ISO 27001 is the internationally recognised standard for information security management, but if you’re trying to figure out what does ISO 27001 cover, the standard itself isn’t exactly light reading. Between the clauses, annexes, and control categories, it’s easy to get lost before you even understand what’s actually required of your organisation.
Here’s the short answer: ISO 27001 covers how you build, run, and improve an Information Security Management System (ISMS). It sets out mandatory requirements for managing risk to your information assets and includes a structured set of security controls spanning people, processes, and technology. The 2022 revision reorganised these controls significantly, so older guides may steer you wrong.
At TrustedIA, we’ve helped organisations across the UK implement and certify against ISO 27001 for over 30 years. This article breaks down the standard’s scope, its core ISMS requirements, and every control category, written by people who work with it daily, not just summarise it. Whether you’re exploring certification for the first time or reassessing your posture after the 2022 update, you’ll leave with a clear picture of what the standard demands and why each piece matters.
Why ISO 27001 matters for UK organisations
UK businesses face a higher volume of cyber attacks than most organisations acknowledge. According to the UK government’s Cyber Security Breaches Survey, over half of UK businesses reported a cyber breach or attack in the past year, with that figure climbing sharply for medium and large organisations. The problem isn’t limited to large enterprises with deep pockets. Attackers are targeting businesses of every size, across every sector, and the consequences of a serious incident, including downtime, regulatory scrutiny, and reputational damage, are significant regardless of how big your organisation is.
The UK cyber threat landscape
The National Cyber Security Centre (NCSC) handles hundreds of significant incidents every year, and the pattern is consistent: most successful attacks exploit weak access controls, unpatched systems, or untrained staff. These aren’t sophisticated intrusions. They’re preventable failures. ISO 27001 directly addresses all three by requiring you to document, test, and continuously improve your controls across people, processes, and technology.
Certification does not guarantee you’ll never face an attack. It does mean you have the policies, procedures, and controls in place to detect threats faster and limit their impact when one occurs.
Ransomware remains the most disruptive threat for UK businesses, with recovery costs that routinely exceed the ransom itself. Business email compromise, phishing, and supply chain attacks are also rising. Without a structured approach to information security, your organisation ends up reacting to incidents rather than anticipating them. ISO 27001 gives you the framework to move from reactive to proactive.
Regulatory and commercial pressure
UK GDPR and the Data Protection Act 2018 require organisations to implement appropriate technical and organisational measures to protect personal data. ISO 27001 does not automatically deliver GDPR compliance, but it provides a structured framework that demonstrates you’ve approached security with rigour. When the Information Commissioner’s Office assesses a breach, regulators look at whether you had documented controls and risk management processes in place, and ISO 27001 gives you exactly that evidence trail.
Beyond regulation, commercial pressure is accelerating adoption. Public sector contracts and large enterprise procurement processes routinely ask suppliers to demonstrate ISO 27001 certification or an equivalent. If you’re tendering for government work, sitting in a financial services supply chain, or working in healthcare technology, certification is quickly becoming a baseline expectation rather than a differentiator. Organisations that can’t demonstrate it are finding themselves excluded from tenders before the conversation even starts.
What certification signals to clients and partners
When you achieve ISO 27001 certification, you’re telling clients, partners, and prospects that an independent accredited body has verified your ISMS against a rigorous international standard. That signal carries weight because it isn’t self-reported. It requires a Stage 1 documentation review, a Stage 2 on-site audit, and regular surveillance audits to maintain, so the certificate represents ongoing commitment, not a one-time exercise.
Understanding what does ISO 27001 cover matters here because your certification scope defines exactly what that promise extends to. A certificate covering a single system or one office location is very different from one covering your entire organisation. Clients and procurement teams increasingly scrutinise scope documents, so defining it carefully from the outset protects the credibility of your certification. Across financial services, legal, healthcare, and technology sectors in the UK, organisations are recognising that getting the scope right from day one saves significant time and cost during the audit process.
