Think about how much information an organization handles every day: customer details, employee records, financial information, business plans, contracts, emails, and digital files. If this information is lost, exposed to the wrong people, or changed without permission, it can affect customer trust and disrupt business operations.
ISO/IEC 27001:2022 helps organizations take a structured approach to protecting the information they hold and manage. It provides a framework for identifying information security risks, putting appropriate safeguards in place and continually improving how information is protected. Certification gives customers, business partners and other interested parties independent evidence that an organization’s information security management system has been assessed against an internationally recognized standard.
Guardian Assessment Private Limited provides management system certification services to organizations seeking independent assessment of their management systems. Any ISO/IEC 27001 certification application is subject to confirmation that the relevant standard and technical sector fall within Guardian’s current accreditation scopes. This page explains the standard, its requirements, who can benefit from certification, and what to expect from the certification process.
Request Quotation
What Is ISO/IEC 27001:2022 Certification?
ISO/IEC 27001:2022 is the international standard for information security management systems (ISMS). In simple terms, it helps organizations understand what information they need to protect, identify what could put that information at risk, and decide how to manage those risks.
The standard covers information in different forms, including digital files, paper records, databases, business systems, and information entrusted to the organization by customers or other parties. It focuses on protecting three important aspects of information:
- Confidentiality: Information is accessible only to people who are authorized to see it.
- Integrity: Information remains accurate, complete, and protected against unauthorized changes.
- Availability: Information and systems are accessible when authorized users need them.
Certification involves three parties:
- ISO and IEC publish the standard. They develop and maintain the requirements but do not audit individual organizations or issue certificates.
- Your organization implements the management system. It establishes and operates an ISMS that meets the requirements of ISO/IEC 27001.
- A certification body assesses the system. An independent certification body audits the ISMS and issues an ISO/IEC 27001 certificate if the applicable requirements are met.
ISO/IEC 27001 follows the harmonized structure used by other management system standards, such as ISO 9001, ISO 14001 and ISO 45001. This allows organizations to integrate information security with their existing quality, environmental, occupational health and safety or other management systems.
Certification does not guarantee that an organization will never experience a cyberattack, data breach, or information security incident. It also does not replace the organization’s responsibility to meet applicable legal, regulatory and contractual requirements.
ISO/IEC 27001:2022 at a Glance
Particular | Details |
Full title | Information security, cybersecurity and privacy protection — Information security management systems — Requirements |
First edition | Published in 2005 |
Second edition | ISO/IEC 27001:2013 |
Current edition | ISO/IEC 27001:2022, including Amendment 1:2024 |
Publication date | 25 October 2022 |
Structure | 10 clauses following the harmonized structure; requirements are primarily contained in Clauses 4 to 10 |
Annex A controls | 93 information security controls grouped into four themes: organizational, people, physical and technological |
Climate change amendment | Amendment 1:2024, published in February 2024, adds climate change considerations to Clauses 4.1 and 4.2 |
Previous edition | Replaced ISO/IEC 27001:2013; the IAF transition period ended on 31 October 2025 |
Technical committee | ISO/IEC JTC 1/SC 27 — Information security, cybersecurity and privacy protection |
Related standards | ISO/IEC 27000 provides an overview of the ISMS family; ISO/IEC 27002 provides information security controls guidance; ISO/IEC 27005 addresses information security risk management |
Certification framework | ISO/IEC 17021-1 establishes general requirements for management system certification bodies; ISO/IEC 27006-1:2024 provides additional requirements for ISMS certification bodies |
Audit duration | Determined in accordance with applicable certification requirements, including ISO/IEC 27006-1:2024 |
Next edition | ISO/IEC 27001:2022 remains the published edition, with Amendment 1:2024. No replacement edition has been announced |
Sample Certificate
Request Quotation
Other Standards
Recognition
Sample Certificate
The Evolution of ISO/IEC 27001: From 2005 to Today
Information security management has developed alongside changes in technology, business operations and the way organizations store and exchange information. ISO/IEC 27001 has also evolved to address these changing needs.
- 2005 – The first edition: ISO/IEC 27001 was first published in 2005. It established international requirements for creating, implementing, maintaining, and improving an information security management system.
