ISO 27001 Requirements for Certification – The Guide by Clauses 4–10

To obtain ISO 27001 certification, companies must meet the requirements of clauses 4 to 10 of the standard and operate an information security management system (ISMS). Core requirements are a systematic risk assessment, demonstrable management commitment, regular internal audits and the implementation of the Annex A controls selected in the Statement of Applicability. Conformity is checked by an accredited certification body in a two-stage audit (Stage 1 and Stage 2); the certificate is valid for three years.

This guide is based on our experience with more than 70 clients. It takes you through all requirements of ISO/IEC 27001:2022 – structured according to the clause structure of the standard itself, so that you can find each requirement directly in your copy of the standard and in the audit report.

Which of these requirements need to be implemented in your company, and how, is something we clarify in our consulting on the implementation of ISO 27001.

Table of contents:

• What does ISO 27001 require of companies?
• What are the benefits of ISO 27001 certification?
• Getting to know the ISO 27001 requirements in more detail
• 4. Applicability and context in the company – the 27001 requirements at a glance
• 5. Leadership – leading the way
• 6. Planning – anticipating challenges
• 7. Support – strengthening the security infrastructure
• 8. Operation – effective implementation of information security
• 9. Performance evaluation – measuring and evaluating progress in meeting the standard
• 10. Improvement – continual development of the ISMS
• ISO 27001 certification of the company with the final audit
• Additional aspects of the organization’s requirements
• The ISO 27001 controls and how they relate to the requirements

What Does ISO 27001 Require of Companies?

ISO 27001 requires the establishment, operation and continual improvement of an information security management system (ISMS) that safeguards the three protection goals of information security: confidentiality, integrity and availability of information. The mandatory requirements are set out in clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, improvement). In addition, Annex A defines a catalog of 93 security measures (controls) in four themes, from which companies select on a risk basis. The standard does not prescribe specific technologies – it requires a functioning management system that identifies and treats risks and documents this in a verifiable way.

What Are the Benefits of ISO 27001 Certification

ISO 27001 certification measurably reduces security risk and opens doors in B2B sales: more and more corporations and public-sector clients require the certificate as a supplier prerequisite. The most important benefits from our client projects:

1. Improved security level: The structured framework for identifying, assessing and treating information security risks systematically uncovers weaknesses.
2. Trust and credibility: The internationally recognized certificate signals audited security standards to customers, partners and insurers.
3. Meeting customer requirements: Tenders and supplier audits increasingly require ISO 27001 – certification becomes a competitive advantage.
4. Regulatory compliance: The standard helps fulfil GDPR obligations and serves as a recognized implementation framework for the NIS-2 requirements [2].
5. Increased efficiency: Clear processes, responsibilities and key figures reduce security incidents and friction losses.
6. Economic benefits: According to Mirtsch’s ISO 27001 study [4], certified companies rate their revenue growth (2.8 vs. 1.8 on a 5-point scale) and their reputational gain (3.4 vs. 2.5) significantly higher than companies that apply the standard without a certificate.

From practice: We don’t just consult on ISO 27001 – we have been through the process ourselves and are certified to ISO/IEC 27001:2022 by an accredited certification body (Proks Certification GmbH). The biggest hurdle was not the technology but our own standards: processes that had “simply worked” for years had to be documented verifiably for the first time. What we learned is described in our field report on our own ISO 27001 certification.

Getting to Know the ISO 27001 Requirements in More Detail

Overview of the ISO 27001 Requirements

ISO 27001 is an internationally recognized standard that defines requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). This overview provides a structured and easy-to-understand presentation of the ISO 27001 requirements. Each section and each requirement is illustrated with practical examples to make the concepts more tangible and to make implementation in the company easier.

4. Applicability and Context in the Company - The 27001 Requirements at a Glance

4.1. The Organization and Its Context: Understanding the Internal and External Landscape

• Identify internal and external factors that may affect the organization’s ability to achieve the intended outcomes of the information security management system (ISMS).
• Examples: Market conditions, legal requirements (e.g. NIS-2), supply chain dependencies. Since Amendment 1:2024, it must also be determined whether climate change is a relevant issue for the ISMS.

4.2. Needs and Expectations of Interested Parties

• Determine the requirements and expectations of relevant stakeholders (e.g. customers, legislators, employees).
• Examples: Systematic recording of customer requirements and legal regulations.

4.3. Determining the Scope of the ISMS

• Define which parts of the organization and which information resources are covered by the ISMS.
• Examples: These can include business processes, technologies or geographical locations.

4.4. Information Security Management System

• Establish, implement, maintain and continually improve the ISMS, including the processes needed and their interactions.
• Examples: A process map of the ISMS with responsibilities and interfaces.