What ISO 27001 covers at a glance
ISO 27001 divides into two distinct parts. The mandatory clauses (Clauses 4 through 10) set out the requirements for building and maintaining an ISMS, and every organisation pursuing certification must satisfy all of them without exception. The Annex A controls provide a reference set of 93 security controls across four categories, from which you select and implement what applies to your context. Together, these two parts answer the core question of what does ISO 27001 cover: systematic risk management backed by documented, auditable security controls.
The mandatory clauses (Clauses 4 to 10)
The clauses form the backbone of the standard. Clauses 4 to 6 deal with setting the context of your organisation, securing leadership commitment, and planning your ISMS around a structured risk assessment. Clauses 7 to 10 cover the operational requirements: the resources, competence, communication, and documentation you need, followed by performance evaluation and the continual improvement cycle. You cannot cherry-pick which clauses apply. Every single one is a certification requirement, and your auditor will assess all of them.
Treating the mandatory clauses as a checklist to tick rather than a management system to run is the most common reason organisations fail their Stage 2 audit.
The Annex A control categories
Unlike the mandatory clauses, the Annex A controls are risk-driven and context-dependent, meaning you apply the ones relevant to your organisation and justify any you exclude. The 2022 revision reorganised the previous 114 controls into 93 controls across four themes, which makes it considerably easier to see how individual controls relate to each other:
- Organisational controls (37 controls): Policies, roles, supplier relationships, incident management, and business continuity.
- People controls (8 controls): Screening, training, disciplinary processes, and responsibilities after employment ends.
- Physical controls (14 controls): Secure areas, equipment protection, and clear desk and screen policies.
- Technological controls (34 controls): Access control, cryptography, malware protection, logging, vulnerability management, and secure development.
You record which controls you’ve applied or excluded in a Statement of Applicability (SoA), which becomes one of the central documents your auditor scrutinises. Excluding a control requires a clear, documented justification, so the SoA carries real weight in the certification process. Understanding both parts of the standard before you begin implementation saves considerable time and avoids having to rework your approach mid-project.
How an ISMS works in ISO 27001
An ISMS is not a piece of software or a folder of policies. It is a management system, which means it is the combination of people, processes, and technology you use to manage information security risks in a structured, repeatable way. When you understand what does ISO 27001 cover, you realise it is primarily a framework for running this management system consistently, rather than a list of technical controls to bolt on.
The Plan-Do-Check-Act cycle
ISO 27001 builds its ISMS requirements around the Plan-Do-Check-Act (PDCA) model, a continuous improvement cycle that applies to the entire management system. At the Plan stage, you identify risks, define objectives, and select controls. At the Do stage, you implement those controls and run the processes you have documented. Check involves monitoring performance, conducting internal audits, and reviewing whether your controls are working as intended. Act closes the loop by correcting weaknesses and improving the system based on what the checks reveal.
The PDCA cycle is not a one-time project you complete and move on from. It is a permanent operational rhythm your organisation has to sustain to hold certification.
Your auditor will look for evidence of the cycle operating, not just evidence that you wrote a policy at some point. Meeting logs, audit records, risk treatment updates, and management review minutes all demonstrate that your ISMS is running rather than sitting on a shelf.
What your ISMS must document
Your ISMS needs documented information to function and to be auditable. The standard specifies certain documents you must maintain, including your information security policy, risk assessment methodology, risk treatment plan, Statement of Applicability, and records of monitoring and improvement activities.
Beyond the mandatory documents, you will almost certainly need supporting procedures covering areas such as access control, incident response, and supplier management. The level of documentation the standard requires is proportionate to the size and complexity of your organisation, so a ten-person business will produce far less than a multinational, but both need to demonstrate the same systematic approach. Getting your documentation structure right early avoids significant rework before your Stage 2 audit.
The ISO 27001 clauses 4 to 10 explained
When people ask what does ISO 27001 cover, the mandatory clauses give you the clearest answer. These seven clauses define every structural requirement your ISMS must satisfy, and your certification auditor will assess all of them without exception. There is no route to certification that skips even one.
Clauses 4 to 6: Context, leadership, and planning
Clause 4 requires you to understand your organisation and its context, including the internal and external factors that influence your information security risks, and to identify the interested parties whose requirements shape your ISMS, such as regulators, clients, and staff. Getting this right from the start matters because your scope and risk appetite both flow directly from it.
