# What Is ISO/IEC 27001? ISMS, 93 Controls and Certification Guide **URL:** https://securesys.com.tr/en/learning/cyber-security-compliance-advisory/what-is-iso-27001-isms-setup-and-certification-guide ![What Is ISO/IEC 27001? ISMS, 93 Controls and Certification Guide](/images/bilgi-merkezi/covers/cover-uyum-03.webp) ### What Is ISO/IEC 27001? **ISO/IEC 27001 is the standard that defines the international requirements for establishing, operating, maintaining and continually improving an Information Security Management System (ISMS), so that organisations can protect their information assets systematically.** The core purpose of ISO/IEC 27001 is to bring information security risks down to a manageable level. The standard does not focus solely on protecting servers, networks or security software. It addresses different areas in an integrated way, such as people, processes, technology, physical security, supplier relationships and corporate governance. The presence of a firewall, EDR, SIEM or DLP product in an organisation does not, on its own, mean that the requirements of ISO/IEC 27001 are met. This is because information security does not consist of technical controls alone. Risks must be identified, responsibilities assigned, policies applied, audits carried out and management must take part in the process. **Short answer:** ISO/IEC 27001 is an international management system standard, suitable for independent certification, that enables organisations to identify their information security risks, apply appropriate controls and continually improve their security processes. ### \1. Why Is ISO/IEC 27001 Important? Today, information is one of an organisation's most valuable assets. Customer records, financial data, trade secrets, software source code, employee information and operational systems are critical to the continuity of corporate activities. These assets must be protected against unauthorised access, alteration or becoming unavailable. Information security breaches do not cause technical problems alone. They can lead to consequences such as financial losses, service interruptions, legal liabilities, a decline in customer trust and reputational damage. ISO/IEC 27001 ensures that these risks are addressed through a defined management system rather than through ad hoc security measures. #### Benefits ISO/IEC 27001 can offer an organisation - Systematic management of information security risks. - Clearer corporate responsibilities. - Standardisation of security policies. - Protection of critical information assets. - Support for supplier and customer trust. - More effective tracking of legal and contractual obligations. - Development of a culture of internal audit and continual improvement. - Risk-focused planning of security investments. An ISO/IEC 27001 certificate does not guarantee that an organisation will never suffer a cyber attack. Certification shows that, within a defined scope, an information security management system has been assessed for conformity with the requirements of the relevant standard. ### \2. What Is an Information Security Management System (ISMS)? An Information Security Management System is the organisational structure that enables an organisation to manage its information security activities in a planned, measurable and sustainable way. An ISMS is not merely a policy file. It covers how an organisation makes decisions on information security, which risks it accepts, which controls it applies and how it monitors the results. #### Core components of an ISMS **Policies:** Define the organisation's approach to information security. **Risk management:** Assesses threats, vulnerabilities and their potential impact. **Organisation:** Defines roles, responsibilities and authorities. **Technical controls:** Support the security of systems, networks, applications and data. **Operational processes:** Ensure that day-to-day security activities are carried out. **Audit:** Evaluates the effectiveness of the controls and of the management system. **Improvement:** Ensures that deficiencies are remedied and processes are developed further. The success of an ISMS depends on these components being managed as a working system, not as documents independent of one another. ### \3. What Is ISO/IEC 27001:2022? ISO/IEC 27001:2022 is the version of the ISO/IEC 27001 standard published in 2022. In this version, the management system requirements and the Annex A security controls have been updated. One of the most notable changes in the 2022 version is the restructuring of the Annex A control structure. While the previous 2013 version contained 114 controls, the 2022 version contains 93 controls. This change does not mean that security controls have become less important. Some controls have been merged and reorganised, and new controls addressing emerging threat areas have been added. In the 2022 version, areas such as cloud services, threat intelligence, data masking, data leakage prevention and secure coding have become more visible. #### An important distinction ISO/IEC 27001 defines the management system requirements and the Annex A reference controls. ISO/IEC 27002, on the other hand, provides detailed guidance on implementing information security controls. Therefore, ISO/IEC 27001 and ISO/IEC 27002 are not the same standard. ### \4. The Core Security Principles of ISO/IEC 27001 At the centre of ISO/IEC 27001 lie the confidentiality, integrity and availability of information. This approach is known as the CIA Triad. #### Confidentiality Confidentiality means that only authorised people and systems can access information. Examples: Applying role-based access to customer data. Encrypting sensitive files. Protecting administrator accounts with MFA. #### Integrity Integrity