What ISO 27001 is
ISO/IEC 27001 is the international standard for an Information Security Management System (ISMS) — a risk-based framework for managing information security across people, processes, and technology. The current version is ISO/IEC 27001:2022.
Crucially, it is a management system, not just a checklist of controls: you define a scope, assess your risks, select and apply controls to treat them, and continually improve.
The Annex A controls
The 2022 revision organizes 93 controls into four themes — Organizational (37), People (8), Physical (14), and Technological (34).
You do not apply all of them blindly; you select the controls relevant to your risks and record your choices in a Statement of Applicability (SoA).
How certification works
An accredited certification body audits you in two stages. Stage 1 reviews your documentation and readiness; Stage 2 verifies that your ISMS is actually implemented and effective.
Certification is valid for three years, with annual surveillance audits and a full recertification at year three.
Who it's for
Organizations that need to demonstrate credible security to customers, partners, or regulators — common in SaaS, financial services, healthcare, and any B2B vendor where security is a buying requirement.
How muVerity helps
We scope the ISMS, run the risk assessment, help implement and document the controls and SoA, run an internal audit, and support you through the certification audit.