Information security, finally explained.
Every clause from 4 to 10 and all 93 Annex A controls, explained simply, with the evidence you need to provide.
with a Lead ISO 27001 auditor · required by Clause 9.2.1
Hi! Ask me about any clause or Annex A control, e.g. a number like A.8.13 or a topic like backups.
The AI guide answers from this site's content only. It is not a substitute for the standard.
Everything you need, nothing you don't.
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS): a structured way to find the risks to your information and manage them consistently. The 2022 edition has mandatory requirements in clauses 4–10 and a reference list of 93 controls in Annex A.
Organisations can be independently certified by an accredited certification body.
Why it matters
- Wins customer trust and shortens security questionnaires
- Unlocks enterprise and public-sector deals
- Reduces the chance and impact of breaches
- Helps align with laws like GDPR and NIS2
- Gives everyone a shared, repeatable way of working
The management system
Plan, do, check, act — explained sub-clause by sub-clause.
Annex AInstant control search
Filter 93 controls by theme or keyword in milliseconds.
Three steps to certified.
Understand & scope
Learn what the standard asks, define your ISMS scope and get leadership on board (clauses 4–5).
Assess & treat risk
Identify risks, pick Annex A controls, write your Statement of Applicability and put controls in place (clauses 6–8).
Check, improve, certify
Measure, audit internally, review with management, then invite an accredited certification body (clauses 9–10).
Learn by topic
Context of the organization
Understand your organisation and decide what the ISMS covers.
Clause 5Leadership
Top management must own and drive information security.
Clause 6Planning
Assess risks, choose controls, and set objectives.
Clause 7Support
Resources, competence, awareness, communication and documents.
Clause 8Operation
Do what you planned: run the processes and treat risks.
Clause 9Performance evaluation
Monitor, measure, audit and review.
Clause 10Improvement
Fix problems and keep getting better.
Annex A93 controls
Organizational, People, Physical and Technological.
“Without them, we would've struggled a lot to gain the ISO:27001:2022 certification on time.”
Isabella Madrid Malo, Project Manager, Dots.eco