Systems

ISO/IEC 27001 is the international standard for information security management systems (ISMS), and itmad audits ISMSs against ISO/IEC 27001:2022 for organisations in all industries. itmad operates across the Middle East, Asia and Europe, using local auditors and a travelling team. Certification follows a two-stage audit and results in a certificate valid for three years, kept current by annual surveillance audits. Last reviewed: October 2026.

ISO 27001 in brief

The standard asks an organisation to identify which information matters, to assess the risks to it, to select controls in proportion to those risks, and to show that the whole system works. A certificate is independent confirmation that the ISMS works. It does not promise a risk-free environment, and no honest certification body will say that it does. What it gives is a documented, tested basis for knowing which risks the organisation has accepted, and why.

Who the standard is for

Customers and supplier programmes often ask for independent proof of an ISMS. ISO 27001 applies to any organisation that handles information, including:

• IT service providers, software companies and managed service providers
• Banking, insurance and financial services
• Government entities and their technology suppliers
• Healthcare organisations that handle patient data
• Data centres, hosting and cloud providers
• Telecommunications operators
• Any organisation whose clients impose security requirements by contract

What auditors examine

• Scope definitionWhich information, services, locations and systems the ISMS covers. A scope drawn too narrowly produces a certificate that a client rejects as irrelevant to the service being bought.
• Risk assessmentA defined and repeatable method for identifying information security risks, assessing them consistently and producing results that can be compared over time.
• Risk treatment and the Statement of ApplicabilityDecisions on which Annex A controls apply, which are excluded and why, and how each applicable control is implemented. Auditors examine the Statement of Applicability more closely than any other document.
• Leadership and policyVisible top management commitment, an information security policy, and assigned roles and responsibilities.
• Competence and awarenessPeople who understand their security responsibilities in the roles they actually hold, evidenced rather than assumed.
• Supplier and third-party securitySecurity requirements carried into supplier relationships and cloud services, and verified rather than merely stated in a contract.
• Incident managementDetection, reporting, response and learning, with evidence of incidents that were really handled through the process.
• ContinuityThe information security aspects of business continuity, including redundancy of processing facilities.
• Access control and cryptographyIdentity and access management, privileged access, prompt handling of joiners and leavers, and cryptographic controls where the risk assessment calls for them.
• Monitoring and internal auditMeasurement of control effectiveness, internal audit coverage of the whole ISMS, and management review with recorded decisions.

The 2022 revision

ISO/IEC 27001:2022 restructured Annex A. The former 114 controls in fourteen domains became 93 controls in four themes: organisational, people, physical and technological. Eleven controls are new, among them threat intelligence, cloud services security, ICT readiness for business continuity, data leakage prevention and secure coding.

Any certificate issued now is against the 2022 edition. Documentation, a Statement of Applicability or an internal audit programme that is still built around the 2013 control set is the first gap a certification audit finds.

Where ISO 27001 audits find gaps

Three gaps recur. The first is a Statement of Applicability that excludes controls without justification, or claims an implementation that the evidence does not support. The second is a risk assessment done once at implementation and never revisited, so that the risk register describes an organisation that no longer exists. The third is supplier security managed by contract clause alone, with no check that any supplier meets the requirement.

How an itmad audit runs

Stage 1 reviews the documented ISMS, confirms the scope, and examines the risk assessment and the Statement of Applicability in detail, because every later control decision rests on both being sound. Stage 2 tests implementation: whether controls operate as the Statement of Applicability claims, whether monitoring produces real data, how incidents were actually handled, and whether people can describe their responsibilities.

The certificate cycle

An ISO 27001 certificate from itmad runs for three years, with surveillance audits in each of the two intervening years and recertification before it expires.

Scope and integration

The certificate states its scope and clients read it: a scope that covers head-office IT does not cover a platform that a client is buying. ISO 27001 shares its high-level structure with ISO 9001 and ISO 22301, so where more than one is held, an integrated audit covers the common clauses once.

Independence

Independence is what gives the certificate its value to the customer who asked for it. ISO/IEC 17021-1 bars itmad from designing, implementing or consulting on the system being certified, so the role of itmad is limited to the audit, the certification decision and, on request, a pre-assessment that identifies gaps against ISO 27001 without prescribing the fix.

What itmad delivers

• Readiness gaps reported after Stage 1, before the main audit begins
• A Stage 2 audit report with every finding backed by objective evidence
• Nonconformities graded by severity, each with a stated response time
• A certificate of registration naming the scope and locations certified
• Use of the certification mark under itmad's mark and seal policy
• Surveillance audits and reports in each year of the three-year cycle

Frequently asked questions

What is ISO 27001?

ISO/IEC 27001 specifies requirements for an information security management system: identifying what information matters, assessing the risks to it, selecting proportionate controls and showing that the system works. A certificate is independent confirmation that the system works.

What changed in ISO/IEC 27001:2022?

The 114 Annex A controls in fourteen domains became 93 controls in four themes: organisational, people, physical and technological. Eleven controls are new, including threat intelligence, cloud services security and secure coding, and any certificate issued now is against the 2022 edition.

What is the Statement of Applicability?

The Statement of Applicability records which Annex A controls apply, which are excluded and why, and how each applicable control is implemented. Auditors examine it more closely than any other document in the management system.

What are the most common ISO 27001 audit findings?

Three gaps recur: a Statement of Applicability that excludes controls without justification, a risk assessment never revisited after implementation, and supplier security managed by contract clause alone. In each case the evidence cannot support what the documents claim.

How does an ISO 27001 audit work?

itmad audits in two stages. Stage 1 reviews the documented system, the scope, the risk assessment and the Statement of Applicability. Stage 2 tests whether controls operate as the Statement of Applicability claims.

Why does the scope of the certificate matter?

Clients read the scope, and a certificate that covers head-office IT does not cover a platform that a client is buying. A scope drawn too narrowly produces a certificate that a client may reject as irrelevant.