What is ISO 27001?
ISO/IEC 27001 is the international standard that sets out the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS), through which an organisation protects the confidentiality, integrity and availability of its information on a risk basis. It is published jointly by ISO and IEC (committee JTC 1/SC 27) and is the core standard in the ISO 27000 family against which organisations are certified; most other parts, such as ISO 27002 and ISO 27005, are guidance. The current version is ISO/IEC 27001:2022, adopted in Europe and the Netherlands as EN ISO/IEC 27001:2023. It covers all information, whether digital, on paper or spoken, in both IT and OT environments.
🎯 What is the purpose of ISO 27001?
ISO 27001 does not prescribe a fixed set of technical measures but a management system. The organisation itself determines which risks apply and which controls are needed. The main goals are:
- Managing risk - systematically identifying, assessing and treating information security risks through a risk assessment
- Implementing appropriate controls - measures against cyber threats, human error and data breaches
- Protecting sensitive data - such as customer information, intellectual property, recipes and production data
- Supporting compliance - an ISMS helps you demonstrate that you meet legislation such as the AVG (the Dutch name for the GDPR) and NIS2, although the certificate itself does not grant any legal exemption
- Building trust - an accredited certificate gives customers and supply-chain partners independent assurance
📚 How is ISO 27001 structured?
ISO 27001 follows the Harmonized Structure shared by all ISO management system standards, such as ISO 9001 and ISO 22301, which makes it easy to integrate several systems. Clauses 0 to 3 are introductory; the requirements sit in clauses 4 to 10, which together form the PDCA cycle.
| Clause | Subject | Core requirements | PDCA |
|---|---|---|---|
| 4 | Context of the organisation | Internal and external issues, interested parties, scope of the ISMS | Plan |
| 5 | Leadership | Top management commitment, information security policy, roles and responsibilities | Plan |
| 6 | Planning | Risk assessment, risk treatment, Statement of Applicability, objectives | Plan |
| 7 | Support | Resources, competence, awareness, communication, documented information | Do |
| 8 | Operation | Performing risk assessment and treatment, controlling changes | Do |
| 9 | Performance evaluation | Monitoring and measurement, internal audit, management review | Check |
| 10 | Improvement | Nonconformities, corrective action, continual improvement | Act |
The standard also contains Annex A: a reference list of 93 controls. The Statement of Applicability (SoA) records for each control whether it applies, why, and whether it has been implemented. You may exclude a control, provided you justify it. Detailed guidance per control is given in the companion standard ISO 27002.
🔒 Which controls are in Annex A?
In the 2022 version the controls are grouped into four themes, replacing the fourteen domains of 2013 (which held 114 controls):
| Theme | Annex A | Number | Examples |
|---|---|---|---|
| Organisational | A.5 | 37 | Policies, threat intelligence, supplier relationships, incident management, ICT readiness for business continuity |
| People | A.6 | 8 | Screening, awareness and training, confidentiality, remote working |
| Physical | A.7 | 14 | Physical entry, security monitoring, equipment, storage media |
| Technological | A.8 | 34 | Access control, backup, logging, network security, cryptography, secure coding |
Eleven controls are new in 2022, including threat intelligence (A.5.7), information security for use of cloud services (A.5.23), ICT readiness for business continuity (A.5.30), configuration management (A.8.9), data leakage prevention (A.8.12), monitoring activities (A.8.16) and secure coding (A.8.28). Other well-known topics are security awareness, incident response, recovery and supplier security.
🕰️ Which versions exist and what changed recently?
ISO 27001 grew out of the British standard BS 7799 from 1995. The first ISO/IEC edition appeared in October 2005, followed by revisions in 2013 and 2022.
- 25 October 2022 - publication of ISO/IEC 27001:2022; the clauses changed only slightly, while Annex A was fully realigned with ISO 27002:2022 (February 2022)
- February 2024 - Amendment 1 (Climate action changes): clause 4.1 now requires you to determine whether climate change is a relevant issue, and clause 4.2 notes that interested parties can have climate-related requirements
- 1 May 2024 - no more initial or recertification audits against the 2013 version
- 31 October 2025 - end of the 36-month transition period; accredited certificates against ISO 27001:2013 have not been valid since
An organisation that missed the transition has to go through a full initial certification again.
🎓 How does ISO 27001 certification work?
Certification is carried out by an independent certification body. In the Netherlands these bodies are accredited by the Dutch Accreditation Council (Raad voor Accreditatie, RvA), based on ISO/IEC 17021-1 and the ISMS-specific supplement ISO/IEC 27006. A certificate from a non-accredited body carries limited weight in tenders.
| Phase | What happens? | When |
|---|---|---|
| Stage 1 audit | Documentation, scope, risk assessment and SoA are reviewed for readiness | Before certification |
| Stage 2 audit | Assessment of whether the ISMS works in practice and is demonstrably effective | A few weeks after stage 1 |
| Certification decision | Certificate issued once any nonconformities are resolved | After stage 2 |
| Surveillance audits | Sample-based review of the ISMS | Annually (years 1 and 2) |
| Recertification | Full reassessment | Every 3 years |
🔧 How do you implement ISO 27001 in an OT environment?
