Information Security, Cybersecurity and Privacy Protection — Information Security Management Systems — Requirements
Specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system, including a risk-based process for selecting controls. Jointly published by ISO and IEC and certifiable by accredited bodies.
What this does not cover
stated in the document's own scope- It is a management-system requirements standard, not a technical specification for any product or system.
- Annex A is a reference list, not a mandatory control set. The ISO/IEC committee’s own guidance notes that a control’s presence in Annex A does not make it necessary to a given organisation, and that necessary controls may lie outside it.
- Certification covers only the declared ISMS scope, which may exclude sites, systems or services a customer relies on.
- It addresses information security, not the GxP integrity of regulated records; those expectations come from EU GMP Annex 11, 21 CFR Part 11 and data-integrity guidance.
Always verify against the current published text before relying on it for a submission or inspection.
Overview
ISO/IEC 27001 specifies the requirements for an information security management system (ISMS): the policies, processes, roles and controls an organisation uses to establish, implement, maintain and continually improve the security of the information it holds or handles. It is built around a risk process — the organisation assesses its information security risks, decides how to treat them, and selects the controls it needs — rather than a fixed checklist. It applies to organisations of any size and sector, and it is the standard against which organisations are certified, which is why it so often appears in supplier and outsourcing contracts.
Scope & applicability
Any organisation, of any size or sector. In regulated life sciences it is the recognised management-system framework for information security, and the one most often required contractually of suppliers, CROs, CDMOs and software vendors. It governs the security of information — not the integrity of GxP records specifically, which remains a quality-system obligation under Annex 11, Part 11 and the data-integrity guidance.
Legal basis & how it acquires force
It is a voluntary International Standard published jointly by ISO and the International Electrotechnical Commission, developed by ISO/IEC JTC 1/SC 27 (information security, cybersecurity and privacy protection). The current text is the third edition, ISO/IEC 27001:2022, published in October 2022, which replaced the 2013 edition and its corrigenda; Amendment 1:2024 adds climate-action changes. No law requires it in itself; it gains force through contracts, customer requirements and certification by accredited conformity-assessment bodies. ISO advises citing the full reference, for example "certified to ISO/IEC 27001:2022".
Document structure
| Part | Covers |
|---|---|
| Clauses 1–3 — Scope, references and terms | The applicability of the requirements and the vocabulary shared with the rest of the 27000 family |
| Clauses 4–5 — Context and leadership | Understanding the organisation and interested parties, defining the ISMS scope, and top-management commitment and policy |
| Clause 6 — Planning | Risk assessment and risk treatment; 6.1.3 requires the organisation to determine its necessary controls, compare them with Annex A and produce a Statement of Applicability |
| Clauses 7–8 — Support and operation | Resources, competence, awareness, communication, documented information and operational control, including control of externally provided processes, products and services |
| Clauses 9–10 — Performance evaluation and improvement | Monitoring, internal audit, management review, nonconformity, corrective action and continual improvement |
| Annex A — Information security controls reference | A reference set of controls used to check that no necessary control has been overlooked, with implementation guidance in ISO/IEC 27002 |
Key requirements
- Defined ISMS scope, context, interested parties and leadership commitment
- Information security risk assessment and risk treatment with a Statement of Applicability
- Annex A control set selected and justified against assessed risk, not adopted wholesale
- Competence, awareness and documented information proportionate to risk
- Internal audit, management review, nonconformity handling and continual improvement
- Amendment 1:2024 adds climate-action considerations to context and interested parties
Implementation tips
- Certification covers the declared scope only — read a supplier certificate for what it excludes before relying on it.
- The Statement of Applicability is the useful artefact in a supplier assessment; the certificate alone says little.
- ISO/IEC 27001 does not discharge GxP data-integrity obligations. Map its controls onto Annex 11 and Part 11 expectations rather than substituting one for the other.
Revision notes
The 2022 edition restructured Annex A from 114 controls in 14 clauses to 93 controls in 4 themes and introduced attributes for control selection. Amendment 1:2024 adds climate-action changes.
Where this control fails
live FDA enforcementLive FDA recalls SPEQ maps to this standard’s topics — a SPEQ interpretation, not an FDA classification.
International alignment
Clauses 4 to 10 follow ISO’s harmonized structure for management system standards, the same skeleton used by ISO 9001, ISO 22301 and ISO 45001, so an ISMS can be run as part of an integrated management system. ISO/IEC 27002:2022 supplies guidance on the controls listed in Annex A; it cannot be certified to on its own. ISO/IEC 27000 supplies the overview and vocabulary for the family. In industrial control environments the IEC 62443 series addresses the operational technology an ISMS does not reach in detail.
ISO/IEC 27001:2022: frequently asked questions
Quick answers to common questions about ISO/IEC 27001:2022.
What is the current edition of ISO/IEC 27001?
ISO/IEC 27001:2022, the third edition, published in October 2022. It replaced ISO/IEC 27001:2013, and Amendment 1:2024 adds climate-action changes to it.
What is the Statement of Applicability?
It is the record produced under clause 6.1.3. The organisation determines the controls it needs to treat its information security risks (6.1.3 b), compares them with Annex A to check that no necessary control has been omitted (6.1.3 c), and records the outcome in the Statement of Applicability (6.1.3 d). A necessary control that is not in Annex A must be included in it too.
What is the difference between ISO/IEC 27001 and ISO/IEC 27002?
ISO/IEC 27001 contains the requirements an ISMS must meet and is the standard organisations are certified against. ISO/IEC 27002 gives guidance on the controls; it cannot be certified to.
Does ISO certify organisations to ISO/IEC 27001?
No. Certification is carried out by independent certification bodies, which may themselves be accredited by a national accreditation body. Certification is voluntary.
This standard in practice
Recall domain is a SPEQ mapping of this standard’s topics, not an FDA classification.