ISO/IEC 27001 is the most widely adopted information security standard in the world and the de facto baseline for B2B security assurance outside the US. Where a customer wants confidence that a supplier manages security properly, ISO 27001 certification is almost always the first thing they ask for — and increasingly the thing they require. The certification is recognised across geographies and sectors, which is why it is often the foundation on which other frameworks (SOC 2, NIS2, DORA, BSI C5) are built.
The 2022 revision is the current version. It restructured the control catalogue into four themes — organisational, people, physical, and technological — and reduced the number of controls from 114 to 93 by consolidating related ones. The standard requires the organisation to define the scope of the ISMS, identify risks to that scope, select controls from the catalogue to treat those risks, document the selection in a Statement of Applicability, implement and operate the controls, and run an internal audit and management review to verify and improve them.
Certification is a two-stage audit by an accredited certification body. Stage 1 reviews the documentation and confirms the ISMS is ready for audit; stage 2 tests that it actually operates as described. Successful certification lasts three years, with annual surveillance audits in between and a recertification audit at the end. The audits are of the management system, not just the controls — the auditor is checking that the organisation identifies risk, selects and operates controls deliberately, and improves continuously, not that every possible control is in place.
The practical work to achieve certification is substantial but well-defined. It starts with scoping — deciding what parts of the business the ISMS covers — and a gap analysis against the standard. From there the work is risk assessment, control design and implementation, policy and documentation development, internal audit, and remediation before the certification audit. Organisations typically take six to twelve months from start to certification depending on maturity, and the effort is front-loaded: maintaining certification is less work than achieving it the first time.
Passeca delivers ISO/IEC 27001 certification support end to end: scoping, gap analysis, ISMS development, risk assessment, control design and implementation, internal audit, and certification-body liaison. Passeca is itself ISO/IEC 27001:2022 certified across its Germany, Switzerland, and UK operations, which is a credibility prerequisite for a security services firm. The same programme of work also produces the evidence base for SOC 2, NIS2, and DORA, so organisations pursuing more than one framework get substantial reuse.