What is an ISO/IEC 27001?

Unlike SOC 2, which is an American attestation report, ISO 27001 is a certifiable standard: an accredited external registrar audits an organization against it in two stages — a documentation review (Stage 1) and an implementation audit (Stage 2) — and issues a certificate valid for three years with annual surveillance audits in between. The 2022 revision of the standard organizes its requirements into Clauses 4–10 (the management-system obligations: context, leadership, planning, support, operation, evaluation, improvement) plus Annex A, a reference set of 93 security controls spanning organizational, people, physical, and technological categories. A central artifact of any ISO 27001 program is the Statement of Applicability — a document justifying, for every one of the 93 Annex A controls, whether it applies to the organization and how it's implemented (or why it's excluded). The standard also requires a living risk register, periodic internal audits, and management review, meaning certification isn't a one-time checkbox — the ISMS has to keep operating and producing evidence between audits, not just at audit time.