5. Leadership - Leading the Way

5.1. Leadership Commitment

• Ensure that top management supports the implementation of the ISMS and takes responsibility for it.
• Examples: By providing resources and promoting a security culture.

5.2. Information Security Policy

• Develop and communicate a security policy that defines the organization’s information security objectives and commitment.
• Examples: Establishing corporate information security policies and issuing public security statements.

5.3. Roles, Responsibilities and Authorities

• Define and communicate clear roles and responsibilities for information security.
• Examples: Appointing an information security officer (ISO) in the company and setting up an incident response team.

6. Planning - Anticipating Challenges

6.1. Risk Management

• Identify and assess information security risks and plan measures to treat these risks.
• Examples: Carrying out regular risk analyses with the help of risk management plans.

6.1.3. Risk Treatment Measures

• Develop measures to treat identified risks, including acceptance, reduction, transfer or avoidance.
• Examples: Implementing technical controls and taking out insurance for existing security gaps.

6.2. Information Security Objectives and Planning to Achieve Them

• Defining measurable security objectives and planning measures to achieve these objectives.
• Examples: Targeted reduction of security incidents by increasing the employee awareness rate and conducting regular training.

6.3. Planning of Changes

• Changes to the ISMS must be carried out in a planned manner (new in the 2022 version).

7. Support - Strengthening the Security Infrastructure

7.1. Resource Management

• Ensure that sufficient resources (time, money, personnel) are provided for implementing and maintaining the ISMS.
• Examples: Clear budget allocations and staff training in preparation for certification to ISO 27001.

7.2. Competence and Training

• Determine the necessary competences and provide training to develop them.
• Examples: Information security training and the introduction of certification programs for employees, up to training as a Lead Auditor (in German) for the company.

7.3. and 7.4. Awareness and Communication

• Promote awareness of information security and establish effective communication processes.
• Examples: Awareness campaigns on dealing with risks and opportunities. Setting up internal communication guidelines.

7.5. Documented Information

• Create and maintain documented information to support the ISMS.
• Examples: Writing down security policies clearly, introducing systematic process documentation and keeping records of incidents.

8. Operation - Effective Implementation of Information Security

8.1. Operational Planning and Control

• Plan, implement and control processes to meet information security requirements.
• Examples: Developing operational plans and requiring continuous process controls.

8.2. Information Security Risk Assessment

• Perform the risk assessment at planned intervals and when significant changes occur, and retain the results as documented information.
• Examples: Annual update of the risk register and an event-driven assessment for new systems or service providers.

8.3. Implementing Risk Treatment

• Implement risk treatment measures and ensure that they work as planned.
• Example: Having technical controls carried out by the IT department.

Examples of controls from Annex A (not requirements of clause 8 itself):

Annex A: Information Security Incident Management (A.5.24–A.5.28)

• Detect and respond to information security incidents and ensure that measures are implemented.
• Examples: Having incident response plans drawn up by the information security officer (ISO) and establishing clear escalation processes.

Annex A: Emergency Management and Recovery (A.5.29–A.5.30)

• Develop and implement plans for emergencies and for recovery after an incident.
• Examples: Having emergency plans and recovery measures defined by the security officer.

9. Performance Evaluation - Measuring and Evaluating Progress in Meeting the Standard

9.1. Monitoring and Measurement

• Monitor and measure the performance of the ISMS using defined key figures.
• Examples: Security metrics can be used to produce regular monitoring reports.

9.2. Internal Audits

• Plan and conduct regular internal assessments to check the effectiveness of the ISMS.
• Examples: Audit plans and audit reports are the basis for ongoing internal assessments.

9.3. Management Reviews

• Management regularly reviews the suitability and effectiveness of the ISMS using ISMS KPIs that reflect the effectiveness of the information security measures, e.g. the effectiveness of employee awareness measures, the number of audited systems or of systems with automated patching, etc.
• Examples: Producing clear, precise meeting minutes that record important discussion points, decisions and responsibilities. Establishing meaningful metrics to measure ISMS performance.

10. Improvement - Continual Development of the ISMS

10.1. Continual Improvement

• Identify and implement opportunities for improving the ISMS.
• Examples: Setting up improvement projects based on previously prepared best-practice analyses.

10.2. Corrective Action

• Take action to eliminate the causes of nonconformities in order to prevent their recurrence.
• Examples: Carrying out a root cause analysis followed by corrective actions.

