Question 1

What is an Information Security Management System (ISMS)?

Accepted Answer

An ISMS is a systematic framework of policies, procedures, technical controls, and risk management processes designed to protect an organization's information assets in accordance with ISO/IEC 27001 requirements.

Question 2

What is the difference between ISO 27001:2013 and ISO 27001:2022?

Accepted Answer

The 2022 revision restructured Annex A controls from 114 controls across 14 clauses into 93 controls across 4 themes (Organizational, People, Physical, Technological), and introduced 11 new controls including threat intelligence, cloud services security, and data masking.

Question 3

What evidence must be prepared for a Stage 1 ISO 27001 audit?

Accepted Answer

Stage 1 requires documented ISMS scope, information security policy, risk assessment methodology and risk treatment plan, Statement of Applicability (SoA), and evidence of at least one internal audit and management review cycle.

Question 4

How long does the ISO 27001 certification cycle last?

Accepted Answer

An ISO/IEC 27001 certificate is valid for 3 years, subject to mandatory annual surveillance audits at months 12 and 24 to verify continuous ISMS operation before recertification in year 3.

ISO 27001 certification

End-to-end certification support

Gap analysis

Implementation

Certification support

Frequently asked questions

Achieve ISO 27001 certification

Not sure what you need?