ISO 27001 Basics Cheat Sheet
Introduces the ISO/IEC 27001 information security management system framework, its structure, Annex A controls, and certification process.
2 PagesIntermediateFeb 18, 2026
ISMS Fundamentals
Core concepts of an Information Security Management System under ISO 27001.
- ISMS- Information Security Management System; a systematic, risk-based approach to managing sensitive information
- Scope statement- Documented boundary of the ISMS, defining which systems, locations, and processes are covered
- Risk assessment- Identify assets, threats, vulnerabilities, and calculate risk levels to prioritize treatment
- Statement of Applicability (SoA)- Document listing which Annex A controls are applied or excluded, with justification
- PDCA cycle- Plan-Do-Check-Act; the continuous improvement cycle underlying the ISMS
Management Clauses (4-10)
The mandatory management system clauses of ISO 27001:2022.
- Clause 4: Context of the organization- Determine internal/external issues and interested parties relevant to the ISMS
- Clause 5: Leadership- Top management commitment, policy, and defined roles/responsibilities
- Clause 6: Planning- Risk assessment, risk treatment plan, and information security objectives
- Clause 7: Support- Resources, competence, awareness, communication, and documented information
- Clause 8: Operation- Operational planning and execution of risk treatment
- Clause 9: Performance evaluation- Monitoring, internal audits, and management review
- Clause 10: Improvement- Nonconformity handling and continual improvement
Annex A Control Themes (2022 revision)
The 93 Annex A controls are grouped into four themes.
- Organizational controls (37)- Policies, roles, supplier relationships, incident management processes
- People controls (8)- Screening, terms of employment, security awareness training, disciplinary process
- Physical controls (14)- Secure areas, equipment protection, clear desk/clear screen policy
- Technological controls (34)- Access control, cryptography, logging, malware protection, secure development
Sample Risk Register Entry
Structure of a risk register entry used to document risk assessments.
yaml
risk_id: RISK-014asset: customer-databasethreat: unauthorized access via leaked credentialsvulnerability: no MFA enforced on admin accountslikelihood: 3 # 1-5 scaleimpact: 5 # 1-5 scalerisk_score: 15 # likelihood x impacttreatment: mitigatecontrol_applied: "A.8.5 - Secure authentication (enforce MFA)"owner: security-teamreview_date: 2026-10-01residual_risk_score: 5
Certification Process Steps
Typical path an organization follows to achieve ISO 27001 certification.
- Gap analysis- Compare current controls against ISO 27001 requirements to find gaps
- Risk treatment implementation- Implement selected Annex A controls and document the SoA
- Internal audit- Conduct an independent internal audit of the ISMS before external audit
- Stage 1 audit- Certification body reviews documentation and readiness
- Stage 2 audit- Certification body verifies controls are implemented and operating effectively
- Surveillance audits- Annual audits over the 3-year certification cycle to maintain certification
New Controls Introduced in ISO 27001:2022
Eleven controls added in the 2022 Annex A revision that did not exist in the 2013 version.
- A.5.7 Threat intelligence- Collect and analyze information about emerging threats relevant to the organization
- A.5.23 Cloud services security- Processes for acquisition, use, management, and exit from cloud services
- A.5.30 ICT readiness for business continuity- Plan and test ICT continuity separately from general BC planning
- A.7.4 Physical security monitoring- Continuously monitor premises for unauthorized physical access
- A.8.9 Configuration management- Establish, document, and monitor secure configurations for hardware, software, and networks
- A.8.10 Information deletion- Delete information in systems, applications, and storage when no longer required
- A.8.11 Data masking- Limit exposure of sensitive data using masking, pseudonymization, or anonymization
- A.8.12 Data leakage prevention- Apply DLP measures across systems, networks, and endpoints handling sensitive data
- A.8.16 Monitoring activities- Monitor networks, systems, and applications for anomalous behavior
- A.8.23 Web filtering- Manage access to external websites to reduce exposure to malicious content
- A.8.28 Secure coding- Apply secure coding principles to software development
Statement of Applicability Excerpt
How SoA entries record applicability, implementation status, and justification for each Annex A control.
yaml
- control: "A.8.5" name: "Secure authentication" applicable: true implemented: true justification: "Required to reduce credential-based account takeover risk" evidence: "MFA policy doc, Okta config export"- control: "A.8.24" name: "Use of cryptography" applicable: true implemented: partial justification: "Encryption at rest done; key rotation policy in progress" target_date: "2026-09-30"- control: "A.7.4" name: "Physical security monitoring" applicable: false justification: "Fully cloud-hosted, no company-managed physical premises with information assets"
Audit Finding Classifications
How certification body auditors grade findings during Stage 2 and surveillance audits.
- Major nonconformity- A requirement is missing entirely, or a systemic failure affects the ISMS's ability to achieve its objectives; blocks certification
- Minor nonconformity- An isolated lapse in an otherwise implemented control (e.g., one missed log review); requires a corrective action plan but doesn't block certification
- Observation- A potential future nonconformity if left unaddressed; noted but not scored
- Opportunity for improvement (OFI)- Auditor suggestion for strengthening a control beyond minimum compliance
- Corrective action (Clause 10.1)- Root-cause analysis and remediation required for any nonconformity, with evidence tracked to closure
Risk Treatment Decision Record
Documenting which of the four ISO 27001 risk treatment options was chosen and why.
yaml
risk_id: RISK-021description: "Legacy FTP server exposes internal file share to the internet"treatment_option: mitigate # one of: mitigate | avoid | transfer | acceptrationale: > Migrating to SFTP with key-based auth eliminates the plaintext credential exposure without disrupting the vendor integration.alternative_considered: avoid # decommission FTP entirelyalternative_rejected_because: "Vendor integration has no SFTP fallback until Q4"approved_by: "CISO"approval_date: 2026-06-01residual_risk_accepted_by: "CISO"review_frequency: annual
Pro Tip
Treat the Statement of Applicability as a living document, not a one-time deliverable — review it whenever new systems, vendors, or risks are introduced, since auditors specifically check that the SoA reflects current reality, not the state at initial certification.
Was this cheat sheet helpful?
Explore Topics
#ISO27001Basics#ISO27001BasicsCheatSheet#Cybersecurity#Intermediate#ISMSFundamentals#ManagementClauses410#Annex#Control#Security#CheatSheet#SkillVeris