means preventing information from being altered in an unauthorised or unintended way. Examples: File integrity checks. Database change logs. Source code version control. #### Availability Availability means that information and information systems are usable when needed. Examples: Backup. Disaster recovery. High availability architectures. Capacity and continuity planning. These three principles must be considered together. A security approach that focuses only on confidentiality may fail to adequately protect the availability of systems or the integrity of data. ### \5. The Main Clauses of the ISO/IEC 27001 Standard The ISO/IEC 27001 management system requirements are set out in clauses 4 to 10 in particular. | Clause | Topic | Core purpose | | --- | --- | --- | | 4 | Context of the organisation | Determine the scope and interested parties | | 5 | Leadership | Ensure management responsibility | | 6 | Planning | Manage risks, opportunities and objectives | | 7 | Support | Manage resources, competence and documentation | | 8 | Operation | Carry out planned activities | | 9 | Performance evaluation | Monitoring, internal audit and management review | | 10 | Improvement | Resolve nonconformities and improve the system | These clauses form the management system backbone of the standard. The Annex A controls, in turn, contain the reference security controls that can be used in treating risks. ### \6. ISO/IEC 27001 Clause 4: Context of the Organisation Before setting up an ISMS, the organisation's activities and business environment must be assessed. It must be established which services the organisation provides, which information assets it uses and which parties it interacts with. #### Areas of assessment Corporate activities. Customer expectations. Legal and regulatory obligations. Supplier relationships. Technological infrastructure. Business continuity requirements. Internal and external issues. #### Example In a software company, source code repositories, CI/CD systems and customer development environments may be critical. In a financial institution, payment systems, customer information and transaction records may come to the fore. The ISMS scope should be defined with these differences in mind. ### \7. How Is the ISO/IEC 27001 Scope Determined? The ISMS scope defines which activities, locations, systems and organisational units the certification covers. The scope must be clear, understandable and verifiable. #### Questions to ask when determining the scope Which services will be included in the scope? Which locations will be included? Which systems support these services? Which employees and suppliers are involved? Which types of data are processed? Which external dependencies exist? #### Example scope statement “Information security management activities for the software development, application maintenance, technical support and information technology operations carried out at the organisation's head office.” This statement is only an example. The actual scope should be prepared according to the organisation's activities and the certification requirements. Artificially narrowing the scope so that critical dependencies are overlooked can weaken the effectiveness of the management system. ### \8. ISO/IEC 27001 Clause 5: Leadership and Top Management ISO/IEC 27001 does not treat information security as the responsibility of the IT department alone. Top management must lead and support the ISMS. #### Core responsibilities of top management Ensuring that an information security policy is established. Aligning ISMS objectives with the corporate strategy. Providing the necessary resources. Defining roles and responsibilities. Evaluating the effectiveness of the management system. Supporting continual improvement. #### The critical point An information security manager can report risks. However, the acceptance of risks at the corporate level and the allocation of resources must be carried out within the defined authorities and responsibilities. Management involvement is necessary for the sustainability of the ISMS. ### \9. ISO/IEC 27001 Clause 6: Risk Management Risk management is one of the most important components of ISO/IEC 27001. The organisation must identify, analyse, evaluate and appropriately treat its information security risks. #### The core process - Defining the risk assessment methodology. - Identifying risks. - Assessing likelihood and impact. - Determining the risk level. - Evaluating risk treatment options. - Creating the risk treatment plan. - Accepting residual risks with the appropriate authority. - Reviewing risks regularly. The risk assessment method must be consistent, repeatable and suited to the organisation's needs. ### \10. How Is an ISO/IEC 27001 Risk Analysis Performed? Risk analysis can be carried out with different methodologies. In a simple approach, likelihood and impact scores can be used. #### Example risk matrix | Likelihood | Impact | Risk score | | --- | --- | --- | | 1 | 1 | 1 | | 2 | 3 | 6 | | 3 | 4 | 12 | | 4 | 4 | 16 | | 5 | 5 | 25 | Example calculation: **Risk Score = Likelihood × Impact** Consider an internet-facing VPN device with a critical vulnerability in an organisation. Likelihood: 4. Impact: 5. Risk score: 20. Depending on the risk criteria the organisation has defined, this value may be rated as high or critical. #### Points to note A CVSS score on its own is not a corporate risk score. The business value of the asset, its attack exposure, the existing controls and the business impact must also be assessed. The same technical vulnerability can create different risk levels in different organisations. ### \11. What Are the Risk Treatment Methods? Appropriate treatment options are evaluated for the identified risks. #### Risk