ISO 27001 (Information Security Management System)

What Is ISO 27001?

ISO/IEC 27001 (current version: ISO 27001:2022, published October 2022) is the global standard for Information Security Management Systems (ISMS). Published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it specifies requirements for establishing, implementing, maintaining, and continually improving an ISMS within the context of the organisation.

Unlike a technical checklist, ISO 27001 is a management system standard — meaning it integrates information security into organisational governance, risk management, and business processes rather than treating it as purely an IT matter.

Structure: The High-Level Structure (HLS)

ISO 27001:2022 follows the standard Annex SL High-Level Structure used by all modern ISO management system standards (also ISO 9001, ISO 14001, ISO 22301). This makes integration with other management systems straightforward. The main clauses are:

• Clause 4: Context of the organisation
• Clause 5: Leadership and commitment
• Clause 6: Planning (risk assessment and treatment)
• Clause 7: Support (resources, competence, awareness, communication, documented information)
• Clause 8: Operation (implementing risk treatment plans, controls)
• Clause 9: Performance evaluation (monitoring, internal audit, management review)
• Clause 10: Improvement (nonconformities, corrective action, continual improvement)

Annex A Controls

ISO 27001:2022 references Annex A, which lists 93 information security controls organised into four themes (updated from the previous 14-domain structure):

1. Organisational controls (37 controls) — policies, roles, responsibilities, asset management, supplier relationships
2. People controls (8 controls) — screening, terms of employment, training, disciplinary process
3. Physical controls (14 controls) — physical security perimeters, clear desk, secure disposal
4. Technological controls (34 controls) — access control, cryptography, network security, vulnerability management, monitoring

New controls in the 2022 revision include threat intelligence, cloud security, data masking, and ICT readiness for business continuity.

The Certification Process

ISO 27001 certification is awarded by accredited certification bodies (in Spain, ENAC-accredited bodies such as AENOR, Bureau Veritas, TÜV, BSI). The process typically follows these stages:

1. Gap analysis — benchmark current state against ISO 27001 requirements
2. ISMS design and implementation — define scope, conduct risk assessment, select controls, write policies and procedures
3. Statement of Applicability (SoA) — document which Annex A controls are applicable and why
4. Internal audit — verify implementation before external audit
5. Stage 1 audit (documentation review) — certification body reviews ISMS documentation
6. Stage 2 audit (implementation review) — on-site verification of implementation
7. Certification issued — valid for three years, with annual surveillance audits

For a medium-sized Spanish company, the process typically takes 6–12 months from initial gap analysis to certification.

ISO 27001 and Regulatory Compliance

ISO 27001 certification provides significant leverage in meeting regulatory obligations:

• GDPR/LOPD-GDD: ISO 27001’s technical and organisational measures (TOMs) directly satisfy Article 32 GDPR requirements. The AEPD recognises ISO 27001 as evidence of appropriate security measures.
• NIS2: ISO 27001 addresses many of NIS2’s mandatory risk management measures. NIS2 explicitly recognises use of European and international standards, and ISO 27001 is the most cited reference.
• DORA: For financial entities, ISO 27001 supports the ICT risk management framework requirements, though DORA has additional sector-specific requirements beyond what ISO 27001 alone covers.
• ENS (Esquema Nacional de Seguridad): Spain’s National Security Framework for public sector entities is closely aligned with ISO 27001 and many controls overlap.

Business Benefits Beyond Compliance

Beyond regulatory compliance, ISO 27001 certification delivers tangible commercial value:

• Required or strongly preferred by enterprise clients and public procurement frameworks
• Reduces cyber insurance premiums in many cases
• Provides a structured approach to supply chain security assessments
• Demonstrates security maturity to investors during M&A due diligence

How BMC Can Help

We guide organisations through the full ISO 27001 implementation journey — from initial gap analysis and scope definition through risk assessment methodology, control selection, policy drafting, internal audit preparation, and certification body coordination. We also help companies understand how ISO 27001 intersects with their GDPR and NIS2 obligations.