ISO 27001 (current version: ISO/IEC 27001:2022) is the international standard for **Information Security Management Systems (ISMS)** — a structured, risk-based approach to protecting an organisation's information assets. The standard specifies what an organisation must do to identify risks, define controls, monitor effectiveness, and continuously improve. ISO 27001 certification by an accredited body is widely recognised globally and is often required by enterprise customers, B2B partners, and regulators. It applies to organisations of any size and industry — from a 10-person SaaS startup to a multinational bank.

ISO 27001:2022 was published in October 2022, replacing the 2013 version. Main changes: (1) **Annex A controls reduced from 114 to 93** and reorganised into 4 themes (organisational, people, physical, technological) instead of 14 sections, (2) **11 new controls** including threat intelligence, cloud security, ICT readiness for business continuity, monitoring activities, secure development, and configuration management, (3) **24 controls merged or removed**, (4) **Wording modernised** to align with current security practices. Certified organisations have until **31 October 2025** to transition; new certifications must use the 2022 version.

Costs split into three categories: (1) **Implementation** — preparing the ISMS, writing policies, deploying controls, training staff: €30K-150K for SME, €100K-500K+ for large organisations (often via consulting partners), (2) **Stage 1 + Stage 2 certification audit** by an accredited body — €10K-50K depending on scope and size, (3) **Annual surveillance audits** + 3-year recertification — €5K-25K/year. Total first-year cost for a 100-person company: typically €60K-200K. Recurring annual cost after certification: €15K-50K (surveillance + maintaining ISMS). Bigger organisations or those with multiple sites/scopes pay more. ROI is usually realised through enterprise customer wins, faster sales cycles, and lower cyber insurance premiums.

Annex A organises controls into 4 themes: (1) **Organisational controls (37 controls)** — policies, roles, asset management, supplier relationships, incident management, (2) **People controls (8 controls)** — screening, terms of employment, awareness, disciplinary, return of assets, (3) **Physical controls (14 controls)** — physical perimeter, secure areas, equipment security, clean desk policy, (4) **Technological controls (34 controls)** — endpoint security, cryptography, identity and access management, secure development, vulnerability management, logging and monitoring, network security, configuration management. Each control has implementation guidance in **ISO 27002:2022**. An organisation selects which controls apply (Statement of Applicability) based on risk assessment.

Typical timelines (greenfield, mid-size organisation): (1) **Gap analysis and planning** — 4-6 weeks, (2) **Implementation and remediation** — 4-9 months (writing policies, deploying technical controls, training, internal audits, management review), (3) **Stage 1 audit** (documentation review) — 1-2 weeks, plus 4-8 weeks to remediate findings, (4) **Stage 2 audit** (operational evidence review) — 1-2 weeks, plus remediation, (5) **Certificate issued** — typically 12-15 months from project start to certificate. Mature organisations with strong existing security can reach certification in 6-9 months; complex organisations with many sites or weak baseline often take 18-24 months. The **3-year cycle** then continues with annual surveillance audits.

Three different frameworks for different needs: (1) **ISO 27001** — internationally recognised, formal certification, applicable globally and across industries; preferred in EU, UK, APAC; required by many enterprise customers and regulators, (2) **SOC 2** — US-developed, attestation report (not a certification), focused on five Trust Services Criteria (security, availability, processing integrity, confidentiality, privacy); preferred by US enterprise customers and SaaS market, (3) **NIST CSF (Cybersecurity Framework)** — voluntary US framework, no certification, widely used as internal benchmark; required for US federal contractors. Many enterprises pursue **ISO 27001 + SOC 2 in parallel** to satisfy both EU and US customers. NIST CSF is often used internally to map controls across multiple frameworks.

ISO 27001 is not legally required by these regulations, but it provides strong evidence of compliance: (1) **NIS2** — Article 21 risk management measures map closely to Annex A controls; ISO 27001 certification is widely accepted by national competent authorities as evidence of compliance, (2) **DORA** — ICT risk management framework (Articles 5-15) overlaps with ISO 27001 ISMS requirements; many financial entities pursue ISO 27001 plus DORA-specific controls, (3) **GDPR** — ISO 27001 supports Article 32 (security of processing) and helps demonstrate accountability under Article 5. Note: ISO 27001 alone does not equal GDPR compliance, but it is a strong building block. ISO 27701 (privacy extension) maps directly to GDPR. Many supervisors view ISO 27001 certification favourably during enforcement actions.