reduction Reducing the risk by applying additional security controls. Example: Remedying the absence of MFA. #### Risk avoidance Stopping or changing the activity that creates the risk. Example: Completely removing an insecure external access method. #### Risk sharing Sharing certain consequences of the risk through contractual or insurance mechanisms. However, sharing a risk does not mean that all of the organisation's responsibilities disappear. #### Risk acceptance Accepting the risk within the defined criteria and authorities. Risk acceptance must be justified, recorded and carried out with the appropriate authority. ### \12. What Is ISO/IEC 27001 Annex A? Annex A contains the reference controls that can be used in addressing information security risks. ISO/IEC 27001:2022 contains a total of **93 controls**. The controls are organised into four main groups. | Control group | Number of controls | | --- | --- | | A.5 Organisational controls | 37 | | A.6 People controls | 8 | | A.7 Physical controls | 14 | | A.8 Technological controls | 34 | | Total | 93 | It should not be assumed that all of these controls must be applied in the same way in every organisation. Control selection should be linked to the risk assessment and to the relevant obligations. However, the decision not to implement a control must be explained with an appropriate justification. ### \13. A.5 Organisational Controls Organisational controls support the management of information security through corporate processes. #### Example areas Information security policies. Roles and responsibilities. Segregation of duties. Asset inventory. Information classification. Supplier relationships. Security of cloud services. Information security incident management. Business continuity preparedness. Legal and contractual requirements. #### Example implementation A process can be established in which the organisation classifies its information assets and determines access authorisations according to that classification. However, preparing a policy is not sufficient on its own. Evidence showing that the policy is being applied must exist. ### \14. A.6 People Controls People controls address the information security responsibilities of employees and interested parties. #### Example areas Pre-employment screening. Terms and conditions of employment. Information security awareness. Disciplinary processes. Termination and change of employment. Confidentiality obligations. Remote working. Reporting of information security events. #### Example implementation Revoking the access of a departing employee in a timely manner requires people controls and technical access controls to work together. If no notification is made by human resources, the technical team may not be able to carry out the necessary action on time. For this reason, coordination must be ensured between processes. ### \15. A.7 Physical Controls Physical controls support the protection of the environments in which information assets are located. #### Example areas Physical security perimeters. Physical entry control. Office and facility security. Physical security monitoring. Protection against environmental threats. Equipment security. Management of storage media. Secure disposal. #### Example implementation Access to the server room can be limited to authorised personnel only. Entry logs can be kept. Threats such as fire, flooding and power outages can be assessed. Physical security does not become entirely unimportant for organisations that use cloud services either. The security assurances offered by the supplier and the organisation's own physical assets must be assessed. ### \16. A.8 Technological Controls Technological controls cover technical measures for system and application security. #### Example areas Endpoint security. Privileged access rights. Secure authentication. Protection against malware. Technical vulnerability management. Secure configuration. Data deletion. Data masking. Data leakage prevention. Backup. Logging. Network security. Cryptography. Secure development life cycle. Secure coding. #### Example implementation In a software development organisation, access to source code repositories can be restricted. Code analyses can be carried out. Security controls can be applied in CI/CD processes. Development and production environments can be separated. These controls support the reduction of technical risks. ### \17. The 11 New Controls Highlighted in ISO/IEC 27001:2022 The 2022 control structure contains 11 controls defined as new compared with the previous version. | Control | Topic | | --- | --- | | A.5.7 | Threat intelligence | | A.5.23 | Information security for use of cloud services | | A.5.30 | ICT readiness for business continuity | | A.7.4 | Physical security monitoring | | A.8.9 | Configuration management | | A.8.10 | Information deletion | | A.8.11 | Data masking | | A.8.12 | Data leakage prevention | | A.8.16 | Monitoring activities | | A.8.23 | Web filtering | | A.8.28 | Secure coding | These controls support a more systematic approach to the risks encountered in modern information technology environments. In particular, the cloud security, DLP, monitoring and secure coding controls are directly related to corporate Cyber Hygiene programmes. ### \18. What Is the Statement of Applicability (SoA)? **The Statement of Applicability (SoA) is the core ISMS document under ISO/IEC 27001 that identifies the necessary controls, shows their implementation status and explains the justifications for including or excluding controls.