- 2013 – The second edition: The 2013 edition updated the standard’s requirements and aligned its structure with the common framework used by other ISO management system standards. It strengthened the focus on organizational context, leadership, risk management, and continual improvement.
- 2022 – The third edition: Published on 25 October 2022, ISO/IEC 27001:2022 replaced the 2013 edition. The main management system requirements were updated and aligned with the harmonized structure, while Annex A was reorganized to reflect the revised information security controls in ISO/IEC 27002:2022.
- 2024 – Climate Action Amendment: In February 2024, ISO published an amendment requiring organizations to determine whether climate change is a relevant issue for their ISMS and recognizing that interested parties may have climate-related requirements. This was an amendment to ISO/IEC 27001:2022, not a new edition.
- 2025 – The end of the 2013 transition period: The three-year transition period under IAF MD 26 ended on 31 October 2025. For certification bodies and accredited certificates within the scope of those IAF arrangements, organizations were required to complete their transition to the 2022 edition by this date.
Organizations seeking new ISO/IEC 27001 certification should use the 2022 edition, including its 2024 amendment. Existing certificate holders should ensure that their certificates and certification arrangements reflect the applicable current requirements.
ISO/IEC 27001:2022 vs. ISO/IEC 27001:2013
ISO/IEC 27001:2022 replaced the 2013 edition and introduced important changes, particularly to Annex A. The overall purpose of the standard remains the same: to help organizations manage information security risks and protect the confidentiality, integrity, and availability of information.
Area | ISO/IEC 27001:2013 | ISO/IEC 27001:2022 |
Standard edition | Second edition, published in 2013 | Third edition, published in 2022 |
Structure | Followed the harmonized structure used at the time | Updated to align with the latest harmonized structure |
Annex A controls | 114 controls grouped into 14 domains | 93 controls grouped into four themes |
Organizational controls | Controls were distributed across the previous 14 domains | 37 organizational controls |
People controls | People-related controls were included across the previous structure | 8 people controls |
Physical controls | Physical security controls were included in the previous Annex A | 14 physical controls |
Technological controls | Technical controls were distributed across the previous domains | 34 technological controls |
New controls | Did not include the 11 controls introduced in the 2022 revision | Introduced 11 new controls addressing areas such as threat intelligence, cloud services, data leakage prevention, and secure coding |
Control attributes | Used the previous control structure and presentation | Introduced control attributes to help organizations classify and understand controls |
Risk treatment | Required organizations to assess and treat information security risks | Retains the risk-based approach, with the revised Annex A control reference set |
The 2022 edition contains 93 controls rather than 114, but this does not mean that information security requirements have simply been reduced. Several controls were consolidated or updated, and new controls were introduced to address evolving security risks.
The 11 new controls include:
- Threat intelligence.
- Information security for use of cloud services.
- ICT readiness for business continuity.
- Physical security monitoring.
- Configuration management.
- Information deletion.
- Data masking.
- Data leakage prevention.
- Monitoring activities.
- Web filtering.
- Secure coding.
Organizations should review their existing ISMS against the 2022 requirements rather than assuming that their previous arrangements automatically meet the revised standard. Particular attention should be given to the risk assessment process, Statement of Applicability, risk treatment plan and the updated Annex A controls.
ISO/IEC 27001:2022 Amendment 1:2024 – Climate Change Considerations
In February 2024, ISO published a climate action amendment applicable to ISO/IEC 27001:2022. It introduced climate change considerations into the requirements for understanding the organization’s context and the needs and expectations of interested parties. Under the amendment:
- Clause 4.1: Organizations must determine whether climate change is a relevant issue that could affect their information security management system.
- Clause 4.2: Organizations must recognize that relevant interested parties may have requirements related to climate change.
The relevance of climate change will depend on the organization’s activities, operating environment, information assets and business continuity arrangements. For example, climate-related issues may include:
- Extreme weather affecting data centres, offices or other facilities.
- Power interruptions that affect the availability of information systems.
- Flooding, heat or other environmental conditions that disrupt IT infrastructure.
- Climate-related disruption to cloud service providers or other critical suppliers.
- Changes to business continuity and disaster recovery arrangements.
