A large customer sends you a supplier questionnaire, and question one asks for your ISO 27001 certificate. If you are a 40-person company without a dedicated security team, that request can feel like a wall. It is not. With a clear scope and a realistic plan, an SME can build an information security management system (ISMS) that passes certification and actually improves security.
This guide walks you through ISO/IEC 27001:2022 as it stands in October 2026: what the clauses require, how Annex A is organised, what changed from the 2013 edition, and a phased roadmap from scoping to certificate.
What ISO 27001 actually is
ISO/IEC 27001 is an international standard for an information security management system. It does not tell you which firewall to buy. It requires you to understand your context, assess your information security risks, choose controls to treat them, run those controls, and check and improve the system over time.
Two parts matter most:
- Clauses 4–10: the mandatory management system requirements. Every one applies if you want certification.
- Annex A: a reference list of information security controls. You compare your chosen controls against it and justify what you include or exclude.
One point surprises many first-timers: ISO itself does not certify companies. Certificates are issued by independent certification bodies, ideally ones accredited by a national accreditation body (in Italy, Accredia) that is a signatory to the IAF Multilateral Recognition Arrangement, so the certificate is recognised internationally.
The 2022 edition and the end of the 2013 transition
ISO published ISO/IEC 27001:2022 on 25 October 2022, replacing the 2013 edition. Under the International Accreditation Forum’s transition rules (IAF MD 26), certification bodies had to stop issuing new certificates against the 2013 edition by 30 April 2024, and all certified organisations had to complete their transition by 31 October 2025. That deadline has passed: certificates against ISO/IEC 27001:2013 are no longer valid. If a supplier still shows you a 2013 certificate, treat it as expired.
What changed in 2022
- A new Annex A aligned with ISO/IEC 27002:2022. The control set dropped from 114 controls in 14 clauses to 93 controls in 4 themes. According to IAF MD 26, 11 controls are new, 24 were merged from existing controls and 58 were updated.
- New clause 6.3, planning of changes: changes to the ISMS must be carried out in a planned way.
- Clause 4.2 now asks you to determine which interested-party requirements the ISMS will address.
- Clause 8.1 refers to “externally provided” processes, products or services instead of “outsourced processes”, which puts a sharper focus on suppliers.
- Editorial alignment with ISO’s harmonised structure for management system standards, including restructured sub-clauses in 9.2 (internal audit) and 9.3 (management review).
In February 2024, ISO also published Amendment 1 (ISO/IEC 27001:2022/Amd 1:2024), the “climate action changes” applied across management system standards. It adds a requirement in clause 4.1 to determine whether climate change is a relevant issue, and a note in 4.2 that interested parties may have climate-related requirements. Certification bodies generally treat it as a clarification, but auditors will expect to see that you considered it.
Clauses 4–10 in plain English
| Clause | Topic | What you need to show |
|---|---|---|
| 4 | Context of the organisation | Internal and external issues, interested parties and their requirements, a documented ISMS scope. |
| 5 | Leadership | Top management commitment, an information security policy, assigned roles and responsibilities. |
| 6 | Planning | A repeatable risk assessment and risk treatment process, a Statement of Applicability, security objectives, planned changes. |
| 7 | Support | Resources, competence, awareness, communication and control of documented information. |
| 8 | Operation | Running the risk assessments and treatment plans, and controlling processes, including externally provided ones. |
| 9 | Performance evaluation | Monitoring and measurement, an internal audit programme, management review. |
| 10 | Improvement | Continual improvement, handling nonconformities and corrective action. |
Annex A: 93 controls in 4 themes
The 2022 Annex A groups its controls into four themes:
- Organisational controls (A.5): 37 controls, covering policies, roles, asset management, access control, supplier relationships, incident management, business continuity and compliance.
- People controls (A.6): 8 controls, including screening, terms of employment, awareness and training, disciplinary process and remote working.
- Physical controls (A.7): 14 controls, covering perimeters, entry, equipment, storage media and clear desk.
- Technological controls (A.8): 34 controls, including endpoint devices, privileged access, malware protection, vulnerability management, backup, logging, network security, cryptography and secure development.
The 11 new controls are threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. For many SMEs, the cloud services control is the one that deserves most attention: if your business runs on SaaS and public cloud, your ISMS has to cover how you select, configure and exit those services.
You do not have to implement all 93 controls. Your risk assessment decides which are necessary. Annex A is a cross-check so that you do not accidentally leave out something you need.
A phased roadmap for SMEs
Phase 1: Commitment and scoping
Get a named executive sponsor and a budget before you write a single policy. Then define the scope: which business units, locations, services and systems the ISMS covers. A tight, meaningful scope (“the SaaS platform and the teams that build and run it”) is far easier to certify than “everything”, but it must match what your customers think they are buying. Record the internal and external issues and interested parties that shaped the scope.
Phase 2: Gap analysis
Compare what you already do against clauses 4–10 and Annex A. Most SMEs find they have reasonable technical controls but little documentation, no formal risk process and no internal audit. The gap analysis becomes your project plan.
Phase 3: Risk assessment and treatment
Define a risk method you can repeat: how you identify risks, who owns them, how you score likelihood and impact, and what level of risk you accept. Keep it simple; a spreadsheet works. Then run it, decide how to treat each risk (modify, avoid, share or retain), and get risk owners to approve the treatment plan and the residual risk.