** The SoA is not simply an Excel table in which 93 controls are ticked. It must be linked to risk treatment decisions. #### Core information that should appear in the SoA The necessary controls. The justifications for selecting the controls. Whether the controls are implemented. The justifications for any Annex A controls that are excluded. #### Example SoA entry **Control:** A.8.13 Information backup. **Justification:** Reducing the risk of losing critical business data. **Implementation status:** Implemented. **Evidence:** Backup policy, backup logs and restore test results. The SoA must be consistent with the risk assessment and the risk treatment plan. ### \19. Which Documents Must Be Prepared for ISO/IEC 27001? ISO/IEC 27001 requires certain documented information to be created and maintained. In addition, there may be other documents that the organisation considers necessary for the effectiveness of its management system. #### Common examples of documents ISMS scope. Information security policy. Risk assessment methodology. Risk assessment results. Risk treatment plan. Statement of Applicability. Information security objectives. Evidence of competence. Operational control records. Monitoring and measurement results. Internal audit records. Results of management reviews. Records of nonconformities and corrective actions. #### An important point It is not mandatory to prepare the same number of procedures for every organisation. The scope of documentation should be determined according to the organisation's size, activities, risks and management system needs. Producing unnecessary documents may not make the management system any more effective. ### \20. How Is an Information Security Policy Prepared? An information security policy sets out the organisation's high-level approach to information security. The policy should be appropriate to the organisation's activities. It should provide a framework for information security objectives. It should include a commitment to satisfying applicable requirements and to continual improvement. #### Example policy principles The confidentiality, integrity and availability of information assets are protected. Information security risks are assessed systematically. Access authorisations are determined according to business requirements. Information security incidents are managed through defined processes. Legal and contractual requirements are tracked. The ISMS is evaluated and improved regularly. The policy must be communicated appropriately to interested parties and applied within the organisation. ### \21. Asset Inventory in ISO/IEC 27001 For risk management to be carried out soundly, information assets must be known. An asset inventory does not cover physical devices alone. #### Example asset types Servers. Client devices. Network equipment. Databases. Software applications. Source code. Cloud resources. Contracts. Customer data. Backup systems. Critical business processes. Ownership and appropriate classification information must be determined for each asset. #### Example inventory fields Asset name. Asset type. Asset owner. Location. Criticality. Data classification. Dependencies. Protection requirements. An up-to-date inventory forms the basis of risk assessment and control selection. ### \22. ISO/IEC 27001 and Access Control Access control is one of the core technical areas of an information security management system. The aim is for users to be able to access only the resources necessary for their duties. #### Implementation examples Role-based access control. Multi-factor authentication. Privileged account management. User life cycle management. Periodic review of access authorisations. Service account security. #### Audit approach An auditor does not examine only whether an access control policy exists. They may also assess sample records that show how the policy is applied. For example, they may examine when the account of a departed employee was disabled. ### \23. ISO/IEC 27001 and Vulnerability Management Technical vulnerability management is important for identifying and appropriately addressing security weaknesses in systems. #### Recommended process Determining the asset scope. Regular security scans. Validating findings. Risk-based prioritisation. Remediation plan. Fixing. Retesting. #### Example A high-risk vulnerability may be detected in a critical internet-facing web application in an organisation. It is not sufficient merely to report this finding. It must be assigned to the relevant technical team, a remediation target must be set and the fix must be verified. The results of vulnerability management can also provide input to the ISMS risk assessment. ### \24. ISO/IEC 27001 and Penetration Testing ISO/IEC 27001 requires information security risks to be managed and appropriate security controls to be applied. Penetration tests are one of the methods that can be used to evaluate the effectiveness of these controls. However, the general claim that the standard obliges all organisations to carry out exactly one penetration test per year is not correct. The scope and frequency of penetration testing should be determined according to risks, contracts, legislation and corporate requirements. #### Penetration testing areas Web applications. API services. Internal network. External network. Active Directory. Wireless networks. Cloud infrastructures. Mobile applications. #### Technical verification It is important that the findings identified as a result of a penetration test are remediated and, where necessary, retested. The fact that a test has been carried out does not mean that the findings have been closed. ### \25. ISO/IEC 27001 and SOC Services A SOC can play an important role in monitoring and assessing information security events and in supporting response processes. #### Controls that a SOC can support Monitoring security logs. Detecting suspicious access. Assessing malware activity. Monitoring privileged account