ISO/IEC 27001 · Information security management system
ISO 27001 software for your ISMS.
ISO 27001 is the international standard for information security management. With Basenorm you set up, run and evidence your ISMS, and extend it with ISO 42001 when AI comes into scope.
Hosted in the Netherlands. Your data stays in the EU.The standard in brief
- Version
- ISO/IEC 27001:2022Annex A aligned with ISO/IEC 27002:2022
- Type
- Management system standardCertifiable by an accredited body
- Structure
- Clauses 4 to 10The same structure as ISO 42001
- Annex A
- 93 controls in 4 themesSelected in your statement of applicability
01 / The requirements
What ISO 27001
asks of you.
ISO 27001 sets requirements for an information security management system: context and scope, leadership, risk assessment and treatment, and continual improvement. Annex A provides the controls you select from.
- Clause 4Context of the organisation
Determine internal and external issues, interested parties and the scope of your ISMS.
- Clause 5Leadership
Set an information security policy and assign roles, responsibilities and authorities.
- Clause 6Planning
Assess information security risks, plan their treatment and set objectives.
- Clause 7Support
Arrange resources, competence, awareness, communication and documented information.
- Clause 8Operation
Carry out risk assessments and the risk treatment plan in daily practice.
- Clause 9Performance evaluation
Monitor and measure, run internal audits and hold management reviews.
- Clause 10Improvement
Handle nonconformities with corrective action and keep improving.
The clause titles follow the harmonised structure that ISO 42001 also uses.
02 / Annex A
The controls
in Annex A.
Annex A of ISO 27001:2022 contains 93 controls in four themes. You decide per control whether it applies, and record your choices and justifications in the statement of applicability.
- A.5Organisational controls37 controls
- A.6People controls8 controls
- A.7Physical controls14 controls
- A.8Technological controls34 controls
03 / Next to ISO 42001
ISO 27001 next to ISO 42001.
| Topic | ISO 27001 | ISO 42001 |
|---|---|---|
| Subject | Information security | Responsible development, provision and use of AI |
| Structure | Clauses 4 to 10 | Clauses 4 to 10, the same structure |
| Risk | Information security risks | AI risks and the impact on individuals, groups and society |
| Annex A | Information security controls | Controls for AI |
| Statement of applicability | Required | Required |
| Certification | By an accredited certification body | By an accredited certification body |
Both share the structure of clauses 4 to 10. Reuse is assessed per control, not as a fixed percentage.
What ISO 42001 builds on
- Document control and approvals
- Internal audit and management review
- Nonconformities and corrective actions
- Competence and awareness
- Supplier management
What ISO 42001 adds for AI
- AI systems and their intended use
- AI risk and impact assessment
- Data quality and provenance
- Human oversight
- Testing, monitoring and transparency
04 / The route
From scope to certificate.
- 01
Determine context and scope
Describe issues, interested parties and the boundaries of your ISMS.
In BasenormRecord scope, assets and owners in one place.
- 02
Set policy and responsibilities
Write your information security policy and assign roles and authorities.
In BasenormLink policies and decisions to the controls they support.
- 03
Assess and treat risks
Assess risks and record how you treat them in a risk treatment plan.
In BasenormLink risks to controls, owners and treatment status.
- 04
Statement of applicability
Decide per Annex A control whether it applies and justify your choice.
In BasenormKeep your statement of applicability current as controls change.
- 05
Show that it works
Collect evidence, run an internal audit and hold a management review.
In BasenormLink evidence once and see what is still open.
- 06
Certification and surveillance
An accredited certification body audits your ISMS. A certificate is typically valid for three years, with surveillance audits in between.
In BasenormGive your auditor access to controls and evidence with the auditor role.
05 / NIS2 and more
DIRECTIVE (EU) 2022/2555ISO 27001 and
NIS2.
NIS2 is law. ISO 27001 is a voluntary standard. A certificate alone does not prove NIS2 compliance, but your ISMS gives you the structure for the risk management measures NIS2 asks for.
Read about NIS2Most controls are shared. ISO 27001 and NIS2 share 70 to 80% of their controls, so NIS2 starts mostly complete.
Security of processing. Your information security controls support the security requirements for personal data.
ICT risk management. For financial entities, the ISMS supports the ICT risk management framework.
NIS2 is Directive (EU) 2022/2555; DORA is Regulation (EU) 2022/2554. The 70 to 80% overlap comes from Basenorm’s own published mapping.
06 / In Basenorm
How Basenorm supports you.
Unified Control Library
Define a control once and see whether it counts for ISO 27001, ISO 42001, NIS2 or more.
02Governance Graph
Connect assets, risks, controls, evidence and owners.
03AskNorman
Ask what is still open for your ISMS, in Basenorm or via MCP from ChatGPT or Claude. You review the evidence yourself.
07 / Questions
Questions about
ISO 27001.
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It specifies requirements for establishing, implementing, maintaining and continually improving an ISMS, and can be certified by an accredited certification body.
What changed in ISO 27001:2022?
ISO 27001:2022 is the current version. Annex A was aligned with ISO 27002:2022 and now contains 93 controls in four themes: organisational, people, physical and technological.
How is the ISMS scope defined?
The scope sets the boundaries of your ISMS in terms of organisational units, locations, processes, services, assets and technology. It takes into account internal and external issues, interested parties and interfaces.
What is the statement of applicability?
The statement of applicability lists all Annex A controls, states which apply, justifies inclusions and exclusions, and describes their implementation status.
How does risk treatment work?
For each risk you choose how to treat it: avoid it, reduce it with controls, transfer it or accept it. You record your choices in a risk treatment plan.
What does the internal audit involve?
ISO 27001 requires internal audits at planned intervals to check that the ISMS conforms to the standard and is effectively implemented and maintained.
How does certification work?
An accredited certification body assesses whether your ISMS meets ISO 27001. A certificate is typically valid for three years, with surveillance audits in the years in between.
How does ISO 27001 relate to NIS2?
ISO 27001 supports many NIS2 requirements, such as risk management, incident handling and supplier security. Both share 70 to 80% of their controls, but a certificate alone does not prove NIS2 compliance.
Can we add ISO 42001 later?
Yes. ISO 42001 follows the same structure of clauses 4 to 10. You build on processes such as document control, internal audit and management review, and add what AI requires.
Does Basenorm certify our organisation?
No. Basenorm supports setting up, running and demonstrating your ISMS. An independent, accredited certification body performs the audit and decides on the certificate.
Book a demo
Bring your ISMS into one EU-native platform.
In a demo we look at your current ISMS, your scope and your next step.
- Where your ISMS stands today.
- How you manage controls, risks and evidence in one place.
- How you add ISO 42001 or NIS2 later.
Hosted in the Netherlands. Your data stays in the EU.