Where these issues are relevant, organizations should consider them when evaluating their context, interested-party requirements and information security risks. Auditors may examine how the organization has determined whether climate change is relevant and whether any resulting risks or requirements have been addressed. The amendment does not introduce a separate set of mandatory climate controls. Organizations should determine relevance based on their own context and risks.
Who Needs ISO/IEC 27001 Certification?
ISO/IEC 27001 can be applied by organizations of any size, type, or industry that create, receive, store, process, or manage information. It is relevant to businesses that handle their own information as well as organizations that process or manage information on behalf of customers, suppliers, or other parties.
The scope and complexity of an ISMS will depend on the organization’s business activities, information assets, technology, locations, suppliers and information security risks. Organizations commonly pursue ISO/IEC 27001 certification for reasons such as:
- Client and contractual requirements: Customers and business partners may require independent evidence that an organization has an established information security management system.
- Tenders and procurement: Some public and private sector procurement processes specify ISO/IEC 27001 certification as a supplier qualification or security requirement.
- Supply-chain security: Organizations that work with third parties, cloud providers, outsourced service providers, or business partners may use certification to demonstrate a structured approach to managing information security risks.
- Regulatory and legal responsibilities: Organizations may pursue certification to strengthen how they identify and manage information security obligations. Certification does not itself establish compliance with every applicable law or regulation.
- Protection of sensitive information: Businesses handling customer records, employee information, financial data, intellectual property, or confidential business information may benefit from a structured security management approach.
- Improving information security management: Organizations may seek certification to establish consistent processes for risk assessment, security controls, incident management, and continual improvement.
Which Industries Can Get ISO/IEC 27001 Certified?
ISO/IEC 27001 is not limited to the information technology sector. Any organization that handles information and wants to manage information security risks can implement the standard and seek certification, provided its activities fall within the applicable certification scope. Some industries where ISO/IEC 27001 certification is particularly relevant include:
- Information technology and software: Software developers, IT service providers, SaaS businesses, managed service providers and technology companies can use ISO/IEC 27001 to manage risks involving applications, networks, customer information and development environments.
- Cloud computing and data centres: Cloud service providers, hosting companies and data centre operators can use an ISMS to manage risks involving infrastructure, access, data storage, service availability and customer information.
- Healthcare and pharmaceuticals: Hospitals, clinics, laboratories, pharmaceutical companies and healthcare technology providers can manage risks involving patient records, research information, medical systems and confidential data.
- Manufacturing and industrial operations: Manufacturers and industrial organizations can address information security risks involving production systems, intellectual property, industrial networks, supplier information and operational technology.
- Education and research: Schools, universities, training providers and research institutions can manage information security risks involving student records, academic systems, research data and intellectual property.
- Government and public services: Public sector organizations and service providers can use an ISMS to manage information entrusted to them and protect the systems used to deliver public services.
- Transportation and logistics: Airlines, shipping companies, freight operators and logistics providers can manage risks involving booking systems, tracking platforms, customer information and operational data.
- Energy and utilities: Energy providers, electricity distributors, water utilities and other infrastructure operators can address information security risks involving operational systems, infrastructure and business continuity.
- Telecommunications: Telecom operators, internet service providers and network infrastructure companies can use the standard to manage risks involving communications networks, customer data and service availability.
- Retail and e-commerce: Retailers, online marketplaces and e-commerce businesses can manage risks involving customer accounts, payment information, order records and digital platforms.
- Professional and business services: Legal firms, accounting practices, consulting companies and business process service providers can protect client records, contracts, financial information and confidential business data.
- Banking and financial services: Banks, payment processors, financial institutions, investment firms and insurance providers handle sensitive financial and personal information that requires appropriate protection.
These are examples rather than a complete list. ISO/IEC 27001 can be relevant to private, public and non-profit organizations across different sectors. The certification scope should accurately describe the information security management activities, locations, systems, and services covered by the ISMS.
Benefits of ISO/IEC 27001 Certification
ISO/IEC 27001 provides a structured approach to managing information security risks and protecting information. Its benefits depend on how effectively an organization implements and maintains its ISMS. Some potential benefits include:
- Better information security risk management: A systematic process helps organizations identify, assess, and treat risks affecting their information and supporting systems.
- Protection of information: The ISMS supports the confidentiality, integrity, and availability of information across digital, physical, and other relevant formats.