activity. Classifying security events. Supporting incident response processes. #### An important distinction It cannot be said that every organisation must purchase a 24/7 SOC service in order to obtain ISO/IEC 27001 certification. The required monitoring and response capability should be determined through the risk assessment. However, for organisations with critical systems and high threat exposure, continuous monitoring can be an important security need. ### \26. The Relationship Between ISO/IEC 27001 and KVKK (Turkish Personal Data Protection Law) ISO/IEC 27001 and Personal Data Protection Law No. 6698 have different purposes. ISO/IEC 27001 defines the requirements for an information security management system. KVKK, on the other hand, regulates the legal obligations relating to the processing and protection of personal data. #### Areas of common work Access control. Data security. Incident management. Risk assessment. Supplier security. Recording and monitoring. #### The critical distinction Holding an ISO/IEC 27001 certificate does not mean that an organisation automatically fulfils all of its KVKK obligations. The conditions for processing personal data, the obligation to inform, data subject rights and other legal requirements must be assessed separately. ### \27. The Difference Between ISO/IEC 27001 and ISO/IEC 27701 ISO/IEC 27001 focuses on information security management. ISO/IEC 27701, on the other hand, offers a management system approach relating to privacy information management and personal data processing. The two standards contain areas that can complement each other. #### ISO/IEC 27001 Information security risks. Security policies. Access control. Technical and organisational security. #### ISO/IEC 27701 Privacy management. Personal data processing activities. Roles of controller and processor. Privacy risks. The version of ISO/IEC 27701 to be applied and its certification conditions must be verified separately. ### \28. The Relationship Between ISO/IEC 27001 and ISO/IEC 42001 For organisations that use or develop artificial intelligence systems, ISO/IEC 42001 may become important in its own right. While ISO/IEC 27001 addresses the information security management system, ISO/IEC 42001 defines the requirements for an artificial intelligence management system. #### Areas that can be considered together Risk management. Policies. Roles and responsibilities. Supplier management. Audit. Continual improvement. #### Areas that differ ISO/IEC 42001 focuses on topics such as the life cycle, impacts and governance of artificial intelligence systems. ISO/IEC 27001, on the other hand, is aimed at managing broader information security risks. In organisations with artificial intelligence security needs, both management systems can be addressed together. ### \29. What Is an ISO/IEC 27001 Internal Audit? An internal audit is carried out to evaluate the ISMS's conformity with the organisation's own requirements and with the ISO/IEC 27001 standard. It also examines whether the management system is effectively implemented and maintained. #### Topics that can be assessed in an internal audit ISMS scope. Risk assessment records. SoA. Policies. Control implementations. Previous audit findings. Improvement activities. #### Auditor independence Impartiality and objectivity must be ensured in internal audit activities. People should avoid auditing activities for which they are themselves responsible in a way that undermines the principle of independence. Internal audit results must be recorded and reported to the relevant management. ### \30. What Is Management Review? Management review is the process in which top management evaluates the suitability, adequacy and effectiveness of the ISMS. #### Inputs that can be assessed Decisions from previous management reviews. Changes in internal and external issues. The needs of interested parties. Information security performance. Risk assessment results. Internal audit findings. Nonconformities. Corrective actions. Opportunities for improvement. #### Expected outputs Improvement decisions. Changes needed in the ISMS. Resource needs. It is important that management decisions are traceable. Management review should not be carried out merely to produce meeting minutes. ### \31. How Does the ISO/IEC 27001 Certification Process Work? ISO/IEC 27001 certification is carried out through an independent conformity assessment performed by an authorised certification body. #### Step 1: Preparation The ISMS scope is determined. A risk assessment is carried out. The necessary policies and processes are established. Controls are implemented. #### Step 2: Internal assessment ISMS practices are verified. An internal audit is carried out. A management review is held. Deficiencies are addressed. #### Step 3: Certification audit – Stage 1 The certification body evaluates the readiness of the management system and the relevant documented information. #### Step 4: Certification audit – Stage 2 The implementation and effectiveness of the management system are examined in more detail. #### Step 5: Certification decision The certification decision is made by evaluating the audit findings and the relevant processes. #### Step 6: Surveillance and recertification To maintain the certificate, surveillance and recertification activities are carried out in accordance with the relevant certification programme. The certification decision is the responsibility of the certification body, not of the consulting firm. ### \32. What Is TÜRKAK (Turkish Accreditation Agency) Accreditation and Why Does It Matter? TÜRKAK is the Turkish Accreditation Agency. Accreditation provides an independent assessment that conformity assessment bodies can carry out specific activities competently. #### Its