Build an information security management system that holds up.
ISO/IEC 27001 is an international standard for information security management, not a regulation. Seraph helps organizations assess current state, close control gaps, and prepare the evidence an accredited certification body will look for.
Understanding ISO/IEC 27001.
What It Is
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It sets out a systematic, risk-based approach to protecting information — covering people, processes and technology — rather than prescribing a fixed checklist. Certification is issued by an accredited third-party body after an independent audit.
Why Organizations Pursue It
It's the security standard most commonly named in enterprise RFPs and vendor security reviews. Certification shortens sales cycles, can reduce cyber insurance premiums, and gives leadership a defensible, internationally recognized baseline to point to after an incident or audit.
- Published by
- ISO / IEC
- Current edition
- ISO/IEC 27001:2022
- Type
- Voluntary certification standard
- Renewal cycle
- 3 years, with annual surveillance audits
- Applies to
- Any organization, any size or sector
93 controls across 4 themes (Annex A, 2022 edition).
Organizational
37 controls — policies, roles, supplier relationships, incident management, business continuity.
People
8 controls — screening, security awareness training, disciplinary process, remote working.
Physical
14 controls — secure areas, equipment siting, media handling, clear desk/screen.
Technological
34 controls — access control, cryptography, logging, secure development, malware defense.
From current state to audit-ready.
A structured path from understanding the standard to maintaining certification over time.
Understand the Requirement
Clarify what ISO/IEC 27001 requires and how it applies to your organization's scope.
Assess Current State
Evaluate existing controls, policies and practices against the standard's requirements.
Identify Control Gaps
Document specific gaps between current practice and the standard, rated by risk.
Develop Policies & Controls
Build the information security management system, policies and controls the standard requires.
Implement & Organise Evidence
Roll out improvements and organize the evidence an auditor will expect to see.
Prepare & Maintain
Prepare for certification audit and maintain the management system on an ongoing basis.
Technology supporting this solution.
Frequently Asked Questions
Can't find what you need? Ask a security expert.
Ready to start your ISO/IEC 27001 journey?
Tell us your current state and target timeline. Our team will help scope a readiness engagement.