ISO/IEC 27001:2022 information security management

Information is a valuable asset that can make or break your business. Managed properly, it lets you operate with confidence. Information security management gives you the freedom to grow, innovate and broaden your customer base, knowing that your confidential information will stay confidential. The current edition, ISO/IEC 27001:2022, replaced the 2013 edition and was amended in 2024 to address climate change.

• Identify risks and put controls in place to manage or reduce them
• Flexibility to apply controls to all or selected areas of your business
• Stakeholder and customer trust that their data is protected
• Demonstrate compliance and gain preferred-supplier status
• Meet more tender requirements by demonstrating compliance

Information security is the preservation of:

• Confidentiality: access to information is appropriately authorised
• Integrity: the accuracy and completeness of information and processing methods are safeguarded
• Availability: authorised users have access to information when they need it

Annex A of the 2022 edition lists 93 controls, grouped in four themes:

• Organisational controls (37): policies, roles, asset management, access control, supplier relationships, incident management, business continuity and compliance
• People controls (8): screening, terms of employment, awareness and training, remote working
• Physical controls (14): secure areas, equipment protection, clear desk and screen
• Technological controls (34): secure authentication, malware protection, backup, logging and monitoring, secure development