- Improved security awareness: Defined responsibilities, communication and awareness activities help employees understand their role in protecting information.
- Stronger access and operational controls: Organizations can establish controls for information access, system use, suppliers, physical security and other relevant activities.
- Improved incident preparedness: Defined processes can help organizations detect, report, respond to, and learn from information security incidents.
- Greater confidence among interested parties: Independent certification can provide customers, suppliers and business partners with evidence that the ISMS has been assessed against an international standard.
- Better supplier and third-party oversight: Organizations can incorporate information security considerations into supplier selection, contracts and ongoing monitoring.
- Continual improvement: Monitoring, internal audits, management reviews and corrective actions help organizations evaluate and improve their information security management system.
Certification does not guarantee that an organization will be protected from every cyber threat or information security incident. It provides independent evidence that the management system has been assessed against the standard’s requirements.
What Are the Requirements of ISO/IEC 27001:2022 Certification?
The requirements of ISO/IEC 27001:2022 are primarily contained in Clauses 4 to 10. Clauses 1 to 3 cover the scope, normative references, and terms and definitions.
Clause | What it covers | What auditors look for |
4 – Context of the organization | Internal and external issues, interested parties, their requirements and the scope of the ISMS | A defined ISMS scope and an understanding of the information security issues that can affect the organization |
5 – Leadership | Management commitment, information security policy, roles and responsibilities | Evidence that top management supports the ISMS and that information security responsibilities are assigned |
6 – Planning | Information security risks and opportunities, risk assessment, risk treatment and information security objectives | A defined risk assessment methodology, risk assessment results, risk treatment plan and Statement of Applicability |
7 – Support | Resources, competence, awareness, communication and documented information | Evidence that the organization has the resources and competent personnel needed to operate the ISMS |
8 – Operation | Operational planning and control, information security risk assessments and risk treatment | Evidence that risk assessments and risk treatment activities are implemented and controlled |
9 – Performance evaluation | Monitoring, measurement, analysis, evaluation, internal audits and management review | Evidence that the organization evaluates ISMS performance and reviews whether the system remains effective |
10 – Improvement | Nonconformities, corrective actions and continual improvement | Evidence that issues are addressed, corrective actions are evaluated and the ISMS is improved |
Understanding Annex A Controls
Annex A of ISO/IEC 27001:2022 contains 93 reference controls grouped into four themes:
Annex A theme | Number of controls | Main focus |
Organizational controls | 37 | Information security policies, responsibilities, supplier relationships, asset management and organizational processes |
People controls | 8 | Screening, awareness, training, responsibilities and information security matters relating to personnel |
Physical controls | 14 | Physical access, secure areas, equipment protection and environmental security |
Technological controls | 34 | Access management, authentication, system security, monitoring, network security and secure development |
Organizations do not automatically have to implement every Annex A control. They must determine the controls needed to treat their information security risks, consider the reference controls in Annex A and document their decisions in the Statement of Applicability (SoA). Controls from other sources may also be considered where appropriate. Three areas receive particular attention during ISO/IEC 27001 assessments:
- Information security risk assessment and treatment: Organizations must establish a repeatable process for identifying, analysing and evaluating information security risks. They must decide how to treat those risks and retain evidence of the assessment and treatment activities.
- Statement of Applicability (SoA): The SoA is a key documented element of the ISMS. It identifies the necessary controls, explains why they have been included, states whether they have been implemented, and provides justification for excluding any Annex A controls.
- Confidentiality, integrity and availability: Organizations must consider how information could be disclosed, changed, lost or made unavailable. The selected controls should address the risks relevant to the organization’s information, systems, people, suppliers and operations.
The Principles Behind ISO/IEC 27001:2022
ISO/IEC 27001 is based on a risk-driven approach to information security. It encourages organizations to protect information through a combination of people, processes, technology, and management oversight.
Principle | What it means |
Confidentiality | Ensure that information is accessible only to authorized people and systems |
Integrity | Protect information against unauthorized changes, damage or loss of accuracy |
Availability | Ensure that information and systems are available when needed by authorized users |
Risk-based thinking | Identify, assess and treat information security risks according to the organization’s context and objectives |
Leadership and accountability | Top management provides direction and assigns responsibilities for information security |
People and awareness | Employees and relevant interested parties understand their information security responsibilities |
Appropriate controls | Select security measures that address identified risks and support the organization’s requirements |
Continual improvement | Monitor performance, address weaknesses and improve the ISMS over time |
The standard follows the Plan-Do-Check-Act (PDCA) approach. Organizations plan their information security objectives and risk treatment activities, implement the necessary controls, check performance through monitoring and audits, and take action to improve the system.
