Home / ISO/IEC 27001
Information security management system (ISMS)ISO/IEC 27001:2022 information security
Protect information, manage cyber risk and earn customer trust with an ISMS certified to ISO/IEC 27001:2022.
ISO/IEC 27001:2022Current edition
93Annex A controls
4 themesOrganisational, people, physical, technological
2024Climate amendment added
About the standard
What it is
ISO/IEC 27001 specifies requirements for an information security management system: assessing information security risks, selecting controls, and continually improving. Its Annex A lists 93 controls grouped into four themes — organisational, people, physical and technological.
The 2024 amendment asks organisations to consider whether climate change is a relevant issue for their ISMS.
Key points for 2026
- Risk assessment and risk treatment at the heart of the ISMS
- Statement of Applicability against the 93 Annex A controls
- Controls for threat intelligence, cloud services, secure coding and data leakage
- Climate change considered in context and interested parties
- Strong fit with India’s DPDP Act 2023 for personal data
Documentation & training kits
Do it yourself
- ISMS manual, scope and information security policy
- Risk assessment and treatment templates; Statement of Applicability
- Policies and procedures for Annex A controls
- Forms for incidents, access reviews, supplier security and audits
- Training presentations and question banks for foundation, implementer and lead auditor courses
Consulting
Let us help
- Gap analysis and risk assessment
- ISMS documentation and implementation
- Internal audits and certification readiness
- Cyber and data security audits through Innovative Matrix
- DPDP Act 2023 readiness
Need documents, training or a consultant?
Tell us your standard, company size and timeline. We reply on the same or next working day.