International standard · Information security management systems – Requirements
ISO/IEC 27001:2022
ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). An organisation can be certified against it by an accredited certification body.
Checked 18 Oct 2026
What it asks of an organisation
- A defined scope and an understanding of the organisation's context.
- Information security risk assessment and risk treatment.
- A Statement of Applicability that justifies every Annex A control included or excluded.
- Internal audit, management review and continual improvement.
How Complia supports the work
- 01
Statement of Applicability
Every Annex A control with an applicability decision and its rationale. An exclusion needs a reason, and clauses 4–10 cannot be excluded.
- 02
Three states, kept apart
Applicable, implemented and verified are separate. Choosing the standard never means you comply with it.
- 03
Evidence per control
Link evidence to the control it supports and let an independent person review it.
- 04
Structure, not licensed text
Control numbers follow the published structure. The wording stays in your licensed copy.
What stays with you
Scope, risk acceptance and the decision to seek certification are yours, and certification is granted by an accredited certification body – not by Complia.
Other frameworks
See it with your own product.
We go through your requirements, owners and next steps in a walkthrough.