What Documents and Records Should an Organization Maintain for ISO/IEC 27001?
ISO/IEC 27001 requires organizations to maintain and retain documented information in specified areas to demonstrate conformity and support the effective operation of the ISMS.
The exact documentation will depend on the organization’s size, activities, information security risks, technology, operating environment, and the complexity of its systems. The standard does not require every organization to use the same set of manuals, procedures or forms.
Documented Information to Maintain
Organizations should maintain documented information relating to areas such as:
- Scope of the ISMS (Clause 4.3): The boundaries and applicability of the information security management system.
- Information security policy (Clause 5.2): The organization’s overall direction and commitments for information security.
- Information security risk assessment process (Clause 6.1.2): The methodology, criteria, and process used to assess information security risks.
- Information security risk treatment process (Clause 6.1.3): The approach used to select and implement risk treatment options.
- Statement of Applicability (Clause 6.1.3): The necessary controls, justifications for their inclusion, implementation status, and justifications for excluding controls.
- Information security risk treatment plan (Clause 6.1.3): The actions selected to address identified information security risks.
- Risk treatment approval and residual risk acceptance (Clause 6.1.3): Evidence of approval by risk owners and their acceptance of residual information security risks.
- Information security objectives (Clause 6.2): The organization’s information security objectives and plans for achieving them.
Records to Retain
Organizations should also retain documented evidence relating to:
- Information security risk assessment results (Clause 8.2).
- Information security risk treatment results (Clause 8.3).
- Competence and relevant training evidence (Clause 7.2).
- Monitoring, measurement, analysis and evaluation results (Clause 9.1).
- Internal audit programmes and audit results (Clause 9.2).
- Management review results (Clause 9.3).
- Nonconformities, corrective actions and their results (Clause 10.2).
- Evidence needed to demonstrate that operational processes have been carried out as planned (Clause 8.1).
Other Useful ISMS Documents
Depending on the organization’s activities, information assets and risks, it may also maintain documents and records such as:
- Information asset inventory.
- Information classification and handling procedure.
- Access control policy and user access records.
- Acceptable use policy.
- Backup and recovery procedures.
- Information security incident response procedure.
- Business continuity and disaster recovery plans.
- Supplier and third-party information security procedure.
- Cryptography and key management procedure.
- Vulnerability and patch management records.
- Change management procedure.
- Secure development and software release procedures.
- Physical security procedures.
- Remote working and mobile device security policies.
- Information security awareness and training records.
- Logging, monitoring and review records.
These examples are not all mandatory as separate documented procedures under ISO/IEC 27001. They may help an organization demonstrate how its ISMS operates and how relevant risks are managed.
An ISMS manual is also not mandatory. Organizations can choose a documentation structure that suits their operations, provided they meet the standard’s documented-information requirements and can demonstrate effective implementation.
How to Get ISO/IEC 27001 Certified
Are You Ready to Apply?
Your organization is generally ready for a certification audit when:
- Your ISMS is established and operating, with a defined scope, an information security policy, and clear responsibilities.
- Information assets and relevant information security risks have been identified.
- An information security risk assessment methodology and risk treatment process are established.
- A Statement of Applicability and information security risk treatment plan have been prepared.
- The selected information security controls have been implemented or are being managed according to the approved treatment plan.
- Employees and relevant personnel understand their information security responsibilities.
- Processes for incident reporting, supplier security, access management, and business continuity are in place where relevant to the ISMS.
- You have completed an internal audit and management review.
If some of these activities are still in progress, it may be helpful to complete them before the certification audit. This allows the organization to identify and address gaps in advance.
Guardian is an impartial certification body. It audits and certifies management systems but does not develop or document management systems for clients.
The ISO/IEC 27001 Certification Process at Guardian
- Application Review: We review your submitted application, organizational structure, business activities, locations, employee count, and proposed Information Security Management System (ISMS) scope to confirm our competence and scope alignment.
