Questions

What does ISO 27001 involve?

Short answer

ISO/IEC 27001 involves setting up and running an information security management system (ISMS): you assess your security risks, choose controls to treat them, write a Statement of Applicability, and keep the system running with internal audits and management reviews. Certification then comes from an accredited certification body that audits you.

Last updated 2026-10-25

The main steps

1Set the scope: which parts of the business, products and locations the ISMS covers.
2Run a risk assessment and decide how to treat each risk.
3Compare your controls with the reference set in Annex A, and record which apply, and why, in a Statement of Applicability.
4Put the controls in place and keep evidence that they work.
5Run internal audits and management reviews, and fix what they find.
6Pass the certification audit, then annual surveillance audits and a recertification audit every few years.

What the 2022 version changed

ISO/IEC 27001:2022 replaced the 2013 edition. Its Annex A follows ISO/IEC 27002:2022, which has 93 controls in 4 groups instead of 114 in 14, with 11 new controls. The deadline for certified organisations to move to the 2022 version was 31 October 2025, after which 2013 certificates expired or were withdrawn.

Where the software comes in

Many controls touch the product: access control and least privilege, secure development, logging and monitoring, backups, encryption, supplier management and change management. Building these into the product and the delivery pipeline makes the audit evidence a by-product of normal work.

Tools

Check it for your case.

SOC 2 checklistFree tool

Sources

Read the official text.

IAF MD 26:2023, Transition requirements for ISO/IEC 27001:2022checked 2026-10-25

Frequently asked

Common follow-up questions.

ISO 27001 or SOC 2: which do we need?

Whichever your buyers ask for. US buyers often ask for SOC 2; buyers in Europe and Asia often ask for ISO 27001. The control work overlaps a lot.

Does every Annex A control have to be implemented?

No. You decide by risk and justify any exclusions in the Statement of Applicability. The auditor checks that the reasoning holds up.

Can a vendor's certificate cover us?

No. A supplier's certificate covers the supplier's ISMS. It helps your supplier management, but you need your own ISMS and audit.

Keep reading

Planning a build? Talk it through.

OceanLab designs and builds production software. Tell us what you are planning and we will reply with how we would approach it.