What is ISO 27001?
ISO/IEC 27001 is the international standard for information security management systems. The current version, ISO/IEC 27001:2022, was published in October 2022. It defines requirements in clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation and improvement) and lists 93 reference controls in Annex A.
The 93 Annex A controls are grouped into four themes: 37 organisational controls, 8 people controls, 14 physical controls and 34 technological controls. The 2022 revision introduced 11 new controls, including threat intelligence (5.7), information security for the use of cloud services (5.23), ICT readiness for business continuity (5.30), data masking (8.11), data leakage prevention (8.12), web filtering (8.23) and secure coding (8.28).
ISO 27001 is voluntary, but it is the most widely requested security certification in European B2B sales. Many enterprise customers, public buyers and investors ask for a certificate before signing a contract.
Who needs ISO 27001 certification?
Any organisation can certify, but in practice the standard is most often pursued by:
- Software and SaaS companies selling to larger enterprises that send security questionnaires.
- Fintech and payment companies that also need to meet DORA and must show structured ICT risk management.
- Managed service providers, hosting and cloud companies that fall under NIS2 and want a recognised framework for their Article 21 measures.
- Scale-ups preparing for due diligence, where a certified ISMS shortens investor and customer reviews.
How does ISO 27001 certification work?
Certification is performed by an accredited certification body. The audit has two stages. Stage 1 reviews your ISMS documentation: scope, risk assessment method, Statement of Applicability, policies and the results of internal audit and management review. Stage 2 tests whether the controls you selected actually operate, using interviews, samples and evidence.
A certificate is valid for three years. During that cycle the certification body performs surveillance audits, usually once a year, followed by a recertification audit in year three. Organisations certified against the 2013 version had to transition to ISO/IEC 27001:2022 by 31 October 2025.
How does ComplyPilot map ISO 27001 controls and evidence?
ComplyPilot (EU compliance platform) is organised around the objects an auditor asks about. Every Annex A control is available as a structured record with an owner, an implementation status and a justification for inclusion or exclusion. The Statement of Applicability is generated from those same records, so it never drifts from what you actually implemented.
Risks in the risk register are linked to the controls that treat them. Evidence — documents, screenshots, logs, tickets — is uploaded once and linked to one or more controls. When a control has no evidence, the readiness score for its theme drops, so gaps are visible before the auditor finds them.
- 93 Annex A controls, grouped by the four 2022 themes.
- Risk register with likelihood, impact, treatment and linked controls.
- Statement of Applicability built from control decisions.
- Policy management with Draft, Approved and Outdated states and version history.
- Evidence library with approval status and control links.
- Exports (PDF, DOCX, CSV) for the auditor.
Spreadsheets vs enterprise GRC vs ComplyPilot: which fits?
Most teams start ISO 27001 in spreadsheets. That works for a first gap analysis, but it becomes hard to keep evidence, risks and the Statement of Applicability consistent. Enterprise GRC suites solve consistency but are built for large compliance departments.
| Criterion | Spreadsheets | Enterprise GRC | ComplyPilot |
|---|---|---|---|
| Set-up time | Fast to start, slow to maintain | Long implementation project | Controls and templates ready from day one |
| Control ↔ evidence links | Manual cross-references | Yes | Yes, built in |
| Statement of Applicability | Separate document to keep in sync | Usually generated | Generated from control records |
| NIS2 and DORA mapping | Build yourself | Often an add-on | Included as framework overlays |
| Target user | Anyone | Dedicated compliance team | Founders, CTOs and small security teams |
How long does ISO 27001 take with ComplyPilot?
Timelines depend on scope and on how mature your security practices already are. A small software company with existing cloud security basics often needs several months to design the ISMS, run it long enough to produce records (risk treatment, internal audit, management review) and pass both audit stages. ComplyPilot shortens the documentation and evidence work; it does not replace the operating period an auditor expects to see.
Frequently asked questions
How many controls are in ISO 27001:2022 Annex A?
ISO/IEC 27001:2022 Annex A contains 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological.
Do I have to implement all 93 controls?
No. You decide which controls apply based on your risk assessment and record the decision and justification for each one in the Statement of Applicability.
Does ComplyPilot certify my company?
No. Only an accredited certification body can issue an ISO 27001 certificate. ComplyPilot helps you prepare the ISMS, evidence and documents that the auditor reviews.
Can ISO 27001 help with NIS2 and DORA?
Yes. Many ISO 27001 controls cover the same ground as NIS2 Article 21 measures and DORA ICT risk-management requirements. ComplyPilot shows that overlap so evidence can be reused.