importance for ISO/IEC 27001 It should be assessed whether the certification body is accredited for the relevant scope. The scope of accreditation is as important as the name of the certification body. #### Points to note The accreditation status of the certification body. Whether the relevant standard is included in the scope of accreditation. The validity status of the certificate. The scope of the certificate. #### The critical distinction An organisation holding an ISO/IEC 27001 certificate and an organisation being authorised to issue ISO/IEC 27001 certificates to other organisations are different matters. Consulting organisations can support ISMS implementation. However, accredited certification activities are carried out by authorised certification bodies. ### \33. How Many Years Is an ISO/IEC 27001 Certificate Valid? In common accredited management system certification programmes, the certification cycle is three years. During this period, planned surveillance audits are carried out. At the end of the three-year cycle, a recertification assessment is performed. However, the validity of the certificate depends on surveillance requirements being met and on the decisions of the certification body. #### An important point The fact that a certificate shows a future expiry date does not mean it is active under all circumstances. Situations such as suspension or withdrawal must be assessed separately. ### \34. How Long Does ISO/IEC 27001 Certification Take? The time needed to set up an ISMS and prepare for certification varies according to the organisation's current situation. #### Factors affecting the duration The size of the organisation. The number of locations. The ISMS scope. The number of employees. The information technology infrastructure. Existing security controls. Documentation maturity. The risk assessment. The scope of corrective actions. #### Example planning | Phase | Activity | | --- | --- | | 1 | Current state analysis | | 2 | Scope and risk methodology | | 3 | Risk assessment and SoA | | 4 | Creation of policies and processes | | 5 | Control implementation | | 6 | Internal audit | | 7 | Management review | | 8 | Certification audit | In some organisations preparation can be completed in a few months, while in more complex organisations the process may take longer. The scope and the current situation should be assessed before any firm commitment is given on timing. ### \35. How Is the Cost of ISO/IEC 27001 Certification Determined? There is no single fixed cost for ISO/IEC 27001 certification that applies to all organisations. Costs may vary according to the characteristics of the organisation and the scope of the service. #### Core cost components Current state analysis. Consulting services. Use of internal resources. Technical security improvements. Training. Internal audit. Certification audit. Surveillance audits. #### The difference between consulting and certification A consulting service supports the organisation in building and improving its management system. A certification service, on the other hand, is an independent conformity assessment. The scopes and responsibilities of these two services are different. ### \36. The Most Common Mistakes in ISO/IEC 27001 Certification #### \1. Focusing only on preparing documents Creating policies is not sufficient. Implementation and evidence are required. #### \2. Carrying out the risk assessment superficially Generic risk lists that are independent of the organisation may not reflect real threats. #### \3. Preparing the SoA independently of the risk assessment Control selections and justifications must be linked to the risk treatment process. #### \4. Not involving top management in the process The ISMS should not be left to the IT department alone. #### \5. Not following up on technical findings The results of penetration tests or vulnerability scans must be included in the improvement process. #### \6. Turning the internal audit into a formality The internal audit must evaluate real practices. #### \7. Not updating the system after certification The ISMS must be operated and improved continually. ### \37. The Relationship Between ISO/IEC 27001 and Cyber Hygiene Cyber Hygiene focuses on applying basic security controls regularly and effectively. ISO/IEC 27001, in turn, supports addressing these controls within a risk-based management system. #### Example mapping | Cyber Hygiene control | ISO/IEC 27001:2022 Annex A relationship | | --- | --- | | Asset inventory | A.5.9 | | Access control | A.5.15 | | Identity management | A.5.16 | | Privileged access | A.8.2 | | Malware protection | A.8.7 | | Technical vulnerability management | A.8.8 | | Configuration management | A.8.9 | | Data leakage prevention | A.8.12 | | Backup | A.8.13 | | Logging | A.8.15 | | Monitoring activities | A.8.16 | | Secure coding | A.8.28 | This table is an example mapping. In an actual conformity assessment, the purpose and scope of the control and the evidence of its implementation must also be examined separately. ### \38. Why Is Technical Verification Necessary for ISO/IEC 27001 Compliance? The existence of corporate information security policies does not mean that systems are securely configured. For example, an access control policy may have been prepared. However, there may be more administrator accounts than necessary on critical servers. Similarly, a backup procedure may have been prepared. But restore tests may fail. For this reason, technical verification makes an important contribution to ISMS assessments. #### Technical verification methods Configuration reviews. Vulnerability scans. Penetration tests. Access control tests. Backup and restore tests. Logging and monitoring tests. Source code security analyses. These