What are the ISO 27001 Requirements?
Understanding ISO 27001 requirements is essential for organisations seeking to protect their information assets and achieve certification. This guide provides a comprehensive checklist, explains the clause structure, and outlines what you need for compliance. Whether you’re exploring ISO 27001 training courses or preparing for certification, this article covers everything you need to know about ISO 27001 and its certification requirements.
In this article:
ISO 27001 Requirements Checklist
The ISO 27001 requirements are structured across ten clauses, with clauses 4-10 containing the auditable requirements for an Information Security Management System (ISMS). Additionally, Annex A provides 93 security controls organised into four themes: organisational, people, physical, and technological. Meeting these requirements demonstrates your organisation’s commitment to protecting information confidentiality, integrity, and availability.
The standard follows the Plan-Do-Check-Act (PDCA) cycle, ensuring systematic implementation and continual improvement. Below is a complete checklist covering all ten clauses:
1. Scope – Defines the boundaries and applicability of the standard to information security management.
2. Normative References – References ISO/IEC 27000 for terms and definitions.
3. Terms and Definitions – Refers to the vocabulary in ISO/IEC 27000.
4. Context of the Organization
This clause requires organisations to understand internal and external factors affecting their ISMS, identify interested parties and their requirements, and define the scope of the management system.
- 4.1 Understanding the organization and its context
- 4.2 Understanding the needs and expectations of interested parties
- 4.3 Determining the scope of the information security management system
- 4.4 Information security management system
5. Leadership
Top management must demonstrate commitment to the ISMS by establishing policy, assigning roles, and ensuring adequate resources.
- 5.1 Leadership and commitment
- 5.2 Policy
- 5.3 Organizational roles, responsibilities and authorities
6. Planning
Organisations must identify risks and opportunities, then establish information security objectives and plans to achieve them.
- 6.1 Actions to address risks and opportunities
- 6.2 Information security objectives and planning to achieve them
- 6.3 Planning of changes
7. Support
This clause addresses resources, competence, awareness, communication, and documented information needed to support the ISMS.
- 7.1 Resources
- 7.2 Competence
- 7.3 Awareness
- 7.4 Communication
- 7.5 Documented information
8. Operation
Operational requirements focus on risk assessment, risk treatment, and implementing the actions planned under clause 6.
Non-Applicable: Any exclusions must be justified and documented, demonstrating that excluding a control does not compromise information security.
- 8.1 Operational planning and control
- 8.2 Information security risk assessment
- 8.3 Information security risk treatment
9. Performance Evaluation
Organisations must monitor and measure ISMS performance, conduct internal audits, and hold management reviews.
- 9.1 Monitoring, measurement, analysis and evaluation
- 9.2 Internal audit
- 9.3 Management review
10. Improvement
The final clause addresses nonconformities, corrective actions, and the requirement for continual improvement of the ISMS.
- 10.1 Continual improvement
- 10.2 Nonconformity and corrective action
Annex A (normative) – Information security controls reference.
Annex A lists 93 controls across four themes. Unlike guidance annexes in other standards, it is normative, and applicable controls must be justified in the Statement of Applicability.
Non-Applicable Requirements
ISO 27001 does not permit exclusions from its clause requirements. The standard states in its scope that excluding any of the requirements specified in clauses 4 to 10 is not acceptable when an organisation claims conformity. All clauses must therefore be addressed for certification.
Annex A controls are different. When completing the Statement of Applicability (SoA), organisations assess each of the 93 Annex A controls against their risk assessment. Controls may be determined not applicable where the associated risks do not exist within the ISMS scope. Any exclusions must be justified and documented, demonstrating that excluding a control does not compromise information security.
Enrol in an ISO 27001 Training Course
Understanding the full scope of these requirements demands professional training. Our CQI and IRCA certified courses provide the knowledge needed to interpret clauses, conduct audits, and maintain effective information security management systems.
Choose from our range of programmes:
- ISO 27001 Lead Auditor Course – Lead third-party certification audits
- ISO 27001 Internal Auditor Course – Conduct effective internal ISMS audits
- ISO 27001 Foundation Course – Build foundational ISMS knowledge
Ready to advance your information security expertise? Explore our ISO 27001 training courses today.
Frequently Asked Questions
Key requirements include defining the ISMS scope, conducting risk assessments, implementing security controls, establishing an information security policy, ensuring competence and awareness, and performing internal audits and management reviews. Organisations must also maintain documented information and pursue continual improvement.
All requirements in clauses 4-10 are mandatory for certification. Mandatory elements include risk assessment and treatment processes, a Statement of Applicability, information security policy, defined objectives, internal audits, management reviews, and documented information demonstrating conformity.
ISO 27001 is not legally mandatory in the UK. However, it is increasingly required by customers, supply chains, and regulatory frameworks. In the UK, the standard is published as BS EN ISO/IEC 27001:2023+A1:2024. A tracked changes version is also available.
The ISO 27001 checklist covers ten clauses addressing context, leadership, planning, support, operation, performance evaluation, and improvement. It also includes assessment of 93 Annex A controls across organisational, people, physical, and technological themes to ensure comprehensive information security coverage.