ISO/IEC 27001:2022 concerns an information security management system that manages confidentiality, integrity and availability risks. Certification is not a promise that every attack will fail.

01

Define information and operational boundaries

Describe services, processes, locations, people, information and technology in scope. Include interfaces to cloud providers and remote work. Outsourcing a platform does not remove responsibility for permissions, supplier arrangements or data handling. A certificate for one hosted service should not be presented as covering every product or company site.

02

Connect risk decisions to the Statement of Applicability

Use agreed assessment criteria to identify and evaluate risks, select treatment and assign owners. The Statement of Applicability explains necessary controls, implementation status and reasons for inclusion or exclusion against the reference set. Copying another organisation’s control list without considering your risks breaks the decision trail. Additional controls may be needed for your obligations and activity.

03

Test the boundaries with a practical case

In a hypothetical payroll service, identify who grants access, where files are stored, which supplier supports the system and who can recover data. If a leaver’s account remains active, link that risk to the access removal process and test evidence. A penetration test alone cannot demonstrate all the organisational, people and physical controls in an ISMS.

04

Application and independent authority

Submit scope, sites, staff, dependencies, risk assessment, treatment and control implementation status. ISO/IEC 27006-1 adds ISMS competence and impartiality requirements to the certification framework. ISO does not issue certificates; check the issuer and any claimed accreditation scope for this standard and activity. The applicant implements the system and prepares procedures specific to its own operations and operating records. A certification enquiry to Kayra concerns actual activities, sites, application information, authority and impartiality risks; this role does not include designing or implementing the client’s system. A management-system certification body, other parts of the same legal entity and controlled entities cannot offer or provide management-system consultancy; separate contracts do not remove this restriction.

Sources and application limits

The payroll example is hypothetical. The catalogue lists ISO/IEC 27001:2022 with a 2024 amendment; verify the actual certificate edition and status separately.