activities should be planned on a risk basis and carried out with the approval of the relevant system owners. ### \39. A 90-Day Sample Implementation Plan for ISO/IEC 27001 The roadmap below is an example for organisations with a certain level of corporate maturity. #### Days 1–15: Current State Analysis Determining the ISMS scope. Reviewing existing policies and procedures. Evaluating the asset inventory. Identifying interested parties. Preparing the gap analysis. #### Days 16–30: Risk Management Establishing the risk assessment methodology. Identifying risks. Preparing the risk treatment plan. Creating the SoA. #### Days 31–60: Control Implementation Access control. Patch and vulnerability management. Backup. Logging. Incident management. Supplier security. Implementing policies and procedures. #### Days 61–75: Effectiveness Evaluation Control verifications. Internal audit. Identifying nonconformities. Planning corrective actions. #### Days 76–90: Management and Certification Readiness Management review. Evaluating open findings. Certification readiness check. Audit planning. **Note:** This plan does not guarantee that a certificate will be obtained within 90 days. The organisation's current situation, the completion of control implementations and the certification body's scheduling all affect the timeline. ### \40. A Corporate Responsibility Matrix for ISO/IEC 27001 Responsibilities must be clearly defined for the ISMS to work effectively. | Activity | Recommended owner | | --- | --- | | ISMS policy | Top Management | | ISMS coordination | Information Security Manager | | Risk assessment | Risk Owners / Information Security | | Asset inventory | Asset Owners / IT | | Access control | IAM / System Administration | | Vulnerability management | IT / Information Security | | Security monitoring | SOC / Security Operations | | Incident response | Incident Response Team | | Internal audit | Impartial Internal Audit Function | | Management review | Top Management | | Corrective actions | Relevant Process Owners | This table is an example. Depending on the organisation's structure, roles can be combined or separated. However, segregation of duties and audit impartiality must be preserved. ### \41. How Is ISO/IEC 27001 Performance Measured? The effectiveness of the ISMS should be evaluated with measurable indicators. #### Example KPIs **Risk treatment rate:** The completion rate of planned risk treatment activities. **Critical vulnerability closure rate:** The proportion of critical vulnerabilities remediated within the target time. **MFA coverage:** The proportion of critical accounts on which MFA is enforced. **Backup test success:** The proportion of restore tests completed successfully. **Training completion rate:** The proportion of employees who have completed the planned information security training. **Audit finding closure rate:** The proportion of nonconformities closed within the target time. #### An important point KPIs should not be created for reporting purposes alone. They should support management decisions and make improvement opportunities visible. ### \42. What Should Be Done After Obtaining an ISO/IEC 27001 Certificate? Certification does not mean that information security work has come to an end. The ISMS must be operated. #### Ongoing activities Updating risk assessments. Adding new assets to the inventory. Evaluating security events. Reviewing access authorisations. Vulnerability management. Internal audits. Management review. Following up on corrective actions. Updating policies and procedures. Preparing for surveillance audits. New technologies, organisational changes and emerging threats can all affect the ISMS. For this reason, information security management should be treated as a continuous activity. ### \43. SECURESYS ISO/IEC 27001 Consulting and Technical Security Services SECURESYS offers an approach that handles information security management system work together with technical cyber security assessments. In ISO/IEC 27001 consulting, the core goal is not only to prepare the organisation for the certification audit, but to manage security risks more systematically. #### ISO/IEC 27001 current state analysis Corporate processes, existing controls and management system requirements are assessed. #### ISMS scope and risk management consulting Support is provided in defining the scope and developing the risk assessment methodology and risk treatment processes. #### SoA and control assessment The ISO/IEC 27001:2022 Annex A controls are linked to risks and their implementation status is assessed. #### Technical security verification System, network and application security assessments can be carried out. #### Penetration testing and vulnerability management The aim is to identify security weaknesses in the corporate infrastructure and to support remediation processes. #### SOC and security monitoring Support can be provided for monitoring security events and developing response processes. #### Internal audit and certification readiness Support is provided in assessing management system practices and carrying out certification readiness work. #### Corporate competencies SECURESYS's corporate competencies in information security, penetration testing, software processes and artificial intelligence management support the integrated assessment of different security and compliance needs. **Important:** ISO/IEC 27001 consulting and certification are different services. The independent certification decision is made by the relevant certification body. ### \44. ISO/IEC 27001 Pre-Certification Checklist - Has the ISMS scope been defined? - Have internal and external issues been assessed? - Have the requirements of interested parties been identified? - Has an