ISO 27001 guide | Doniastack

What ISO 27001 is

ISO/IEC 27001 specifies the requirements for an information security management system: the way an organisation decides what to protect, assesses risk, chooses controls and keeps improving. The current edition is ISO/IEC 27001:2022. Certification is issued by an accredited certification body and is recognised internationally.

The management system clauses (4 to 10)

Clause	Asks you to
4 Context	Define the scope and the interested parties
5 Leadership	Show management commitment and set the security policy
6 Planning	Assess and treat risk; set security objectives
7 Support	Provide resources, competence, awareness and documentation
8 Operation	Run the risk treatment plan
9 Performance evaluation	Monitor, run internal audits and management reviews
10 Improvement	Fix nonconformities and keep improving

Annex A controls

Annex A lists 93 controls in four themes: organisational (37), people (8), physical (14) and technological (34). You do not have to implement all of them. You choose the ones your risk assessment calls for and justify the rest.

The Statement of Applicability

The Statement of Applicability (SoA) lists every Annex A control, whether it applies, why, and whether it is implemented. Auditors read it closely; it ties your risk assessment to your controls.

The certification cycle

Stage 1 audit: the auditor reviews your documentation and readiness.
Stage 2 audit: the auditor checks the ISMS is operating in practice.
Certificate: valid for three years.
Surveillance audits in years one and two, then recertification in year three.

How Doniastack helps

Doniastack holds the risk register, the control library mapped to Annex A, the Statement of Applicability, internal audits and management reviews in one place, so the evidence for every clause is a click away.

ISO 27001: running security as a managed system.