ISO 27001 requirements are the mandatory parts of the standard that every certified organisation must meet. They sit in clauses 4 to 10. This plain-English summary covers each clause and the documented information auditors expect to see.
Clause 4 ISO 27001 Requirements: Context of the Organisation
Understand your organisation, the people with an interest in your information, and decide the scope of the ISMS.
Clause 5: Leadership
Top management must set the policy, assign roles and show commitment. This is why the project needs a named owner.
Clause 6: Planning
Define how you assess and treat risks, set security objectives and plan how to reach them. The Statement of Applicability comes from this clause.
Clauses 7 and 8: Support and Operation
Provide resources, competent people, awareness and communication, then run the risk assessment and treatment plan in practice.
Clauses 9 and 10: Evaluation and Improvement
Monitor and measure performance, run internal audits, hold management reviews, and correct problems. These clauses make the ISMS a cycle, not a one-off project.
Documented Information You Need
Auditors expect to see, among other things: the scope, the information security policy, the risk assessment process and results, the risk treatment plan, the Statement of Applicability, internal audit results and management review records.
To see where you stand against these, start with a ISO 27001:2022 gap assessment or read our guide to ISO 27001 compliance. Our ISO 27001 service can help you meet each requirement.
Meeting ISO 27001 requirements is mostly about doing the basics consistently and recording that you did. Read the ISO 27001 requirements next to your own risk assessment, not in isolation.
Frequently Asked Questions
What are the ISO 27001 requirements?
The mandatory clauses 4 to 10, covering context, leadership, planning, support, operation, performance evaluation and improvement.
Are the Annex A controls mandatory?
No. You select the controls that treat your risks, and record exclusions with reasons.
What documents are required?
Scope, policy, risk process and results, treatment plan, Statement of Applicability, internal audit and management review records, among others.
Do small businesses have to meet the same requirements?
Yes, though the scope and effort scale with the size and complexity of the organisation.