information security policy been established? - Have top management responsibilities been defined? - Have information security objectives been set? - Has a risk assessment methodology been established? - Has a risk assessment been carried out? - Has a risk treatment plan been prepared? - Has the SoA been created? - Have control implementations been verified? - Is the asset inventory up to date? - Are access control processes being applied? - Is technical vulnerability management being carried out? - Have backup and restore processes been evaluated? - Has information security incident management been defined? - Have supplier security risks been assessed? - Have personnel awareness activities been carried out? - Are monitoring and measurement results available? - Has an internal audit been carried out? - Has a management review been held? - Are nonconformities and corrective actions being tracked? - Has the accreditation scope of the certification body been verified? This checklist is for preparation purposes and does not replace all of the requirements of the standard. #### Frequently Asked Questions (FAQ) #### \1. What is ISO 27001? ISO/IEC 27001 is the international standard that defines the requirements for establishing, implementing, maintaining and improving an information security management system. #### \2. What is an ISO 27001 certificate for? It provides an independent assessment of an organisation's conformity with the information security management system requirements within a defined scope. #### \3. Is it mandatory to obtain an ISO 27001 certificate? There is no general obligation for all organisations. However, it may arise as a requirement in certain sectors, regulations, tenders or contracts. #### \4. How many controls does ISO 27001:2022 contain? The Annex A section of ISO/IEC 27001:2022 contains 93 reference security controls. #### \5. Must all ISO 27001 controls be implemented? Controls are determined according to the risk assessment and the relevant requirements. Any Annex A controls that are excluded must be explained in the SoA with appropriate justifications. #### \6. What is an ISMS? ISMS stands for Information Security Management System. It enables the systematic management of corporate information security risks. #### \7. How is an ISO 27001 risk analysis performed? Risk criteria are defined, risks are identified, analysed and evaluated, and appropriate risk treatment decisions are made. #### \8. What is the SoA? The Statement of Applicability is the document that shows the necessary controls, the justifications for selecting them, their implementation status and the justifications for excluding Annex A controls. #### \9. What is the difference between ISO 27001 and ISO 27002? ISO/IEC 27001 defines the management system requirements. ISO/IEC 27002 provides implementation guidance on information security controls. #### \10. How many years is an ISO 27001 certificate valid? In common accredited certification programmes, a three-year certification cycle applies. Surveillance and other certification conditions must be met. #### \11. How long does ISO 27001 certification take? The duration varies according to the organisation's size, scope, current maturity and deficiencies. #### \12. Is penetration testing mandatory for ISO 27001? There is no general requirement for a fixed annual penetration test for every organisation. The need for testing is determined within the scope of risks and applicable obligations. #### \13. Is a SOC mandatory for ISO 27001? No. There is no 24/7 SOC requirement for every organisation. Security monitoring needs should be determined through the risk assessment. #### \14. Does ISO 27001 guarantee KVKK compliance? No. ISO/IEC 27001 supports information security management; the legal obligations under KVKK must be assessed separately. #### \15. Why is TÜRKAK accreditation important? It provides assurance regarding the independent assessment of a certification body's competence within the relevant scope. #### \16. Who can carry out an ISO 27001 internal audit? It can be carried out by people who have the appropriate competence and who can ensure the impartiality of the audit. #### \17. Does an ISO 27001 certificate prevent cyber attacks? Not on its own. The standard supports the systematic management of information security risks and the implementation of appropriate controls. #### \18. Are ISO 27001 consulting and certification the same thing? No. Consulting supports the establishment and improvement of the ISMS. Certification, on the other hand, is an independent conformity assessment. ### Conclusion: ISO/IEC 27001 Is More Than a Certificate ISO/IEC 27001 is an important international standard that enables information security to be managed at the corporate level. However, the real value of the standard does not emerge only during the certification process. Identifying information assets, assessing risks, implementing security controls and measuring the results regularly all contribute to developing corporate resilience. An effective ISMS requires the involvement of top management. Risk assessments must be kept up to date. The SoA must be consistent with actual control implementations. Technical security measures must be verified. Internal audit and management review processes must be operated effectively. Nonconformities must be remedied and improvement activities must be followed up. **The core purpose of ISO/IEC 27001 is not merely to obtain a certificate, but to build an organisation that can manage information security risks continually and measurably.** SECURESYS supports organisations in improving their security maturity through an approach that evaluates information security management and technical cyber security work together.