ISO/IEC 27001:2022

Says in plain words which parts of the business, which locations and which systems your security programme covers — and what is deliberately outside it.

The top-level statement of what the company commits to on security, signed by whoever is actually accountable.

Names who owns security decisions, who runs day-to-day security work, and which duties must not sit with the same person.

Explains how you find security risks, how you score them, and how you decide what to do about each one — so two people assessing the same risk land in the same place.

Lists every Annex A control, whether you apply it, and why — the single page auditors open first.

The working list of what you are actually going to do about each accepted risk, who owns it and by when.

The handful of security outcomes you are aiming at this year and how you will tell whether you hit them.

How security documents get written, approved, versioned and retired, and where the current copy lives.

What security training each group of staff gets, how often, and how you know they did it.

Who you tell what, and when — internally, and to regulators, customers and industry contacts.

How you check your own security controls before the certification body does, and the schedule for doing it.

What leadership looks at when they review security, how often, and what has to come out of the meeting.

What happens when something is found to be wrong: how it gets recorded, fixed at the root, and closed out.

How you keep track of the information and equipment you hold, who owns each item, how sensitive it is and how it is labelled.

The rules staff actually read: what you may do with company laptops, accounts and data, and what you may not.

Who gets access to what, how accounts are created and removed, and how admin rights are kept rare and reviewed.

How you check a supplier before you sign, what security terms go into the contract, and how you keep an eye on them afterwards.

What anyone should do when something looks wrong, who decides it is an incident, and how it gets handled and closed.

How the business keeps running, and how systems come back, when something significant breaks.

What gets backed up, how often, where copies live, and how you know a restore actually works.

The security parts of hiring, employment and leaving: checks before someone starts, what their contract says, and what happens on the last day.

The rules for working away from the office — home, travel, customer sites — and how company kit and data are protected there.

How your premises are protected: who gets in, how visitors are handled, and how equipment and utilities are looked after.

Where encryption is required, which algorithms are acceptable, and how keys are generated, stored and rotated.

How your networks are segmented and defended, and the rules for sending information in and out of the company.

How security gets built into software you write: design rules, coding standards, testing, and keeping environments apart.

How changes to systems get proposed, reviewed, tested and released, and who can approve an emergency one.

The baseline settings your systems are built to, and the written procedures for the operational tasks people repeat.

How you learn about new threats and weaknesses, how fast you patch them, and what protects your machines in the meantime.

What gets logged, how long logs are kept, who watches them, and what triggers a look.

How long you keep each kind of information, who decides, and how personal and sensitive data is protected and deleted.

The list of laws, regulations and contract clauses that bind your security, and who checks you still meet them.