- Audit Planning: Audit duration is determined based on factors such as the ISMS scope, organizational size, complexity, number of locations, and information security risks. We assign a technically qualified audit team with relevant information security experience and provide a detailed audit plan.
- Stage 1 Audit: The audit team reviews your ISMS documentation, information security risk assessment, risk treatment plan, Statement of Applicability (SoA), policies, and internal audit and management review records to assess your readiness for Stage 2.
- Stage 2 Audit: Auditors assess the implementation and effectiveness of your ISMS. This includes reviewing information security controls, evaluating risk treatment measures, interviewing relevant personnel, examining operational processes, and checking evidence of compliance with ISO/IEC 27001 requirements.
- Technical Review: To maintain impartiality, the complete audit file, findings, and supporting evidence are reviewed by a competent person who was not involved in conducting the audit.
- Certification Decision: After a satisfactory technical review and closure of any nonconformities, Guardian Assessment makes the certification decision and issues your ISO/IEC 27001 certificate, subject to the applicable accreditation scope.
Surveillance and Recertification: ISO/IEC 27001 certification operates on a three-year certification cycle. Annual surveillance audits are conducted during the first and second years to verify that your ISMS continues to meet the standard’s requirements. In the third year, an in-depth recertification audit is conducted before the certificate expires.
How Long Does It Take to Get ISO/IEC 27001 Certified?
The time required to obtain ISO/IEC 27001 certification depends mainly on the organization’s readiness and the complexity of its information security management system. An organization with a defined ISMS scope, completed risk assessment, documented risk treatment plan, Statement of Applicability, and implemented controls may be ready for certification sooner than an organization that is still developing its system. Other factors affecting the timeline include:
- Size of the organization and number of personnel.
- Scope and complexity of the ISMS.
- Number and location of operational sites.
- Number and type of information systems and technologies.
- Nature and sensitivity of the information being handled.
- Use of cloud services, outsourced IT functions and third-party providers.
- Availability of relevant documentation and records.
- Any nonconformities identified during the audit and the time required to address them.
Once issued, an ISO/IEC 27001 certificate generally has a three-year certification cycle, subject to successful surveillance audits and continued fulfilment of certification requirements.
What Is the Cost of ISO/IEC 27001 Certification?
There is no fixed price for ISO/IEC 27001 certification. The cost is determined individually because organizations differ in size, ISMS scope, information systems, number of sites, operational complexity, and the maturity of their information security management systems. The main factors affecting certification cost include:
- Size of the organization and number of personnel.
- Scope and complexity of the ISMS.
- Number and location of sites.
- Nature of the organization’s business activities.
- Number and type of information systems and technologies.
- Use of cloud services, outsourced functions and external service providers.
- Information security risk profile.
- Readiness and implementation status of the ISMS.
- Number of audit days required.
The certification cost generally includes the initial certification audit, surveillance audits and recertification activities over the certification cycle. Audit time is determined in accordance with applicable certification requirements and takes account of the organization’s ISMS scope, complexity and other relevant factors.
Guardian prepares a quotation after reviewing these details. To request one, complete application form F-01, available on our Downloads page, and send it to us. You can also email us at info@guardiancertification.com or submit an enquiry through the Contact Us page. If you need more than one management system certification, you may be able to apply for ISO/IEC 27001 alongside other relevant standards as part of an integrated certification arrangement.
How to Check an ISO/IEC 27001 Certificate Is Genuine
A certificate’s credibility depends on the competence and impartiality of the certification body that issued it and, where applicable, the accreditation supporting its certification activities. A certification body audits and certifies organizations. An accreditation body assesses the certification body’s competence and impartiality within defined scopes. The International Accreditation Forum (IAF) Multilateral Recognition Arrangement (MLA) supports international recognition of accredited certifications within its applicable scopes. Before choosing a certification body, you can take the following steps:
- Check the certificate with the certification body: Contact the issuing certification body or use its certificate verification service. Guardian certificates can be checked through our client search.
- Check the accreditation: Verify the certification body’s accreditation status and applicable ISO/IEC 27001 scope in the accreditation body’s official directory.
