Customer trust
A recognised answer to security questionnaires and supplier due diligence.
Certification support
ISO/IEC 27001 Information Security Management
Current edition: ISO/IEC 27001:2022
The information security standard that customers, regulators and partners ask for. It sets out how to manage information security risk systematically, with controls chosen for your risks rather than a fixed checklist.
2022Only valid edition
The 2013 edition is no longer certifiable
The transition from ISO/IEC 27001:2013 ended on 31 October 2025. Certificates now refer to ISO/IEC 27001:2022, with its 93 Annex A controls in four themes and the 2024 climate amendment. If your system or documents still follow the 2013 structure, a gap review is the place to start.
What the standard covers
Requirements, clause by clause
The management system clauses set how you run information security. Annex A lists the reference controls you select from, justified in your Statement of Applicability.
4
Context
Issues, interested parties, scope and the ISMS.
5
Leadership
Commitment, information security policy, roles.
6
Planning
Risk assessment, risk treatment, Statement of Applicability, objectives, changes.
7
Support
Resources, competence, awareness, communication, documented information.
8
Operation
Operational planning, risk assessments and treatment carried out.
9
Performance evaluation
Monitoring, internal audit, management review.
10
Improvement
Nonconformity, corrective action and continual improvement.
Clauses 4 to 10 follow the Plan-Do-Check-Act cycle and the harmonized structure shared with ISO 9001 and ISO/IEC 42001, so the systems integrate cleanly.
Organisational controls
37 controls, from policies and supplier security to threat intelligence and cloud services.
People controls
8 controls covering screening, awareness, remote working and reporting.
Physical controls
14 controls for premises, equipment and media.
Technological controls
34 controls, including secure development, logging, configuration and data leakage prevention.
Why organisations implement it
What a working ISMS delivers
Risk-based controls
Spending focused on the risks that matter to your business.
Regulatory alignment
A management framework that supports NIS2, DORA and data protection obligations.
Incident readiness
Detection, response and lessons learned built into operations.
Supplier control
Security requirements for suppliers and cloud services defined and checked.
A base for more
Extends to cloud (27017, 27018), privacy (27701) and AI (42001).
How we work
Path to certification
One AEC methodology from first assessment to certificate, delivered by registered lead auditors.
- AssessGap assessment against ISO/IEC 27001, scope and roadmap
- DesignProcesses, risk register, policy and documented information
- ImplementProcesses embedded with coaching for process owners
- TrainAwareness for all staff and internal auditor development
- VerifyInternal audit, management review and mock certification audit
- Certify & sustainStage 1 and Stage 2 support, then surveillance readiness
Full implementation
No existing system. We design and implement from the ground up.
Typically 6 to 9 monthsGap remediation
Some documentation in place. We close the gaps and prove effectiveness.
Typically 4 to 6 monthsUpgrade & integration
Adding cloud, privacy or AI extensions, or integration with ISO 9001.
Typically 3 to 5 months
Who certifies
Independent certification, chosen to fit your market
Your ISO/IEC 27001 certificate is issued by an independent certification body accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares you for that audit; the certification decision is theirs.
CB-neutral
We are not tied to one certification body and help you select one to suit your customers and markets.
Audit-ready
Mock certification audit and closed corrective actions before Stage 1 and Stage 2.
No guarantees
We prepare you thoroughly and never promise an outcome only an independent auditor can decide.
Case study
ISO/IEC 27001 in practice
Chemicals & materials · USA
Dow
ISO/IEC 27001 · 2023 · 6 months · Midland, Michigan
1stAttempt
0NCs
6Months
The challenge
Information security for headquarters operations at Midland, as one of three Dow systems in three regulatory contexts across two continents.
What AEC did
Information security management system for Midland headquarters operations, alongside ISO 9001 for Dow Consumer Solutions and IATF 16949 in Brazil.
All three certified at first attempt, no nonconformities. A relationship since 2017, across two continents.
Where it applies
ISO/IEC 27001 by industry
IT services · SaaS, managed services and data centres
Finance · banks, payments and insurers
Healthcare · patient data and connected devices
Government · public services and suppliers
Manufacturing · IP protection and OT environments
Power & utilities · critical infrastructure
Related standards
Training Academy
View ISO/IEC 27001 courses
ISO/IEC 27001 training
Delivered by practising, registered lead auditors. In-house, public, virtual or hybrid.
- Awareness (half day) for all staff
- Implementer (2 to 3 days) for ISMS owners
- Internal Auditor (2 to 3 days) in line with ISO 19011
- Lead Auditor (5 days), CQI/IRCA certified
Questions
ISO/IEC 27001 FAQ
Does AEC issue the ISO/IEC 27001 certificate?
No. Certificates are issued by independent certification bodies accredited by UKAS, DAkkS or an equivalent national accreditation body. AEC prepares your organisation for that audit and supports you through Stage 1 and Stage 2.
Do we have to implement all 93 Annex A controls?
No. You select controls based on your risk assessment and justify inclusions and exclusions in your Statement of Applicability. Auditors check that the selection follows from your risks. Our risk register template includes a 93-control Statement of Applicability.
How long does ISO/IEC 27001 take?
Typically 6 to 9 months from a standing start, 4 to 6 months where security policies and controls exist, and 3 to 5 months for integration or extensions.
Does ISO/IEC 27001 cover NIS2 or DORA?
It does not replace them, but an ISMS gives you the risk management, incident handling and supplier controls those regulations expect. We map your ISMS to the obligations that apply to you.
Start your ISO/IEC 27001 programme
Tell us your scope, locations and customers' expectations. We reply with a proposal covering risk assessment, implementation, training and certification support.
Certification decisions are made by independent, accredited certification bodies. AEC prepares organisations for certification and does not guarantee certification outcomes.