That distinction trips up a lot of organizations. Teams document policies, buy software, and still fail their audit because they can't show the system operating day to day. The real challenge isn't picking controls. It's producing evidence that your risk-based decisions are real, current, and followed.
This article walks through what Clauses 4–10 actually require, how Annex A fits into risk treatment, what documentation auditors expect to see, and how to prepare for certification without turning the whole project into a paperwork exercise.
Key Takeaways
- Clauses 4–10 are mandatory; Annex A controls are selected based on your organization's actual risks
- Auditors want objective evidence that processes are defined, running, monitored, and improved — not just written down
- Certification comes from an independent certification body, not from internal self-assessment
- Start with a clear scope, named leadership ownership, a documented risk method, and an evidence plan
What ISO 27001:2022 Covers—and What Certification Means
What ISO 27001:2022 Covers and What Certification Means
An ISMS ties together people, processes, technology, and governance to protect confidentiality, integrity, and availability of information. It's a risk-management framework, not a product checklist: the standard assumes different organizations will land on different controls based on their own exposure.
The standard's structure breaks into three parts:
- Clauses 0–3: Introduction, scope, normative references, and terms (background material, not requirements)
- Clauses 4–10: The mandatory ISMS requirements every certified organization must satisfy
- Annex A: A reference list of controls to evaluate against your risk assessment, not a mandatory checklist
Certification itself happens in stages. Most certification bodies run a Stage 1 audit to check documentation and readiness, then a Stage 2 audit to assess whether the ISMS actually operates and is effective.
Exact terminology and process details vary slightly by registrar, so confirm specifics with whoever you select. NQA's certification guide uses this two-stage structure.
ISO 27001 itself is voluntary. Nobody's required to get certified by law in most sectors. But that voluntary status often becomes practically mandatory: procurement teams, enterprise customers, and security questionnaires increasingly list certification as a condition of doing business, especially in defense supply chains and regulated industries.
The Core ISO 27001 Requirements: Clauses 4–10
Clauses 4 through 10 form the management-system backbone. Auditors use these clauses to assess whether you've built a coherent, risk-based system, not just a binder of policies. Here's what each one demands.
Define the Organization's Context and ISMS Scope (Clause 4)
Start by identifying internal and external issues, interested parties, information assets, locations, systems, and supplier dependencies relevant to security. From there, write a formal scope statement defining what's in, what's out, and why.
Scope mistakes go both directions. An overly broad scope (claiming the whole enterprise) creates audit headaches when auditors sample areas you never actually prepared. An artificially narrow scope (excluding a data center or a subsidiary that actually touches customer information) fails to reflect reality and gets flagged immediately.
Establish Leadership, Policy, and Accountability (Clause 5)
Top management has to visibly own this, not just sign off once. That means approving and communicating the information security policy, assigning clear roles and responsibilities, and funding the program adequately.
Evidence to collect here includes:
- Approved and dated information security policy
- Documented role descriptions tied to ISMS responsibilities
- Leadership communications referencing security objectives
- Management review minutes showing resource decisions
Plan Objectives, Risks, Opportunities, and ISMS Changes (Clause 6)
This clause requires a repeatable risk assessment and treatment methodology, not a one-off spreadsheet from kickoff week. You also need measurable security objectives tied to business priorities, plus a documented process for assessing and authorizing any planned changes to the ISMS before they happen.
Provide Resources, Competence, Awareness, and Documentation (Clause 7)
Staffing, budget, training, and document control all live here. Competence evidence matters more than attendance sheets. Auditors want to see that people can actually do their assigned security tasks, through assessments, exercises, or demonstrated work output, not just a certificate of completion.
Operate and Control the ISMS (Clause 8)
This is where you execute the risk assessment and treatment plan, implement selected controls, and manage changes. The critical distinction: documenting a procedure isn't the same as proving it's followed. Auditors sample actual records (access reviews, change tickets, vendor assessments) to confirm the procedure runs as written.
Evaluate Performance (Clause 9)
Monitoring, internal audits, and management reviews all fall under this clause. Define what's measured, how often, by whom, and what happens with the results. Audit findings, control testing, incidents, and objective results all become the evidence an auditor will pull.
Improve the ISMS (Clause 10)
When something goes wrong, you need a documented process for recording nonconformities, determining root cause, implementing corrective action, and checking that the fix actually worked. Continual improvement shows up as a closed feedback loop running year over year, not a one-time certification sprint.
Annex A, Risk Treatment, and the Documentation Auditors Expect
Annex A and your risk assessment work together. Controls get selected and justified based on identified risks, contractual obligations, and your operating context, not copied wholesale from a template.
Annex A Control Themes to Evaluate
The 2022 revision organizes controls into four themes:
- Organizational: supplier security, information handling, role separation
- People: hiring-process risks, security responsibilities for staff and contractors
- Physical: secure areas, equipment protection, off-site asset handling
- Technological: access management, cryptography, logging, secure development
Annex A contains 93 controls total, according to BSI's implementation guide. That's a reference set to compare against your risk treatment decisions, not a mandatory implementation list. Confirm the exact count and theme names against the current official text before you publish anything externally, since standards get amended.