ISO 27001 was designed from an IT and office-information perspective, but its scope can include production facilities. In OT you will run into its limits:
- Availability and safety come first - the standard sets no fixed order of priority between confidentiality, integrity and availability, whereas in OT process availability and physical safety take priority
- Generic controls - Annex A has no zones and conduits, security levels or requirements for PLCs and SCADA systems
- Patching and scanning - controls such as regular patching or vulnerability scans cannot always be applied in OT without downtime
That is why many industrial organisations combine ISO 27001 with IEC 62443. The ISMS provides the organisational framework; IEC 62443 provides the OT-specific detail, including the zones and conduits model. The second edition of IEC 62443-2-1 (August 2024) is explicitly designed for this: it describes the asset owner’s security programme in six security program elements, drops requirements that an ISMS already covers and is intended to be used alongside an ISMS, typically based on ISO 27001. For energy utilities, ISO/IEC 27019:2024 adds controls for process control systems.
A practical six-step approach:
- Include OT explicitly in the scope - name the sites, installations and the boundary with IT, for example using the Purdue Model
- Build an asset inventory - from MES and ERP interfaces to SCADA, PLCs and IIoT devices
- Assess risks with OT impact - include process disruption, environment and safety in the risk method, for example with ISO 27005 and IEC 62443-3-2
- Translate Annex A to OT - record network segmentation, controlled remote access and patch management with compensating controls in the SoA
- Involve operations - make process owners co-owners of risks and changes
- Review and improve - include OT in internal audits and management reviews
🔄 How does ISO 27001 relate to BIO, NIS2 and the NIST CSF?
- ISO 27002 - the code of practice with guidance and attributes per control; not certifiable
- BIO - the Dutch government’s information security baseline. BIO2 was adopted on 23 September 2025; part 1 follows the structure of NEN-EN-ISO/IEC 27001:2023 and part 2 that of ISO 27002:2022
- NIS2 and the Dutch Cybersecurity Act - the Dutch law entered into force on 15 August 2026 and requires a risk-based duty of care and incident reporting within 24 hours. An ISO 27001 ISMS covers much of the duty of care, but is not an automatic exemption
- NIST CSF - the US framework; version 2.0 (February 2024) has the functions Govern, Identify, Protect, Detect, Respond and Recover. ISO 27002 uses Identify to Recover as an attribute (‘cybersecurity concepts’), which makes the two easy to map
Taken together, ISO 27001 acts as the backbone of broader risk management and cybersecurity governance, onto which sector rules and OT standards are layered.
❓ Frequently asked questions
Is ISO 27001 mandatory?
ISO 27001 is not a legal requirement in the Netherlands or the EU. However, customers, public-sector buyers and supply-chain partners often demand an ISO 27001 certificate. Organisations covered by the Dutch Cybersecurity Act widely use ISO 27001 as the framework to demonstrate their duty of care.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 contains the requirements for an ISMS and is the standard you are certified against. ISO 27002 is guidance that explains, for each Annex A control, how you can implement it. Certification against ISO 27002 is not possible.
How many controls does ISO 27001:2022 have?
ISO 27001:2022 contains 93 controls in Annex A, divided into four themes: 37 organisational, 8 people, 14 physical and 34 technological. The 2013 version had 114 controls in fourteen domains. Your Statement of Applicability determines which controls apply.
How long is an ISO 27001 certificate valid?
An ISO 27001 certificate is valid for three years. A surveillance audit follows in the first and second year, and a recertification audit after three years. Certificates against the 2013 version have not been valid since 31 October 2025.
Is ISO 27001 enough for OT security?
ISO 27001 on its own is usually not enough for OT security, because its controls are generic and do not account for process control and safety requirements. Industrial organisations therefore combine ISO 27001 with IEC 62443, which defines zones, conduits, security levels and component requirements.
Does ISO 27001 help with NIS2?
ISO 27001 helps a great deal with NIS2, because the risk assessment, policies, incident management and supplier management of an ISMS align with the duty of care in the Dutch Cybersecurity Act. A certificate is not an automatic exemption, however: the supervisor checks whether the scope and controls genuinely cover the critical services.
📌 In summary
ISO/IEC 27001 is the international, certifiable standard for an ISMS: a risk-based management system that protects information systematically and improves continually. The 2022 version has 93 controls in four themes and has been the only valid basis for certification since 31 October 2025. In OT environments ISO 27001 provides the organisational foundation, complemented by IEC 62443 for securing process control.