ISO 27001 in Plain Language

ISO 27001 is the international standard for information security management. Here is what it requires, who needs it, and how long it takes.

Published April 10, 2025 by Megan Fulton.

Category: Compliance

ISO 27001 is the international standard for information security management systems. It is the most widely recognized security certification in markets outside the United States and increasingly required by enterprise customers globally. Despite its prominence, ISO 27001 is frequently misunderstood — treated as either a simpler alternative to SOC 2 or as an incomprehensible international standard that only multinational enterprises need to worry about.

Neither characterization is accurate. ISO 27001 is a rigorous, internationally recognized framework that requires organizations to build and maintain a genuine information security management system — not just implement a list of controls.

What ISO 27001 Actually Requires

ISO 27001 requires organizations to establish, implement, maintain, and continually improve an Information Security Management System. The ISMS is not a set of technical controls — it is a management system that governs how security decisions are made, how risks are assessed and treated, and how the organization ensures its security program remains effective over time.

• Risk assessment and treatment: organizations must identify information security risks, assess their likelihood and impact, and make documented decisions about how to treat each risk
• Statement of applicability: a formal document that maps each control from Annex A of the standard to the organization, indicating whether it applies and, if so, how it is implemented
• Internal audit: annual internal audits of the ISMS, conducted by qualified auditors
• Management review: periodic review by organizational leadership of the ISMS performance
• Continual improvement: documented processes for identifying and implementing improvements to the ISMS

ISO 27001 vs. SOC 2: The Key Differences

ISO 27001 and SOC 2 are both security certifications, but they are built on fundamentally different models. SOC 2 is an attestation — an auditor's opinion on whether specific controls were suitably designed and operating effectively. ISO 27001 is a certification to a management system standard — a formal assessment of whether the organization has built and is maintaining an ISMS that meets the standard's requirements.

Practically, this means that ISO 27001 places greater emphasis on the governance processes — risk management, management review, internal audit, continual improvement — that surround the technical controls. An organization can have excellent technical controls and fail an ISO 27001 audit because its management processes are insufficient.

The Annex A Controls

ISO 27001's Annex A contains 93 controls organized into four categories: Organizational controls, People controls, Physical controls, and Technological controls. Organizations must assess each control for applicability and document their treatment in the Statement of Applicability.

ISO 27001:2022, the current version of the standard, reorganized and updated the controls from the 2013 version, adding 11 new controls that address areas including threat intelligence, information security in cloud services, physical security monitoring, and data masking. Organizations certified under the 2013 standard have a transition deadline to move to the 2022 version.

Certification and Surveillance

ISO 27001 certification requires an initial audit — a two-stage process involving document review and on-site assessment — conducted by an accredited certification body. Certification is valid for three years, with annual surveillance audits in years two and three, followed by a recertification audit in year four.

VioletX works with organizations pursuing ISO 27001 certification for the first time and with certified organizations preparing for surveillance audits and recertification. The continuous assurance model VioletX operates is particularly well-suited to ISO 27001's requirement for continual improvement — a management system that is genuinely evolving, not static.

Read the full article on VioletX