What the standard actually requires, how the controls in Annex A fit in, what the certification audits look like and how to prepare without building a paper exercise.
In short
ISO 27001 is the international standard for an information security management system: a managed way to find, treat and review information security risks. It has mandatory clauses plus 93 reference controls in Annex A. Certification is done by an accredited certification body through a two-stage audit, then annual surveillance over a three-year cycle.
ISO/IEC 27001 is the most widely used standard for showing customers, partners and boards that an organisation handles information security in a systematic way. This explainer is written by Devies, a Gothenburg-based product and engineering consultancy, for CTOs, IT managers and compliance leads who are weighing certification, often because a customer or a tender has started asking for it.
What is ISO 27001?
ISO 27001 is a requirements standard for an information security management system (ISMS), published by ISO and IEC, against which an organisation can be independently certified.
An information security management system (in Swedish, ledningssystem för informationssäkerhet) is the set of policies, roles, processes and controls an organisation uses to protect the confidentiality, integrity and availability of its information, and to improve that protection over time. It is a management system, not a product or a firewall configuration.
The current edition is ISO/IEC 27001:2022, with a one-page amendment from 2024 that asks organisations to consider climate change as part of their context. The transition from the 2013 edition has ended: certification bodies set 31 October 2025 as the date when 2013 certificates expired.
The standard is often confused with related frameworks. The table separates them.
Term
What it is
Can you be certified?
ISO/IEC 27001
What it is
Requirements for an ISMS, with Annex A controls
Can you be certified?
Yes, by an accredited certification body
ISO/IEC 27002
What it is
Guidance on how to implement each Annex A control
Can you be certified?
No, it is guidance
SOC 2
What it is
An American attestation report by an independent CPA firm on controls at a service organisation
Can you be certified?
No certificate; you receive an auditor's report
NIS2 and the Swedish Cybersecurity Act
What it is
Legal duties for covered entities, including risk management and incident reporting
Can you be certified?
No, it is law; compliance is supervised
Penetration test
What it is
A technical test of specific systems at one point in time
Can you be certified?
No, but it can be evidence inside an ISMS
What does the standard require?
The standard requires a working management cycle: understand your context, assess risks, choose and run controls, measure them and improve.
The mandatory part is clauses 4 to 10:
- Context (4): the scope of the ISMS, interested parties and their requirements.
- Leadership (5): management commitment, an information security policy and assigned roles.
- Planning (6): a documented risk assessment and risk treatment method, security objectives, and a Statement of Applicability.
- Support (7): resources, competence, awareness, communication and documented information.
- Operation (8): running the risk assessments and treatment plans.
- Performance evaluation (9): monitoring, internal audit and management review.
- Improvement (10): handling nonconformities and continual improvement.
The Statement of Applicability is the document that lists each Annex A control, whether it applies, why, and whether it is implemented. Auditors read it closely, because it links your risks to your controls.
How do the Annex A controls work?
Annex A is a reference list of 93 controls that you compare your risk treatment against, not a checklist you must implement in full.
In the 2022 edition the controls are grouped into four themes: 37 organisational, 8 people, 14 physical and 34 technological. They range from supplier relationships and incident management to access control, logging, secure development and cloud services. ISO/IEC 27002 gives guidance for each.
You may exclude a control if your risk assessment shows it is not needed, as long as you justify the exclusion in the Statement of Applicability. A software company without its own server room will treat several physical controls very differently from a data centre operator. This is what makes the standard scalable, and also where weak implementations go wrong: controls chosen to look complete rather than to treat real risks.
How does ISO 27001 certification work?
Certification (in Swedish, ISO 27001 certifiering) is an independent audit by a certification body, and in Sweden the bodies that issue accredited certificates are accredited by Swedac.
ISO itself does not certify anyone. Accredited certification bodies follow ISO/IEC 17021-1 and ISO/IEC 27006-1, as described in Swedac's requirements for information security certification. The process looks like this:
- Stage 1 audit. The auditor reviews your documentation, scope, risk assessment and Statement of Applicability, and checks whether you are ready for stage 2.
- Stage 2 audit. The auditor tests whether the ISMS actually works: interviews, records, samples of controls in operation.
- Certification decision. Major nonconformities must be corrected before a certificate is issued.
- Surveillance audits. Shorter audits in years one and two check that the system is maintained.
- Recertification. A full audit in year three renews the three-year certificate.
How do you prepare for certification?
Preparation is mostly about running the management system for long enough to produce evidence, not about writing policies.
- Set the scope. Decide which organisation, locations, products and systems the ISMS covers. A narrow, honest scope is better than a broad one you cannot run.
- Secure management commitment. Name an owner, set objectives and agree a budget.
- Inventory assets and assess risks. Use a simple, repeatable method that the team understands.
- Treat risks and write the Statement of Applicability. Map each treatment to Annex A and justify exclusions.
- Implement and operate controls. Access reviews, logging, supplier assessments, incident handling, secure development and awareness training should produce records.
- Run an internal audit and a management review. Both are mandatory before stage 2.
- Choose an accredited certification body and book stage 1 when the system has been running and has produced records.
Organisations that already work with IT security (IT-säkerhet) in a structured way often have many controls in place but lack the records and the management cycle. That gap, not the technology, is usually what takes time.
As of October 2026, the Swedish Cybersecurity Act (cybersäkerhetslagen, SFS 2025:1506) requires covered entities to manage cyber risks but does not require ISO 27001 certification. The NIS2 Directive asks Member States to encourage European and international standards, so an ISMS is a practical way to organise compliance.
Keep reading
From our work
Client Case: ZenseactHow Devies helped Zenseact make cybersecurity a natural part of developing safety-critical software for driver assistance and autonomous driving.Read the caseDevies
Want a second opinion?
Devies, a Gothenburg-based product and engineering consultancy, works on questions like this with Nordic product and IT teams. Tell us where you are and we will suggest a sensible first step.
Frequently asked questions
How long does it take to get ISO 27001 certified?
It depends on scope, maturity and resources rather than on the standard itself. The certification audits take days, but before stage 2 the management system must have run long enough to produce evidence, including at least one internal audit and one management review. A small organisation with existing security routines usually moves faster than one starting from scratch.
Is ISO 27001 certification mandatory in Sweden?
No. As of October 2026, no Swedish law requires ISO 27001 certification in general. The Cybersecurity Act requires covered entities to manage cyber risks and report significant incidents, but it does not prescribe a specific certification. Certification is often required commercially instead, by customers, procurement processes and partners who want independent evidence of information security.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the requirements for an information security management system and is the standard you are certified against. ISO 27002 is a guidance document that explains how to implement each of the 93 controls listed in Annex A of ISO 27001. You use 27002 to design controls, but auditors assess you against 27001.
Do we have to implement all 93 Annex A controls?
No. You must compare your risk treatment with all 93 controls and record the result in a Statement of Applicability, but you can exclude controls that your risk assessment shows are not needed. Every exclusion needs a justification. Auditors check that the selected controls match your actual risks and that the ones you claim are in place actually operate.
Sources
- ISO: ISO/IEC 27001:2022 Information security management systems
- ISO: ISO/IEC 27001:2022/Amd 1:2024 Climate action changes
- IAF/ISO Joint Communiqué on the climate change amendments (February 2024)
- Swedac DOC 24:1, Certifiering av ledningssystem, informationssäkerhet
- Cybersäkerhetslag (2025:1506), riksdagen.se
- Directive (EU) 2022/2555 (NIS2)
