What do you need to adopt ISO 27001? The clauses and controls explained

If your company decides to adopt the information security standard ISO/IEC 27001:2022, you are faced with ten clauses and 93 Annex A controls. At first, these can seem overwhelming. However, once you understand how all those elements work together, the process becomes simpler. In this article, Linda Porter, Principal Assessor, Information Security Management Systems at NQA, a Kiwa company, explains what you need to adopt ISO 27001 in your company.

ISO 27001 is an international standard for information security. It provides a framework for managing information security risks and protecting the confidentiality, integrity and availability of information.

This core group follows the Plan-Do-Check-Act (PDCA) cycle that runs through many management system standards. "You might put in a control, but you need to check that the control is doing what you're expecting it to," Linda explains. 

Annex A sets out 93 controls, grouped into four themes: organizational, people, physical, and technological. Linda notes that only 34 of the 93 controls are technical, which can surprise people who assume ISO 27001 is an IT standard.

"You don't have to do every single control, but you need to have a justification for why you are or you aren't," says Linda. Some controls will be needed for legal or contractual reasons, some because they reduce a specific risk, and some simply because they're good practice, like a clear desk policy.

Similarly, the standard doesn’t determine how you meet a control. "The level of controls is based on the level of risk to the business," she says. "The standard's not telling you what to do. It's a guide." For example, to ensure safe printing, a larger company might decide to require ID cards to release print jobs, while that would make little sense for a business of two people. 

It’s the same for costs. Many people assume that technical controls mean expensive software or hardware. But adopting simpler processes like restricting USB use, monitoring large emails, and blocking access to personal webmail could be enough for a smaller company to limit data leakage. "Just because it sounds technical, it doesn't have to be an expensive solution," says Linda. For extra guidance on each control, she also recommends ISO 27002.

When it comes to choosing which ISO 27001 controls to integrate, your statement of applicability is essential. It’s where you document which of the 93 controls are applicable to your organization and justify why each control has been included or excluded, giving a clear reason for each. Beyond that purpose, it can also become a useful practical working document. "You can add in how each control is being implemented and links to the relevant documents," says Linda, "which helps you find information within your management system."

What mistakes should you avoid?

One of the most common issues Linda sees is related to the statement of applicability. “If you just put a tick without explaining why a control is needed and what risk it reduces, you don't have the full picture,” says Linda. Another area of weakness is related to risk registers. Risks should be linked to the measures and controls used to manage them, with the risk reviewed afterwards to check whether it has actually been reduced.

Starting the certification process means starting with your own company. “It’s less about ticking off 93 controls than about understanding your own business”, says Linda. “Start by considering your organizations context, risks and opportunities, before taking sensible measures to manage them. Then, explore the clauses to build that picture, use Annex A to choose proportionate controls, and record your reasoning in your statement of applicability.” As Linda puts it, the standard is there to guide you, and what you build from it should fit your organization.

Want to learn more? Read our step-by-step guide to ISO 27001 certification or send us a message now