Senior management must demonstrate genuine commitment under Clause 5 by setting a documented information security policy, assigning clear roles and responsibilities, and actively supporting the management system. Approving a document and stepping back is not enough. Auditors look for evidence that leadership is engaged on an ongoing basis, not just at implementation.
If leadership treats ISO 27001 as an IT project rather than a business priority, your ISMS will struggle to function and your audit evidence will reflect that clearly.
Planning takes centre stage in Clause 6, where you conduct your risk assessment, define treatment objectives, and set measurable security goals. This is where the analytical work begins, and producing a thorough assessment at this stage prevents you from implementing controls that do not match your actual threat landscape.
Clauses 7 to 10: Operation, evaluation, and improvement
Clause 7 covers the resources and competence your ISMS needs to operate, including trained personnel, documented procedures, and defined communication processes. Clause 8 requires you to run the operational processes your planning defined, which includes executing your risk treatment plan and maintaining records that prove your controls are active rather than theoretical.
Performance evaluation becomes the focus in Clause 9. You must monitor and measure your controls, conduct internal audits against the standard, and hold formal management reviews to assess whether the ISMS is meeting its objectives. These activities generate the evidence your auditor needs to confirm the system is genuinely running.
Clause 10 closes the cycle by requiring you to address nonconformities when they arise and to continually improve the ISMS. Corrective actions must be documented, investigated for root cause, and tracked through to resolution.
Risk assessment, treatment, and the SoA
Risk assessment sits at the centre of ISO 27001, and understanding it is essential to understanding what does ISO 27001 cover at a practical level. The standard does not prescribe a specific assessment methodology, but it does require your approach to be documented, repeatable, and consistently applied across your defined scope. That flexibility is intentional, but it means you need to make deliberate choices before you begin rather than improvising as you go.
Conducting your risk assessment
Your risk assessment starts with identifying information assets and the threats and vulnerabilities that could affect them. You then assess each risk using a methodology you define, typically by evaluating likelihood and impact, and producing a risk score that allows you to prioritise treatment decisions objectively. Every step of this process needs documented evidence, because your auditor will trace your treatment decisions back to the risks that drove them.
Common assets organisations identify include customer data, employee records, financial systems, intellectual property, and third-party integrations. The scope of your ISMS determines which assets fall inside the assessment boundary, which is why defining your scope accurately in Clause 4 directly affects the quality of your risk assessment. A poorly defined scope produces gaps that surface during your Stage 2 audit at the worst possible moment.
Risk treatment and the Statement of Applicability
Once you have assessed your risks, you need to decide what to do with each one. ISO 27001 gives you four treatment options: mitigate, accept, avoid, or transfer. Most risks are mitigated by applying relevant Annex A controls, accepted where the residual risk falls below your defined threshold, avoided by removing the activity that creates the risk, or transferred through insurance or contractual arrangements.
Your risk treatment plan must document which option you have chosen for each risk and which controls you are applying, creating a clear, auditable link between your risk assessment results and your implemented controls.
The Statement of Applicability (SoA) formalises this link. It lists all 93 Annex A controls, states whether each is applicable to your organisation, and records your justification for any exclusions. Controls you include must reference the risks or requirements that make them necessary. Your SoA is one of the first documents an auditor requests, so treating it as a live document rather than a one-time output keeps your certification defensible throughout surveillance audits.
Annex A controls in ISO 27001:2022
The 2022 revision significantly restructured Annex A, and understanding what does ISO 27001 cover at this level is where implementation decisions become concrete. The previous 2013 version contained 114 controls spread across 14 domains. The 2022 update consolidated and reorganised these into 93 controls across four themes: organisational, people, physical, and technological. This change makes it easier to assign ownership and map controls to your risk treatment decisions without losing track of coverage gaps.
Organisational and people controls
Organisational controls form the largest single category with 37 controls, covering the policies, governance structures, and operational processes that underpin your entire ISMS. These include your information security policy, roles and responsibilities, supplier relationship management, and how your organisation handles incidents and business continuity. Getting these right matters because they set the conditions under which every other control operates. Weak organisational controls tend to undermine even strong technical ones, and auditors frequently identify gaps here during Stage 2 reviews.
