ISO 27001: running your ISMS, from the statement of applicability to the internal audit
ISO/IEC 27001 is the international standard that sets out the requirements for an information security management system (ISMS). Its 2022 version comes with an Annex A of 93 security controls, grouped into four themes.
See ISO 27001 in CompliKeyBy Alexandre Vivier, ISO 27001 Lead Implementer · Updated on 10 October 2026
The ISMS, in seven clauses
The standard's requirements concern the management system itself: understanding its context, assessing and treating risks, managing, checking and improving.
- 4Context of the organisation and scope of the ISMS
- 5Leadership and security policy
- 6Planning: risk assessment and treatment
- 7Support: resources, competence, documentation
- 8Operation
- 9Performance evaluation: internal audit, management review
- 10Continual improvement
The 93 Annex A controls
Organisational · 37 controls
Policies, roles, suppliers, incident management, continuity.
People · 8 controls
Screening, awareness and training, remote working.
Physical · 14 controls
Security perimeters, physical access control, equipment.
Technological · 34 controls
Privileged access, cryptography, logging, networks, development.
Applicable controls are selected according to the risk assessment. The statement of applicability (SoA) justifies each inclusion and each exclusion: it is the central document presented to the auditor.
Mappings to other frameworks
In CompliKey, a control assessed for ISO 27001 can cover requirements of other frameworks; every mapping is traced, with no coverage claimed by default.
| Framework | Link with ISO 27001 | Page |
|---|---|---|
| NIS2 | Largely shared risk management measures | View NIS2 |
| CyFun NIS2 | In Belgium, an ISO 27001 certification accepted by the CCB gives a presumption of conformity | View CyFun NIS2 |
| ReCyF NIS2 | Many shared controls, reused in CompliKey (page in French) | View ReCyF NIS2 |
ISO 27001 in CompliKey
- 1Define the ISMS scope and activate the framework: controls already assessed for another framework are carried over.
- 2Audit on evidence (clause 9.2): each control receives a score from 0 to 4, findings are qualified in auditors’ vocabulary.
- 3Publish the justified, versioned statement of applicability, and export the audit report to PDF to prepare for certification.
ISO 27001: frequently asked questions
Does CompliKey issue ISO 27001 certification?
No. CompliKey helps you build and run your ISMS, carry out your internal audit and produce your statement of applicability; certification is issued by an accredited body.
Do all 93 Annex A controls have to be applied?
No. Controls are selected according to your risk assessment; each inclusion and each exclusion is justified in the statement of applicability.
Does ISO 27001 help with NIS2?
Yes. The measures overlap widely, and in Belgium an ISO 27001 certification whose scope and statement of applicability are accepted by the CCB gives a presumption of conformity with the NIS2 law.
What about ISO 27701?
ISO 27701 extends security management to privacy protection. It is available in the Advanced plan, together with ISO 27001.
See ISO 27001 in CompliKey
A demo of the statement of applicability and the internal audit, on a sample scope.