Overview
ISO/IEC 27001:2022 sets requirements for an information security management system (ISMS) that preserves confidentiality, integrity and availability of information through a risk management process. The 2022 revision restructured Annex A into four themes — organizational, people, physical and technological — and introduced 11 new controls such as threat intelligence and secure coding.
How the standard is structured
- 4Context of the organization
- 5Leadership
- 6Planning
- 7Support
- 8Operation
- 9Performance evaluation
- 10Improvement
- Annex AInformation security controls reference (93 controls)
ISMS implementation field guide
Build a traceable chain from organizational context to risk ownership, treatment, operating controls and improvement evidence.
- 1
Set context and scope
Identify internal and external issues, interested-party requirements, interfaces and dependencies; document a boundary that matches real operations.
- 2
Assess information-security risk
Use approved, repeatable criteria to assess risks to confidentiality, integrity and availability and identify accountable risk owners.
- 3
Select and plan treatment
Choose treatment options, assign owners and due dates, record approvals and residual risk, and keep applicability records consistent with decisions.
- 4
Operate and measure controls
Define how controls work in practice, what evidence they produce and how the organization will evaluate their effectiveness.
- 5
Review and improve
Use audit, measurement, incident and management-review results to correct root causes and verify that changes work.
Evidence checklist
- Current scope and interface map
- Risk criteria and risk-owner decisions
- Treatment plan and control applicability rationale
- Operating samples rather than policy alone
- Monitoring, audit and corrective-action records
Common failure modes
- Treating tool purchase as control implementation
- Leaving third-party interfaces outside scope without analysis
- Confusing the CISO with the accountable business risk owner
- Listing controls as implemented without operating evidence
Key concepts examiners test
Risk owner
Person or entity with the accountability and authority to manage a risk.
Statement of Applicability
Mandatory document listing necessary controls, justification and implementation status.
Risk treatment plan
Plan for implementing selected controls, approved by risk owners.
Control attributes
Tags in ISO/IEC 27002:2022 such as control type and cybersecurity concept used to filter controls.
Planning of changes
Clause 6.3 — changes to the ISMS must be planned (new in 2022).
Preparing for the Lead Auditor exam
- Use the SoA as your audit map — every 'included' control needs evidence of implementation.
- Sample risk owners and ask them to explain residual risk they accepted.
- Grade findings by impact on system effectiveness, not by the number of instances alone.
- Verify management review inputs include changes in interested-party needs (added in 2022).
Preparing for the Lead Implementer exam
- Agree risk assessment methodology early — consistency and comparability are explicit requirements.
- Map existing controls to the 93 Annex A controls before writing new policies.
- Plan at least one full internal audit cycle and management review before Stage 2.
- Keep the scope statement precise about interfaces and dependencies with third parties.