ISO 27001 starts with risk.
The information security management system. The one your corporate customers ask for before signing a contract.
the SoA is the first thing the auditor opens- Information asset inventory and risk assessment
- Annex A: 93 controls in 4 themes (37 organizational, 8 people, 14 physical, 34 technological)
- Statement of Applicability: why each control applies or is excluded
- Identical Colombian adoption: NTC-ISO-IEC 27001:2022
Clauses 4 to 10 are the same across the four standards; this is what goes on top.
Where the standard stands today.
Status of the standard · October 2026
| Document | Status | What it means |
|---|---|---|
| ISO/IEC 27001:2022 | Current and certifiable | Current edition, with Annex A reorganized into 93 controls and 4 themes. |
| ISO/IEC 27002:2022 | Guidance | Explains how to implement each Annex A control; not certifiable. |
| NTC-ISO-IEC 27001:2022 | Colombian adoption | Identical national version, the one ICONTEC applies in Colombia. |
The right order: risk first
Field noteHalf of implementations fail because they start backwards: they download a policy template, fill it in, and only at the end ask what risks they have. An auditor spots it in ten minutes, because the controls cannot be justified against anything.
The real order is: identify your information assets, assess the risks on them, decide how to treat them, and only then choose which Annex A controls apply. Every applied or excluded control is backed by the Statement of Applicability, the document the auditor opens first.
The 93 controls, in four themes
The 2022 edition regrouped Annex A into four themes instead of fourteen domains: organizational (37 controls), people (8), physical (14) and technological (34). It also added attributes that let you filter controls by type, security property, cybersecurity concept or operational capability.
Not all of them apply to you, and that is the point: applying all 93 without justification is as suspicious as excluding half without an argument.
What makes an SoA auditable
A credible Statement of Applicability has, control by control: whether it applies or not, why, where it is implemented and which evidence verifies it. The suspicious ones say “applies” for all 93 without a single reference to a risk, or exclude controls with the words “not applicable” and nothing else.
What this work looks like inside.
Map your context
Processes, scope and whatever you already have written. Half-finished documents are reused, not discarded.
Measure the gap
Requirement by requirement of ISO/IEC 27001, with four states: compliant, in progress, gap, observation.
Draft and approve
Every document is born as a draft. A person approves it and the approval is recorded, as clause 7.5 requires.
Rehearse the audit
Stage 1 and Stage 2 rehearsals with findings written with criterion, evidence and statement, the way an auditor writes them.
The Ark of ISO's requirement catalogue uses its own curated interpretation of each clause. It never reproduces the literal text of the standard, which belongs to ISO and ICONTEC: to implement you need your licensed copy.
Frequently asked questions
Do I need ISO 27001 before ISO 27701?
How many controls do I have to implement?
Does it help answer customer security questionnaires?
Which evidence does an auditor ask for first?
Same base, different catalogue.
All four share clauses 4 to 10. You document the base once and each standard's catalogue goes on top.
Next on the route, on the same base: ISO 14001, ISO 45001, ISO 37001 and ISO 22301. Adding them does not mean rebuilding the system.
Ready to set sail?
The 2026 pilot onboards one company at a time. Leave your email and we will write when your seat opens.