What certification covers
ISO/IEC 27001:2022 sets requirements for an information security management system (ISMS). The organisation establishes a scope, assesses information security risks, decides how to treat them and evaluates how well its management system works. A certificate refers to the scope assessed by the certification body.
Define the boundary
Describe the business activities, services, sites and dependencies included in the ISMS. Identify relevant parties and their requirements, the people who own risks, and the teams responsible for the selected controls.
A hosted service may depend on an identity provider outside the organisation. Define that dependency and the oversight your organisation exercises, even though the supplier operates the technology. The scope should help an auditor understand who does what.
Assess and treat risk
Choose criteria that let risk owners evaluate likelihood, impact and acceptable risk consistently. Record a treatment decision for each material risk and identify the controls needed. Agree who can approve the treatment plan and accept remaining risk.
For privileged access, a useful evidence chain connects the risk, the access owner, the control for granting privileges and the review record showing that the control actually operated.
Use the Statement of Applicability
Compare the necessary controls with the 93 reference controls in Annex A to check for omissions. The Statement of Applicability identifies necessary controls, the reasons for including them and whether they are implemented. It also explains any exclusions from Annex A. An organisation can choose additional controls when its risks require them.
A concise entry links a control to the risk treated, the accountable owner and the evidence of operation. This helps the organisation explain its own decisions during an audit.
Review how the ISMS works
Internal audits test whether the ISMS meets its requirements and operates as intended. Management review examines performance, changes, findings and opportunities for improvement. Keep decisions and follow-up actions with named owners.
Plan–Do–Check–Act is one useful way to organise that work. Use a practical cycle of risk review, control operation, evaluation and corrective action that fits the organisation.
What customers can infer
Customers can examine the certificate’s scope and ask how it relates to the services they buy. ISO certification is one source of assurance. Privacy obligations, sector requirements and insurance terms still need to be considered separately.
Prepare for independent audit
Select an independent certification body. If accredited certification is required, confirm that its accreditation covers the relevant standard and scope. Prepare the ISMS scope, risk assessment, treatment plan, Statement of Applicability, internal audit findings and management review records.
Stage 1 reviews documentation and readiness. Stage 2 assesses implementation and effectiveness. The certification body determines the outcome. Keep previous audit findings and their evidence of closure ready for surveillance and re-certification.