People controls are fewer in number at 8 controls, but they are critical to managing the human risk in your organisation. They cover pre-employment screening, security awareness training, the disciplinary process for policy violations, and the controls that apply when someone leaves your organisation. Staff remain one of the most consistent sources of security incidents, whether through phishing susceptibility or accidental data exposure, so this category deserves genuine investment during implementation rather than minimal documentation.
Treating people controls as a box-ticking exercise rather than a genuine behaviour change programme is one of the most common gaps auditors identify during certification assessments.
Physical and technological controls
Physical controls address 14 requirements focused on protecting your premises and equipment. These range from securing physical perimeters and monitoring access to facilities through to equipment maintenance, secure disposal of media, and clear desk policies. For organisations with remote or hybrid workforces, physical controls now extend well beyond the office environment, and your risk assessment should reflect that reality accurately.
Technological controls are the largest technical category at 34 controls, addressing access management, cryptography, secure development practices, malware protection, network security, and vulnerability management. The 2022 update introduced several new controls here, including threat intelligence, data masking, and monitoring of physical security. Each control you select must link directly back to a risk or requirement recorded in your SoA, so your auditor can trace exactly why it is in scope and confirm your treatment decisions are consistent throughout.
How to scope, implement, and certify ISO 27001
Before you start writing policies or selecting controls, you need to define your scope clearly, because every subsequent decision in your implementation flows from it. Your scope sets the boundary of what your ISMS covers, including which locations, systems, processes, and business units fall inside the certification perimeter. Organisations that rush this step often find themselves either over-committing to an unmanageable scope or producing a certificate too narrow to satisfy client and procurement requirements.
Defining your scope and context
Your scope definition sits inside Clause 4, and it requires you to map your information assets, identify relevant interested parties, and articulate why the boundary sits where it does. A focused scope covering your core service delivery operation is often more achievable for a first certification than one that tries to capture every function across the organisation. Once you hold certification, you can expand the scope incrementally during surveillance cycles, which reduces the pressure on your first audit without limiting your long-term ambition.
Starting with a tightly defined, well-evidenced scope consistently produces better first-audit outcomes than attempting to certify everything at once.
Building and running your ISMS
Once your scope is set, your implementation work follows the structure of Clauses 4 through 10 and your selected Annex A controls. You need to complete your risk assessment, produce your Statement of Applicability, and build out the policies and procedures that support your risk treatment decisions. At this stage, understanding what does ISO 27001 cover at the control level becomes directly operational, because each gap in your treatment plan will surface as a nonconformity during your audit if you leave it unaddressed.
Running the ISMS means maintaining the PDCA cycle actively rather than treating it as a project you finish. You need to conduct internal audits, hold management reviews, and track corrective actions on a regular basis so that your evidence file reflects a live management system, not a static documentation exercise.
The certification audit process
Certification involves two stages with an accredited certification body. The Stage 1 audit reviews your documentation and confirms your ISMS is sufficiently developed to proceed. The Stage 2 audit assesses whether your controls are implemented and operating effectively in practice. After certification, you maintain it through annual surveillance audits and a full recertification audit every three years. Choosing an experienced implementation partner significantly reduces the time between starting your project and achieving that first certificate.
Key takeaways
Understanding what does ISO 27001 cover comes down to two interconnected parts: the mandatory clauses that define how you build and run your ISMS, and the Annex A controls that give you a structured set of security measures to apply against your identified risks. Neither part works in isolation. The clauses give your management system its structure, and the controls give it practical teeth.
Your risk assessment drives every implementation decision, from which Annex A controls you select to how you define your Statement of Applicability. Getting that foundation right before you build your policies and procedures saves significant time and avoids costly rework ahead of your audit.
Certification is achievable for organisations of every size, but it requires genuine commitment from leadership and a management system that operates continuously rather than sitting dormant between audits. If you want expert guidance on implementing ISO 27001, speak to the TrustedIA team and we will help you build it properly from day one.
