ISO/IEC 27001 · Information security
It requires assessing and treating information security risks and declaring the applicability of the Annex A controls.
- Sectors
- Technology · Financial services · Telecommunications
- Edition
- ISO/IEC 27001:2022
We use cookies needed for the site to work and, if you accept, others to measure use and improve our communications. You can change your choice at any time. See the details
It requires a service management system that plans, delivers and improves the IT services agreed with the customer.

Accredited scope published in the Trust Center · 30-06-2026
Initial certification follows these steps.
What you are asked for, what activities you carry out, and at which sites and in which country you operate.
In writing, sized to the standard, the activities, the sites and the country.
The assigned team assesses the documentation and the operation with evidence.
A function separate from the audit team decides. The certificate can be checked by its code.
Continuity of the cycle is agreed for your case.
Issuance depends on the audit and an independent decision.
There is no list price: the proposal is sized on standard, scope, sites, headcount, activities, system complexity and delivery mode. The request is reviewed first and the proposal is then issued.
Findings are documented and classified. The organization submits correction, root cause and corrective action with evidence; the audit team evaluates it and only then does the file go to decision.
A competent function separate from the audit team. Those who audit do not decide, and no outcome is anticipated before that review.
In the public certificate register, by code.
It requires assessing and treating information security risks and declaring the applicability of the Annex A controls.
It requires analysing the impact of a disruption, defining continuity strategies and testing them through exercises.
It requires governing how the organization develops, provides or uses artificial intelligence, with assessed risks, Annex A controls and human oversight.

The proposal arrives in writing, with the standard, the scope and the timeline.