- Check IAF CertSearch: Use IAF CertSearch, the global database for accredited management system certifications, to search for relevant certificate information where available.
A certificate should be checked against the issuing body’s records and the applicable accreditation scope rather than relying only on the appearance of the certificate.
Integrating ISO/IEC 27001 With Other Management System Standards (IMS)
Many organizations integrate information security with other management systems, such as quality, environmental management, occupational health and safety, business continuity and IT service management. An integrated management system (IMS) can use shared processes, responsibilities, documentation and internal audits instead of maintaining completely separate systems. The harmonized structure of ISO management system standards makes integration easier. Organizations can coordinate common activities such as context analysis, leadership reviews, internal audits, corrective actions, and continual improvement. Where applicable requirements are met, combined audits may reduce duplication and the total audit time.
Guardian Assessment provides management system certification services that may include combined audits for:
- ISO 9001 – Quality Management System.
- ISO 14001 – Environmental Management System.
- ISO 45001 – Occupational Health and Safety Management System.
- ISO 21001 – Educational Organizations Management System.
- ISO 37001 – Anti-Bribery Management System.
Guardian Assessment also provides certification or assessment services for specialized management system standards and frameworks, subject to applicable scopes and requirements. These include ISO 22000 (Food Safety), ISO 13485 (Medical Devices), ISO 50001 (Energy), ISO/IEC 27701 (Privacy Information Management), ISO/IEC 20000-1 (IT Service Management), ISO 22301 (Business Continuity), ISO 41001 (Facility Management), ISO 55001 (Asset Management), and ISO/IEC 42001 (Artificial Intelligence).
Why Choose Guardian as Your ISO/IEC 27001 Certification Body?
Choosing a certification body is an important part of the certification process. Organizations should consider its accreditation, competence, impartiality, and ability to assess their information security management systems.
- Accreditation: Guardian is accredited by UAF and IAS for applicable certification activities. The relevant ISO/IEC 27001 accreditation scope and technical sector coverage should be confirmed for the specific certification application.
- Auditors with relevant technical knowledge: Audit teams are assigned based on the organization’s activities, information systems, technology, and information security risks.
- Impartial certification: Guardian conducts independent audits and certification decisions. It does not provide consultancy for the management systems it certifies, helping maintain impartiality throughout the process.
- Combined audits: Organizations seeking multiple management system certifications may be able to combine audits for ISO/IEC 27001 and other applicable standards, where the relevant scopes and audit arrangements allow.
- Certificate transfer: Organizations holding an accredited ISO/IEC 27001 certificate from another certification body may be eligible to transfer their certification, subject to a review of the existing certificate and applicable transfer requirements.
Apply for ISO/IEC 27001:2022 Certification
If your organization is planning to obtain ISO/IEC 27001:2022 certification, Guardian Assessment can guide you through the application, audit planning, and certification process.
Tell us about your organization, the information it handles, its information systems, and the activities covered by your ISMS. You can apply for ISO/IEC 27001 certification alone or explore an integrated certification approach with other management system standards, subject to the applicable certification scopes.
Contact Guardian Assessment to request a quotation or begin your ISO/IEC 27001 certification application.
Frequently Asked Questions
Organizations of any size or industry can apply for ISO/IEC 27001 certification. It is suitable for businesses that handle confidential, personal, financial, or operational information. IT companies, banks, healthcare providers, educational institutions, and manufacturers are some examples.
Annex A of ISO/IEC 27001:2022 contains 93 information security controls. These are grouped into four categories: organizational, people, physical, and technological controls. Organizations select controls based on their information security risks and document their decisions in the Statement of Applicability.
Organizations must maintain documented information such as the ISMS scope, information security policy, risk assessment, and risk treatment plan. The Statement of Applicability and information security objectives are also required. Additional records may include internal audit results, management review records, and corrective action documentation.
The certification timeline depends on the organization's size, complexity, and ISMS readiness. Organizations with established information security processes may need less preparation time. The overall duration also depends on the audit scope and the time required to address any identified nonconformities.
Yes. ISO/IEC 27001 can be integrated with other management system standards, including ISO 9001, ISO 14001, and ISO 45001. Their compatible structures allow organizations to coordinate policies, objectives, audits, and management reviews. An integrated approach can help reduce duplication and simplify management system activities.