ISO 27001 Requirements | Complete Implementation Guide

ISO 27001 Standard Structure

Clauses 4-10: Requirements

Mandatory requirements for establishing an Information Security Management System (ISMS)

•Clause 4: Context of the Organization
•Clause 5: Leadership
•Clause 6: Planning
•Clause 7: Support
•Clause 8: Operation
•Clause 9: Performance Evaluation
•Clause 10: Improvement

Annex A: Controls

93 security controls organized into 4 categories (select what applies to your organization)

•Organizational Controls (37 controls)
•People Controls (8 controls)
•Physical Controls (14 controls)
•Technological Controls (34 controls)

Mandatory ISMS Requirements (Clauses 4-10)

Clause 4: Context of the Organization

✓Understand your organization and its context
✓Identify interested parties and their requirements
✓Determine ISMS scope
✓Establish the ISMS

Clause 5: Leadership

✓Top management demonstrates leadership and commitment
✓Establish information security policy
✓Define organizational roles, responsibilities, and authorities
✓Assign accountability for ISMS performance

Clause 6: Planning

✓Actions to address risks and opportunities
✓Information security risk assessment process
✓Information security risk treatment plan
✓Information security objectives and plans to achieve them

Clause 7: Support

✓Determine and provide resources needed
✓Ensure competence of personnel
✓Awareness training for all personnel
✓Internal and external communication plan
✓Create and control documented information

Clause 8: Operation

✓Operational planning and control
✓Information security risk assessment (annual minimum)
✓Information security risk treatment
✓Implement risk treatment plan and controls

Clause 9: Performance Evaluation

✓Monitor, measure, analyze, and evaluate ISMS performance
✓Internal audit program (annual minimum)
✓Management review meetings (annual minimum)
✓Document results and take corrective actions

Clause 10: Improvement

✓Identify and address nonconformities
✓Implement corrective actions
✓Continual improvement of ISMS suitability, adequacy, effectiveness

Annex A Controls (93 Total)

🏢

Organizational Controls

37 controls

•Information security policies
•Roles and responsibilities
•Segregation of duties
•Management responsibilities
•Contact with authorities
•Threat intelligence
•Information security in project management
•Inventory of information and assets
•Acceptable use of assets
•Return of assets
•Classification of information
•Labeling of information
•Asset management
•Supplier relationships
•Information security in supplier agreements
•ICT supply chain management

👥

People Controls

8 controls

•Screening (background checks)
•Terms and conditions of employment
•Information security awareness, education, and training
•Disciplinary process
•Responsibilities after termination or change
•Confidentiality or non-disclosure agreements
•Remote working
•Information security event reporting

🏗️

Physical Controls

14 controls

•Physical security perimeters
•Physical entry controls
•Securing offices, rooms, and facilities
•Monitoring for physical and environmental threats
•Working in secure areas
•Delivery and loading areas
•Equipment siting and protection
•Supporting utilities
•Cabling security
•Equipment maintenance
•Secure disposal or reuse of equipment
•Clear desk and clear screen policies

💻

Technological Controls

34 controls

•User endpoint devices
•Privileged access rights
•Information access restriction
•Access to source code
•Secure authentication
•Capacity management
•Protection against malware
•Management of technical vulnerabilities
•Configuration management
•Information deletion
•Data masking
•Data leakage prevention
•Information backup
•Redundancy of information processing facilities
•Logging and monitoring
•Clock synchronization

Mandatory Documented Information

ISMS Documentation (Required)

✓ISMS scope
✓Information security policy
✓Information security objectives
✓Risk assessment methodology
✓Risk treatment plan
✓Statement of Applicability (SoA)
✓Competence records
✓Monitoring and measurement results
✓Internal audit program and results
✓Management review results
✓Nonconformity and corrective action records

Typical Supporting Documents

✓Asset inventory
✓Risk register
✓Access control policy
✓Incident response plan
✓Business continuity plan
✓Change management procedures
✓Backup and recovery procedures
✓Information classification policy
✓Supplier security policy
✓Acceptable use policy
✓Security awareness training records

LowerPlane Policy Templates

We provide 15+ ISO 27001-compliant policy templates with customization. Save weeks of work and $10,000-$20,000 in consultant fees.

Control Selection Process

Risk Assessment

Identify information security risks to your organization

Control Selection

Select applicable controls from Annex A to address risks

Justification

Justify inclusion or exclusion of each control in Statement of Applicability

Implementation

Implement selected controls and document evidence

Statement of Applicability (SoA)

The SoA is a critical document that lists all 93 Annex A controls and states whether each is:

•Applicable and implemented
•Applicable but not yet implemented (with timeline)
•Not applicable (with justification)

Most organizations implement 60-80 of the 93 controls, excluding those not relevant to their operations (e.g., physical data centers if fully cloud-based).

Certification Process

Stage 1: Documentation Review

1-2 days

Auditor reviews your ISMS documentation, policies, SoA, and risk assessment

→Stage 1 report with any gaps to address

Stage 2: Onsite Assessment

2-5 days

Auditor tests control implementation, interviews staff, reviews evidence

→Stage 2 report with findings (major nonconformities, minor nonconformities, observations)

Remediation (if needed)

2-4 weeks

Address any nonconformities identified in Stage 2

→Evidence of corrective actions

Certification Decision

1-2 weeks

Certification body reviews audit reports and decides on certification

→ISO 27001 certificate (valid 3 years)

Ongoing Requirements

After certification, you must maintain compliance:

•Annual surveillance audits
•Recertification audit every 3 years
•Continual improvement of ISMS
•Internal audits and management reviews

ISO 27001:2022 Requirements