Phase 4: Statement of Applicability
The Statement of Applicability (SoA) lists the controls you need, why you included them, whether they are implemented, and why any Annex A controls are excluded. Auditors read it closely. Every inclusion should trace back to a risk, a legal or contractual requirement, or a business decision.
Phase 5: Implement controls and documentation
Write the policies and procedures the standard and your SoA require, and implement the controls you are missing. Typical SME priorities include multi-factor authentication, asset inventory, backup testing, supplier security, logging and an incident response process. Run awareness training and keep records; clause 7 requires evidence of competence and awareness, and a structured security awareness training programme gives you both.
Phase 6: Operate and measure
Let the ISMS run. Collect evidence: access reviews, backup restore tests, training completion, incident records, supplier reviews. Track the security objectives you set in clause 6.2. Certification bodies want to see a system that works, not one that was switched on the week before the audit.
Phase 7: Internal audit
Audit the whole ISMS against the standard and your own procedures. The auditor must be objective and impartial, which for small companies often means an external consultant or a trained colleague who does not audit their own work. Raise nonconformities and fix them through corrective action.
Phase 8: Management review
Top management reviews audit results, risk status, objectives, incidents, changes and improvement opportunities, and makes decisions. Minute it. A missing or superficial management review is one of the most common reasons for a nonconformity at certification.
Phase 9: Certification (Stage 1 and Stage 2)
- Stage 1 is largely a documentation and readiness review: scope, policies, risk assessment, SoA, and whether internal audit and management review have been done. The auditor tells you whether you are ready for Stage 2.
- Stage 2 assesses whether the ISMS is implemented and effective. Auditors interview staff, sample evidence and test controls. Major nonconformities must be resolved before a certificate is issued.
Once certified, the certificate normally runs on a three-year cycle, with surveillance audits in the intervening years and a recertification audit at the end.
Realistic timelines
There is no official duration, and anyone who quotes you a fixed number without seeing your organisation is guessing. As a planning guide from practice, a focused SME with management support and some existing controls often needs roughly six to twelve months from kick-off to Stage 2. The main drivers are:
- the size and complexity of the scope;
- how mature your current controls and documentation are;
- how much internal time you can dedicate (a part-time owner rarely moves fast);
- how long you let the ISMS operate before audit, so you have real evidence;
- certification body availability for Stage 1 and Stage 2 dates.
Common mistakes to avoid
- Buying a template pack and calling it an ISMS. Auditors quickly spot policies that do not match how you work.
- Scoping too broadly, or too cleverly. A scope that excludes the systems customers care about will not satisfy them.
- Starting from Annex A instead of risk. Controls should follow the risk assessment, not the other way round.
- Treating it as an IT project. HR, legal, procurement and management all own parts of the ISMS.
- No evidence of operation. A procedure without records is a nonconformity waiting to happen.
- Weak supplier management. The 2022 edition puts more weight on externally provided services and cloud.
- Forgetting the ISMS after certification. Surveillance audits check that it is still alive.
How ISO 27001 helps with NIS2
NIS2 (Directive (EU) 2022/2555) requires essential and important entities to take appropriate and proportionate technical, operational and organisational measures to manage cybersecurity risk (Article 21), and makes management bodies responsible for approving and overseeing those measures and for following training (Article 20). Article 21(2) lists minimum areas: risk analysis and policies, incident handling, business continuity, supply chain security, secure development and vulnerability handling, effectiveness assessment, cyber hygiene and training, cryptography, HR security and access control, and multi-factor authentication. Article 25 asks Member States to encourage the use of European and international standards. For background, read our NIS2 Directive explainer.
An ISO 27001 ISMS covers most of that ground: a risk-based approach, documented policies, supplier controls, incident management, continuity and management involvement. It gives you a ready-made governance structure for NIS2 evidence.
But certification is not automatic NIS2 compliance. Gaps usually appear in:
- the specific incident reporting timelines and channels to your national CSIRT or authority;
- registration duties with the national authority;
- national technical requirements. In Italy, ACN’s Determination 164179 of 14 April 2025 sets baseline security measures built on the national Framework Nazionale per la Cybersecurity e la Data Protection, and ACN has supported UNI/PdR 174:2025 as a bridge for ISO 27001-certified organisations;
- for digital infrastructure and digital service providers, the detailed requirements of Commission Implementing Regulation (EU) 2024/2690. ENISA’s technical implementation guidance (June 2025) offers practical advice and evidence examples for it.
The practical approach: scope your ISMS to include the services that fall under NIS2, add the NIS2 and national requirements to your list of interested-party requirements in clause 4.2, and map them in your SoA. Our NIS2 compliance checklist helps you spot what remains. This is general guidance, not legal advice.
AceFortis runs practical ISO 27001 and NIS2 training for implementation teams, internal auditors and management — get in touch to plan a session.
FAQ
Do we have to implement all 93 Annex A controls?
No. You must compare your controls against Annex A and justify every inclusion and exclusion in your Statement of Applicability. Controls are selected based on your risk assessment and requirements.
Is our ISO 27001:2013 certificate still valid?
No. The IAF transition period ended on 31 October 2025. Certificates against the 2013 edition are no longer valid, so you need certification against ISO/IEC 27001:2022.
Can a small company be certified without a full-time security manager?
Yes, provided roles are clearly assigned, management is involved and the ISMS genuinely operates. Many SMEs combine a part-time internal owner with external support for risk assessment and internal audit.
Does ISO 27001 certification make us NIS2 compliant?
Not by itself. It gives you a strong foundation, but you still need to cover NIS2 reporting, registration and any national technical measures.
