ISO/IEC 27001:2022

Name

ISO/IEC 27001:2022

Publisher

ISO/IEC

Type

Security standard

What it is

Requirements for establishing, implementing, maintaining and improving an information security management system (ISMS). It is the certifiable standard, with Annex A listing 93 controls.

Key points

Clauses 4–10 set ISMS requirements (context, leadership, planning, support, operation, evaluation, improvement)
Annex A lists 93 controls in four themes
Certification by accredited bodies

On the exam

Certification, management review, the statement of applicability and top management leadership (clause 5.1).