ISO 27001:2022 Implementation Guide: From Zero to Certified
ISO 27001:2022 is the world's leading information security management standard, trusted by over 70,000 certified organisations globally. The 2022 revision brought the most significant changes in a decade — 11 new controls, reorganised Annex A, and stronger focus on threat intelligence and cloud security. This guide walks you through implementation from first gap assessment to certification audit.
What changed in ISO 27001:2022?
Structure changes
- • Annex A reduced from 114 to 93 controls
- • Controls reorganised into 4 themes (was 14 domains)
- • 11 new controls added
- • 24 controls merged, 58 updated
New controls include
- • Threat intelligence (5.7)
- • Cloud security (5.23)
- • ICT readiness for business continuity (5.30)
- • Data masking (8.11)
- • Data leakage prevention (8.12)
- • Web filtering (8.23)
- • Secure coding (8.28)
Phase 1: Initiation and Planning (Weeks 1–4)
Define the ISMS Scope
Scope definition is the most important decision in any ISO 27001 implementation. A poorly defined scope creates audit findings and wasted effort. Your scope should cover the information assets, business processes, locations, and technology that are relevant to the information security risks you face.
Consider: which systems handle sensitive customer data? Which processes are revenue-critical? Which locations will the certification cover? Document your scope statement clearly — auditors will test everything within it.
Conduct a Gap Assessment
Before building anything, understand where you stand. Map your existing controls against ISO 27001:2022 Annex A and identify gaps. This assessment should cover all 93 controls and produce a prioritised remediation backlog. Most organisations find they have 60–70% of required controls in some form — the challenge is documentation and consistency.
Get Board Buy-In
ISO 27001 clause 5.1 requires demonstrated leadership commitment. This isn't box-ticking — you need an executive sponsor, a defined information security policy approved at board level, and resources allocated to the implementation. Without genuine leadership support, ISMS programmes stall.
Phase 2: Risk Assessment and Treatment (Weeks 4–10)
The information security risk assessment is the heart of ISO 27001. Clause 6.1.2 requires you to define a risk assessment methodology, identify risks to information confidentiality, integrity, and availability, analyse and evaluate those risks, and select appropriate treatment options.
Risk assessment methodology essentials
- Define risk criteria — what likelihood and impact scales will you use?
- Identify all in-scope information assets and their owners
- For each asset, identify relevant threats and vulnerabilities
- Assess inherent risk (before controls) and residual risk (after controls)
- Apply risk appetite — which risks are acceptable, which require treatment?
- Document treatment decisions: mitigate, accept, transfer, or avoid
- Produce a Risk Treatment Plan (RTP) with owners and deadlines
Phase 3: Controls Implementation (Weeks 8–20)
Based on your risk treatment decisions, implement the required Annex A controls. The four themes in ISO 27001:2022 organise controls as follows:
Organisational Controls (5.x)
37 controls
Policies, roles, supplier security, incident management, threat intelligence
People Controls (6.x)
8 controls
Screening, terms of employment, security awareness, disciplinary process
Physical Controls (7.x)
14 controls
Physical perimeters, clear desk, equipment security, secure disposal
Technological Controls (8.x)
34 controls
Access control, encryption, malware protection, vulnerability management, secure coding
Phase 4: Statement of Applicability
The Statement of Applicability (SoA) is a mandatory document that lists all 93 Annex A controls, states whether each is applicable to your ISMS, justifies inclusions and exclusions, and references the implementation status. The SoA is one of the first documents an auditor reviews — it needs to be thorough, accurate, and linked to your risk treatment decisions.
A common mistake: excluding controls without documented justification. Every exclusion must reference why the control is not applicable — typically because the associated risk doesn't exist in your context (e.g. physical media controls excluded because you're fully cloud-based and handle no physical media).
Phase 5: Internal Audit and Management Review
Before your certification audit, you must complete at least one full internal audit cycle (clause 9.2) and a management review (clause 9.3). The internal audit must be conducted by someone independent of the areas being audited — this can be internal staff not responsible for those areas, or an external consultant.
The management review must cover: audit results, risk assessment outcomes, ISMS performance metrics, nonconformities and corrective actions, and opportunities for improvement. Minutes must be retained as evidence.
Phase 6: Certification Audit
Certification audits are conducted by accredited certification bodies (CBs) in two stages:
Stage 1 — Document Review
The auditor reviews your ISMS documentation: scope, policies, risk assessment, SoA, risk treatment plan, and management review minutes. This typically takes 1–2 days. The auditor produces a Stage 1 report identifying any areas to address before Stage 2.
Stage 2 — Implementation Audit
The auditor tests whether your documented controls are actually implemented and effective. They will interview staff, review evidence, inspect systems, and test processes. This typically takes 2–5 days depending on scope and organisation size.
Realistic Timeline and Cost
Small org (50 staff)
4–6 months
£15k–£40k
Mid-size (200 staff)
6–12 months
£40k–£100k
Large (1000+ staff)
12–18 months
£100k–£300k+
Costs include external consultancy, certification body fees, and tooling. Internal resource not included.
Accelerate your ISO 27001 journey
Cyber Horizon pre-loads all 93 ISO 27001:2022 controls, automates evidence collection, generates your Statement of Applicability, and tracks your certification readiness in real time. Most customers reach audit-ready in half the typical time.
Book a Demo