Back to ISO
Standard · 2022 + Amd 1:2024
ISO/IEC 27001
Information security. 93 Annex A controls in four themes. A Statement of Applicability is required.
Record
The SoA and the controls
The standard
ISO/IEC 27001:2022 + Amd 1:2024
Where it is used
On the clause register
What it does
- Annex A is the control register: included or excluded, with a justification.
- The Statement of Applicability is built from that register. It is not free-written.
- A control without an owner stays visible as a gap.
On the record
- Turn the standard on only if you hold it, or you are working towards it.
- A clause is compliant, partial, a gap, or not applicable. Evidence is linked.
- An AI draft does not count toward readiness until a named person signs it.
The standard
ISO/IEC 27001:2022 + Amd 1:2024
Information security. The Statement of Applicability is part of the system.
Also in Standard
All- ISO 45001Occupational health and safety. Worker consultation, the hierarchy of controls, and incidents as nonconformities.
- ISO 9001Quality. The operational records sit with the process. A later edition can be added as an update.
- ISO 14001Environment. Published April 2026. New planning clauses, and the management review split. Transition runs to May 2029.
- ISO 50001Energy. The energy review, significant energy uses, the energy performance indicators, the baseline, and the data collection plan.
- ISO 39001Road traffic safety. The numbering does not follow the usual Annex SL pattern. Crash investigation, internal audit, and management review are included.
- ISO 22301Business continuity. The business impact analysis and the risk assessment, the strategies, the plans, and the exercise programme.
- ISO 31000Risk management. It is not a certifiable standard. The record is a maturity self-assessment, not an audit.
- ISO/IEC 42001AI management. 38 controls in nine groups. A Statement of Applicability, and an AI system impact assessment.