Context and scope
Issues, interested parties and boundaries. Amd 1:2024 adds climate change as a consideration.
Information security management
An ISO/IEC 27001 system that survives its second year.
We design, operate and internally audit an ISMS your own teams can sustain, then extend it to privacy and continuity when the business needs them.
- ISO/IEC 27001:2022 + Amd 1:2024
- ISO/IEC 27701:2025
- ISO 22301:2019
- Who it is for
- SaaS, cloud, financial and payment firms asked for certification
- Standards
- ISO/IEC 27001:2022 (+ Amd 1:2024), 27701:2025, ISO 22301:2019
- Our role
- Advisory, implementation support and internal audit
- The outcome
- Certification at the first attempt, and clean surveillance audits after it
The challenge
A certificate can be bought. A management system cannot.
ISO/IEC 27001 does not certify that you are secure. It certifies that you run a system that decides how to treat risk, and that those decisions are still being carried out.
Template risk registers and paper management reviews pass Stage 2, then fail at surveillance. We design for the second year, not the first certificate.
- Annex A controls in four themes
- 93 controls
- Controls new in the 2022 edition
- 11 new
- Certification cycle, with annual surveillance
- 3 years
Outcomes
What a well-built ISMS gives you.
01
A defensible scope
Products, locations and cloud accounts customers can understand.
02
Risk decisions with owners
Treatments executives actually made and can explain.
03
A meaningful SoA
Every Annex A decision traced to a risk or obligation.
04
Evidence that keeps flowing
Surveillance tests a running system, not a project archive.
The requirement
Clauses 4 to 10: the system around the controls.
Certification bodies raise many nonconformities here, not in Annex A.
Leadership
Leaders set policy, assign roles and resource the ISMS, with evidence of real decisions.
Risk and planning
A repeatable risk method, a treatment plan, an SoA, measurable objectives and planned changes.
Support and operation
Competence, controlled documents, and a treatment plan actually being executed.
Audit and review
Impartial internal audits and management reviews that contain decisions.
Improvement
Root-cause analysis and verified corrective action, not symptom fixes.
Annex A explorer
All 93 controls, and what auditors expect.
Filter by theme, show the eleven new controls or search, then select a control.
Control titles follow ISO/IEC 27001:2022 Annex A. Guidance notes are our summary, not text from the standard.
Related standards
Extend to privacy and continuity.
Same management-system structure: one governance, internal audit and management review.
Privacy information management
Now a standalone privacy management system, certifiable without ISO/IEC 27001, though most integrate the two.
- Controller and processor roles per activity
- Privacy impact assessment and data-subject requests
- Transition from the 2019 edition
Business continuity management
Know which activities matter, how fast they must recover and what they depend on, then prove it through exercises.
- Business impact analysis, RTO and RPO
- Exercises from tabletop to technical failover
- Alignment with DORA resilience testing
Our approach
Five phases, built for the second year.
Each phase ends with an artifact your team owns.
- Discover
Context & scope
Service and data-flow mapping; a boundary customers recognize.
- Assess
Gap & risk
Clause and control gaps; a risk method your people can repeat.
- Remediate
Implement
Proportionate policies, owners, an SoA and an evidence calendar.
- Validate
Internal audit
Impartial audit and management review before Stage 1.
- Sustain
Surveillance
Rolling audit program and support through recertification.
The auditor’s real question: show me how you decided, and that it is still true today.
Deliverables
Proportionate, not padded.
A twenty-person SaaS company and a multinational bank should not have the same policy library.
Scope and context statement
Boundaries, interfaces and interested-party requirements.
Risk methodology and register
Criteria, thresholds and named risk owners.
Statement of Applicability
All 93 controls with status and justification.
Policy and procedure set
Sized to you, written for the people who follow it.
Internal audit program
Full scope across the cycle, by independent auditors.
Certification readiness report
Stage 1 and Stage 2 readiness and open actions.
Accreditation & scope
From gap assessment to certificate
What MarkTillson delivers
- Gap assessment, ISMS design and implementation support
- Risk assessment facilitation and SoA development
- Internal audit, performed by a separate team from the one that built the system
- Support through Stage 1, Stage 2, surveillance and recertification
What completes certification
- The ISO/IEC 27001 certificate, issued by an accredited certification body (UKAS, ANAB or equivalent) that your customers recognize
- We help you select that body and prepare the RFP
Framework mapping
The most reusable foundation.
Build the ISMS once and reuse it widely. Each framework keeps its own scope, evidence and reporting.
| Control area | SOC 2 (TSC) | PCI DSS v4.0.1 | NIST CSF 2.0 | DORA |
|---|---|---|---|---|
| Governance, policy and roles (5.1–5.4) | Directly addressed | Directly addressed | Directly addressed | Directly addressed |
| Risk assessment and treatment (Clause 6) | Directly addressed | Partially addressed | Directly addressed | Directly addressed |
| Supplier and ICT supply chain (5.19–5.23) | Directly addressed | Partially addressed | Directly addressed | Partially addressed |
| Identity and access (5.15–5.18, 8.2–8.5) | Directly addressed | Directly addressed | Directly addressed | Partially addressed |
| Incident management (5.24–5.28) | Directly addressed | Directly addressed | Directly addressed | Partially addressed |
| Continuity and ICT readiness (5.29–5.30) | Partially addressed | Not addressed– | Directly addressed | Partially addressed |
Directly addressed Partially addressed or different evidence expectations , Not a primary objective. Each certificate or report is still earned on its own terms.
Industry considerations
Same standard, different pressures.
Requested in procurement, often with SOC 2. The key choices: which products are in scope, and how infrastructure as code evidences configuration (8.9) and cloud responsibilities (5.23).
The backbone that DORA, PCI DSS and supervisory expectations hang from. Supplier controls must reconcile with the DORA register of information.
Pair the ISMS with ISO/IEC 27701 for privacy. US customers may still ask for HITRUST.
Design the ISMS to feed national schemes such as FedRAMP and NIST SP 800-53, where MarkTillson prepares cloud providers for authorization.
Technical use cases
Where 2022 controls meet modern infrastructure.
Infrastructure as code as evidence
Versioned baselines with drift detection, when the pipeline itself is controlled.
Cloud across its lifecycle
Acquisition, shared responsibility and how you would exit.
Leakage paths, including AI tools
Email, endpoints, SaaS sharing and generative-AI prompts.
Detecting anomalous behavior
Baselines, triage and escalation, beyond log collection.
Engagement journey
The certification cycle, step by step.
Select a stage to see what happens and how we support you.
FAQs
Questions we are asked.
Who issues the certificate?
An accredited certification body. We build the system, run the internal audit and stay beside you through Stage 1, Stage 2 and every surveillance visit.
How long does certification take?
The constraint is operating evidence, not documents: risk treatment under way, an internal audit and a management review before Stage 2. You receive a dated plan once the gap assessment is complete.
Must all 93 Annex A controls apply?
No. Your SoA must consider each one and justify inclusion or exclusion. Exclusions without a defensible rationale are a common nonconformity.
Is our 2013-edition certificate still valid?
No. The transition to the 2022 edition ended on 31 October 2025. We run focused gap assessments against the 2022 requirements and prepare you for recertification quickly.
Will ISO/IEC 27001 satisfy customers asking for SOC 2?
Sometimes. One control set can support both, but the reports, scope and periods differ, so many buyers ask for each.
ISO/IEC 27001
Plan an ISMS your teams will keep running.
Tell us your target date, your scope and who is asking. A senior practitioner will set out the route, the timeline and the effort involved.