ISO 27001 Certification of the Company with the Final Audit

• Procedure for obtaining and maintaining ISO 27001 certification by an external auditor. With the certification, you also receive the corresponding proof for your company.
• The process for obtaining and maintaining ISO 27001 certification comprises several important steps:
  • • Carrying out a gap analysis
    • Implementing the necessary measures
    • Internal assessments with the support of our consultants
    • Formal certification by an external auditor.
• The certification confirms that the ISMS meets the requirements of ISO 27001 and has been implemented effectively.
• Regular surveillance audits ensure that compliance is maintained continuously and that the system is continually improved.
• Examples: Internal audits, external audits and the associated certification processes.

Surveillance Audit

• In years 1 and 2 after the certificate is issued, a surveillance audit takes place each year – no new application is required, as it is part of the ongoing certification. It is based on the certification process according to BSI requirements (in German).
• Examples: Evidence of the effectiveness of corrective actions, sample checks of selected controls.

Recertification

• Before the three-year validity expires, a recertification audit takes place; with certification bodies, it is usually part of the ongoing certification contract.
• Examples: Complete repeat audit of the ISMS with a fresh assessment of scope, risk treatment and Statement of Applicability.

Additional Aspects of the Organization’s Requirements

Access Rights, IAM and Compliance in the ISMS

Effective information security management does not end with formally meeting the ISO 27001 requirements; it also includes the practical management of access rights, identities and privileged accounts. In access control in particular, clean identity and access management (IAM), role-based access control (RBAC), multi-factor authentication (MFA) and targeted privileged access management (PAM) play a central role in preventing unauthorized access and implementing the principle of least privilege.

This includes the regular granting, review and recertification of permissions, the clean separation of roles, the management of joiner-mover-leaver processes and the protection of credentials, sessions and administrative rights.

For companies close to critical infrastructure (KRITIS), it is also important to align ISO 27001 with other frameworks and regulatory requirements such as ISO 27002, the GDPR, the obligations under the BSIG following the NIS-2 implementation (in force since December 6, 2025) and – depending on the sector – B3S, in order to cover information security and compliance holistically.

For AI systems, the requirements of ISO 42001 (in German) also apply — many controls can be derived from the existing ISMS.

How Are Requirements and Controls Related?

The requirements of clauses 4 to 10 define how an ISMS must be established and operated – they are fully mandatory. The Annex A controls, by contrast, are concrete risk treatment measures that are selected on a risk basis: in the Statement of Applicability, the company documents for each of the 93 controls whether it is applied and justifies its inclusion or exclusion. Guidance on implementing each control is provided by the accompanying ISO 27002 – it is a guideline against which you cannot be certified. How an ISMS is built along this logic is shown in our guide to building an ISMS.

From practice: Our own ISMS shows what a justified exclusion in the SoA looks like: as a remote-first company, we have taken several physical controls (A.7) out of scope, and since we do not develop software, also the controls for secure development. This is exactly the transparency the auditor expects – not the implementation of all 93 controls, but a comprehensible justification for every inclusion and every exclusion.

ISO 27001 Controls Identify, Assess and Treat Information Risks

ISO 27001 controls are concrete security measures that a company can implement to manage information security risks and meet the requirements of ISO 27001. These measures are divided into four themes:

• Organizational controls (A.5, 37 controls): Policies, roles, information classification, supplier relationships, incident and continuity management – e.g. A.5.7 Threat intelligence, A.5.23 Information security for use of cloud services, A.5.24 Information security incident management planning.
• People controls (A.6, 8 controls): Screening, terms and conditions of employment, awareness and training, remote working – e.g. A.6.3 Information security awareness, education and training, A.6.7 Remote working.
• Physical controls (A.7, 14 controls): Secure areas, physical entry control, protection of equipment – e.g. A.7.4 Physical security monitoring, A.7.7 Clear desk and clear screen.
• Technological controls (A.8, 34 controls): Access control, cryptography, logging, network security, secure development – e.g. A.8.9 Configuration management, A.8.12 Data leakage prevention, A.8.24 Use of cryptography.

Overall, these controls and the listed measures for dealing with risks help to identify, assess and treat information risks. They therefore form the backbone of a solid information security management system. They ensure that information security requirements are addressed systematically and comprehensively in accordance with the ISO 27001 standard.

Sources:

[1] German Federal Office for Information Security (BSI) (2023): ISO 27001 certification on the basis of IT-Grundschutz (in German). (accessed on July 8, 2026).

[2] German Federal Office for Information Security (BSI) (2026): #nis2know: ISO/IEC 27001 in the context of NIS-2/BSIG (in German). (accessed on July 8, 2026).

[3] International Organization for Standardization (ISO) (2022): ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements. (accessed on July 8, 2026).

[4] Mirtsch, M. (2023). Adoption of the Information Security Management System Standard ISO/IEC 27001: A Study Among German Organizations. International Journal for Quality Research, 17(3), 747–768.

Last updated: July 10, 2026