Build the Risk Assessment and Treatment Record
Your risk record needs to cover:
- Asset identification and risk criteria
- Threat and vulnerability analysis
- Likelihood and impact scoring
- Treatment decisions, named owners, and target dates
- Residual-risk acceptance
The risk treatment plan then links each identified risk to a control, an accountable owner, implementation status, and supporting evidence.
Complete and Maintain the Statement of Applicability
The SoA lists applicable and excluded controls, with reasons for each exclusion and current implementation status. It should trace directly back to your risk treatment decisions.
Don't copy a generic SoA from a template site. Auditors spot these immediately. A tailored SoA references your actual scope, your actual systems, and your actual risk findings.
Assemble Core Documented Information
At minimum, keep these current and accessible:
- Scope statement and information security policy
- Risk assessment methodology and results
- Risk treatment plan and SoA
- Competence and awareness records
- Internal audit program and results
- Management review outputs and corrective-action logs
Auditors need proof these documents are approved, current, controlled, and connected to real activity, not just that templates exist in a folder somewhere.
How to Meet the Requirements and Prepare for an ISO 27001 Audit
A practical implementation sequence looks like this:
- Secure leadership sponsorship and define the ISMS scope
- Establish governance: roles, responsibilities, and a risk methodology
- Run the initial risk assessment and set measurable objectives
- Select and implement controls, then train affected staff
- Collect evidence as work happens, not retroactively
- Conduct an internal audit and complete management review
- Remediate findings before scheduling the certification audit
Assign a named owner for every requirement, control, document, and metric. When responsibility sits with one compliance employee, the whole program stalls the moment that person is out sick or leaves.
Build an evidence register mapping each requirement to its owner, the required record type, collection frequency, storage location, and any identified gaps. This single artifact becomes your pre-audit sanity check.
Certification audits generally follow a documentation-readiness review, then an assessment of actual implementation and effectiveness. Exact steps vary by registrar, per DNV's certification process, so confirm specifics with your chosen body.
Before scheduling Stage 1, check:
- Scope statement matches actual operations
- Policy is approved and current
- Risk treatment decisions trace to the SoA
- Training and competence records exist for affected roles
- Internal audits were performed independently
- Open corrective actions have documented effectiveness checks
QMS Learning's ISO 27001 Information Security course walks ISMS owners and security leads through drafting scope, risk methodology, and a Statement of Applicability inside each lesson, with working drafts reviewed by a course coach rather than left as homework.
For teams aligning ISO 27001 with CMMC or NIST 800-171 obligations, the Defense Cybersecurity Readiness pathway (a Q3 2026 pilot) extends that same practitioner-built, evidence-first model across overlapping frameworks.
Maintaining the ISMS and Avoiding Common Implementation Gaps
Certification isn't the finish line. You need ongoing risk reviews, internal audits, management reviews, control updates, training refreshes, and corrective-action follow-through to stay certified through surveillance audits.
Watch for these recurring gaps:
- Unclear scope that drifts from what the business actually does
- Leadership sign-off without ongoing involvement after the initial push
- Generic risk assessments copied from templates instead of reflecting real exposure
- Controls implemented without evidence that they're actually running
- Outdated documents nobody updated after a system or vendor change
- Corrective actions closed without checking whether the fix actually worked
Treat changes in systems, suppliers, personnel, regulations, or customer requirements as triggers to reassess risk and update the ISMS. Don't wait for the next scheduled review cycle.
The strongest ISO 27001 programs fold security into everyday business decisions and build evidence as work happens, instead of scrambling to produce documentation the week before an audit.
Frequently Asked Questions
What are the main requirements of ISO 27001?
Clauses 4–10 require a defined ISMS scope, leadership commitment, risk-based planning, adequate resources and competence, operational control, performance evaluation, and continual improvement. Controls from Annex A get selected based on your specific risk assessment.
Is ISO 27001 certification mandatory?
No, certification is generally voluntary. That said, customer contracts, procurement processes, or sector expectations frequently make it a practical requirement for winning new business.
What documents are required for ISO 27001?
Core documentation includes the scope statement, security policy, objectives, risk assessment and treatment records, the Statement of Applicability, competence evidence, audit records, management reviews, and corrective-action logs.
Are all Annex A controls mandatory?
No. Every control must be evaluated through your risk-based process, but you only implement the ones your risk assessment justifies. Exclusions need documented reasoning in the SoA.
How do you meet ISO 27001 requirements?
Start with scope and leadership commitment, then move through risk assessment, control selection, implementation, evidence collection, internal audit, and management review — closing gaps before the certification audit.
What is the difference between ISO 27001 requirements and Annex A controls?
Clauses 4–10 are mandatory management-system requirements that apply to every certified organization. Annex A is a reference catalogue of security controls you evaluate and apply selectively based on your actual risk and context.