Current Edition Checked October 24, 2026
The transition from the 2013 edition ended on October 31, 2025, so every valid certificate is now to the 2022 edition.
What It Covers
The requirements for an information security management system: assessing and treating information security risks, with the 93 controls of Annex A as the reference set.
Who It Applies To
Any organization that holds information worth protecting, and suppliers whose customers make certification a condition of supply.
Key Requirements
- Information security risk assessment and treatment, with a Statement of Applicability (6.1.2, 6.1.3).
- Annex A controls in four themes: organizational, people, physical, and technological.
- Planning of changes to the management system (6.3).
- Internal audit, management review, and continual improvement (clauses 9–10).
What an Auditor Asks to See
- The Statement of Applicability and the risk treatment plan.
- Evidence that a control in the plan is operating.
Where Systems Fall Short
- A Statement of Applicability that includes every control, with no risk-based justification.
How QES Helps
Integration of the information security system with the quality and environmental systems, through our risk and cybersecurity partner.
Related Standards
Sources. ISO — ISO/IEC 27001:2022 (opens in a new tab); de Grandson — ISO management system revisions, 2026–2030 (September 2026) (opens in a new tab). Status checked October 24, 2026. This page summarizes ISO/IEC 27001:2022; it does not reproduce or replace it. Buy the standard from its publisher, or read the regulation in its official text, before relying on a detail. Not legal advice.