ISO 27001
ISO/IEC 27001:2022 — Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Published by ISO, jointly with IEC (International Electrotechnical Commission) · ISO/IEC 27001:2022 (third edition)
Requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS) — a risk-managed approach to preserving the confidentiality, integrity, and availability of information.
How it’s structured
- Management-system requirement clauses covering context, leadership, planning, support, operation, evaluation, and improvement of the ISMS
- Annex A: 93 reference controls organized into 4 themes — organizational, people, physical, and technological
Who it applies to
Any organization, of any size and from any sector, that wants to establish, certify, or maintain an ISMS.
How Pentforge uses it in an engagement
- Gap analysis against the Annex A control themes and the ISMS management clauses
- Control mapping and an evidence pack designed for ISO 27001 readiness — preparation support, not certification
- Internal-audit-style review ahead of a client's own certification audit
What you get
- A gap register mapped to the Annex A control themes
- An evidence pack organized for an external certification auditor
- A prioritized remediation plan with owners
Official source
Pentforge does not issue certificates
We assess against ISO 27001 — that is a statement about the work, not a certification. Pentforge holds no certifications of its own; the credentials our practitioners hold individually are listed on About.
Request a scoping call