Overview
ISO/IEC 27001 is the international standard for Information Security Management Systems (ISMS). It gives organizations a structured way to identify risks, implement controls, and continually improve how they protect information. The current edition, ISO/IEC 27001:2022, uses the harmonized structure (clauses 4–10) and a streamlined set of 93 Annex A controls organized into four themes: Organizational, People, Physical, and Technological. Certification shows customers, partners, and regulators that information security risk is managed systematically.
What it covers
- Context, leadership, and planning for the ISMS (clauses 4–6)
- Support, operation, performance evaluation, and improvement (clauses 7–10)
- Risk assessment and risk treatment process
- Statement of Applicability and selection of Annex A controls
- Related guidance often implemented alongside it: ISO/IEC 27017 (cloud), 27018 (PII in public cloud), and 27019 (energy utility control systems)
How we help
Implementation, audits and maintenance.
Implementation
We run a gap analysis against the current state, facilitate risk assessment, design controls, establish governance and documentation, and prepare the organization for certification. The focus is on controls that reduce real exposure and fit how the business operates, not just paperwork.
Audits
Internal ISMS audits, Stage 1 and Stage 2 readiness reviews, and certification audit support. We also support surveillance and recertification cycles.
Maintenance
Ongoing control monitoring, management review support, surveillance audit preparation, and continual improvement so the ISMS stays effective after certification.
Typical outcomes
What you have at the end
- Documented scope, risk assessment, and risk treatment plan
- Statement of Applicability aligned to Annex A (2022)
- Implemented controls with evidence of effectiveness
- Readiness for Stage 1 and Stage 2 certification audits
- A system that can later integrate with ISO 27701 (privacy) or ISO 42001 (AI)
Relevant credentials
Who does the work
PECB Certified Internal Auditor
PECB · Mar 2017Typical engagement
From gap analysis to certification.
Gap analysis
Current-state assessment against the standard and your obligations.
Risk assessment
Identify what could go wrong and plan how to treat it.
Governance & process design
Roles, policies and processes sized to how you operate.
Implementation & controls
Hands-on support designing and evidencing controls.
Internal audit & readiness
Independent internal audit and Stage 1 / Stage 2 preparation.
Training
Build capability so your team can run the system.
Related services
Often implemented together
Privacy Information Management
A standalone, certifiable PIMS under the 2025 edition, or transition from 2019.
Learn more → ISO/IEC 42001:2023AI Management System
Accountability, AI impact assessments and controls for a certifiable AIMS.
Learn more → ISO 22301:2019Business Continuity & Disaster Recovery
BIA, recovery strategy and tested plans for a certifiable BCMS.
Learn more →Ready to start on ISO/IEC 27001?
Preparing for ISO certification, tightening governance, or need an independent assessment? Tell us where you are and we’ll map the route.
Or email sales@metronguard.com