ISO 27001 compliance

ISO/IEC 27001 is the international standard for an information security management system (ISMS). It is voluntary: companies certify against it because customers ask for it, and it gives a ready structure for what NIS2 and DORA require.

What it requires

The main obligations in plain words, with the article or clause they come from.

  • Clause 4

    Set the scope of the management system from the organization's context and the needs of interested parties.

  • Clauses 5–6

    Leadership and an information security policy; a risk assessment and treatment process; security objectives.

  • Clause 6.1.3

    A Statement of Applicability: every Annex A control, whether it applies, why, and whether it is implemented.

  • Clauses 7–8

    Resources, competence, awareness and documented information; carry out the risk treatment plan.

  • Clauses 9–10

    Monitor and measure, run internal audits and management reviews, and correct nonconformities.

  • Annex A

    93 controls in four themes: organizational (37), people (8), physical (14) and technological (34).

How Atitic covers it

What the product does for this framework, on the same records as every other.

  • Clauses 4 to 10 and the 93 Annex A controls as requirements, linked to your policies, evidence and risks.

  • A control library based on Annex A with owners, test plans and results; a failed test shows on the requirements it supports.

  • The Statement of Applicability as PDF and Excel, built from your decisions; marking a control Not applicable needs a justification and an approver.

  • Internal audits, the management review and access reviews as recurring activities in the governance calendar; external auditors get access limited to their audit.

  • Crosswalks from ISO 27001 to NIS2, DORA, SOC 2, ISAE 3402, ISO 27005, the CRA, MiCA and HIPAA.

What the catalogue holds

The areas of the framework in Atitic and how many requirements each holds. When you adopt it, each requirement becomes a row you own and link to policies, evidence and controls.

  • 4 Context of the organization4
  • 5 Leadership3
  • 6 Planning5
  • 7 Support6
  • 8 Operation3
  • 9 Performance evaluation3
  • 10 Improvement2
  • A.5 Organizational controls (37)37
  • A.6 People controls (8)8
  • A.7 Physical controls (14)14
  • A.8 Technological controls (34)34

Related frameworks: ISO 27005 NIS2 DORA SOC 2 ISAE 3402

Common questions

Does Atitic certify us?

No. Certification is done by an accredited certification body. Atitic keeps the management system, the evidence and the Statement of Applicability in order, and gives the auditor access limited to their audit.

Which version does the catalogue follow?

ISO/IEC 27001:2022 with its Annex A of 93 controls. Certificates against the 2013 version had to move to the 2022 version by 31 October 2025.

Does the catalogue include the text of the standard?

No. ISO standards are copyrighted; the catalogue names each clause and control and describes it in its own words. The standard itself is sold by ISO and by national standards bodies.

A summary for orientation, not legal advice. The official text is the reference.

Try it on your own data

Adopt ISO 27001 in a free trial, link the evidence you already have and see what is still missing.

Start a free trial