The Compliance Atlas·Volume III
Volume III · ISO/IEC 27001:2022 · Edition 2026.1

The Compliance Atlas

Authoritative refs
ISO/IEC 27001:2022 · 27002:2022
ISO/IEC 17021-1 · ISO 19011
Verified May 12, 2026

ISO 27001 is the only framework in the Atlas that issues a certificate — a binary outcome from an accredited body operating to its own ISO standard. Most teams treat ISO 27001 as "Annex A controls plus paperwork." The certification body sees the inverse: a management system whose Annex A is merely the toolkit.

Reading the Atlas

Internal — ISMS operation External — certification body Bridge / hand-off

The CB is itself accredited under ISO/IEC 17021-1 by a national body (UKAS, ANAB, RvA). The discipline runs three years deep: Stage 1 + Stage 2, then surveillance years 1 and 2, then recertification at year 3.

I.
Layer 01 — Lifecycle

The three-year certification cycle

ISO/IEC 17021-1
certification audit reqs

Stage 1, Stage 2, surveillance — the certification body's clock

3-YEAR CERTIFICATION CYCLE → Pre-cert — readiness Stage 1 audit Stage 2 audit Year 1 — surveillance Year 2 — surveillance Year 3 — recertification Cycle restarts INTERNAL — ISMS OWNERS EXTERNAL — CERTIFICATION BODY (CB) Define ISMS scope Cl. 4.3 organization · interfaces Risk assessment + treatment plan Cl. 6.1.2 · 6.1.3 Statement of Applicability Cl. 6.1.3(d) · the SoA Implement controls selected via SoA Cl. 8 · operation Internal audit Cl. 9.2 · pre-Stage 2 qualified, independent Mgmt review Cl. 9.3 documented decisions ISMS operation continues SoA refreshed annually improvement Cl. 10 CB selection accredited under 17021-1 UKAS · ANAB · RvA NC remediation post Stage 1 findings major / minor / OFI Documented info policies · records Cl. 7.5 throughout Evidence collection continuous objective evidence per Cl. CAPA on findings root cause + correction Cl. 10.2 Surveillance prep ~1/3 ISMS scope tested CB rotates emphasis Recert prep · year 3 full scope re-examined like Stage 2 scaled-down Application review contract · audit days 17021-1 mandays formula Stage 1 audit documentation review readiness assessment Stage 2 audit implementation review on-site or remote Certificate issued 3-year validity if no major NCs Surveillance #1 ~12 mo from Stage 2 partial scope Surveillance #2 ~24 mo from Stage 2 different rotation Recert audit scope re-issued or cycle ends ~33mo from cert · 3-yr clock Audit team selection competent · independent 17021-1 §7 Stage 1 report readiness opinion go/no-go for Stage 2 Findings raised major · minor · OFI closure SLA per CB Cert decision CB tech-review panel independent of audit team Mandatory clauses always tested at S/V Cl. 9 + 10 + chgs to ISMS Cert maintenance no major NC = stays valid susp/withdrawal otherwise Special audits on complaint · breach · scope chg extraordinary reviews CB OPERATES UNDER ITS OWN AUDIT Accreditation body audits the CB; ISO 19011 governs audit principles SoA — primary document audited internal audit reports CB reviews effectiveness NC closure required pre-Stage 2 mgmt review → S/V scope rotation solid · primary procedure dashed · follow-on / parallel

Findings — Major NC, Minor NC, Observation, OFI

SEVERITY · BLOCKING Major NC absence or total failure of a requirement — No internal audit performed before Stage 2 — SoA does not exist or is unsigned — No risk assessment in last cycle — Repeat finding from prior surveillance — Multiple minor NCs in same area = major CONSEQUENCE Certification withheld until corrective action verified — usually special audit SEVERITY · CONDITIONAL Minor NC isolated lapse · doesn't break the system — One missing access review record — Risk treatment plan slightly incomplete — A control implemented but undocumented — Single training record absent — Late management review CONSEQUENCE Cert proceeds. Closure plan required in agreed time (90d typical) SEVERITY · ADVISORY Observation trending issue · not yet a NC — Process at risk of becoming non-conforming — Pattern of small lapses across area — Marginal evidence, not yet failing — Auditor flags for attention — Often turns into minor NC next year CONSEQUENCE Cert unaffected. Address before next surveillance to avoid escalation. SEVERITY · IMPROVEMENT OFI opportunity for improvement — Auditor's suggestion, not requirement — "Consider tightening this metric" — "More automation could reduce risk" — Voluntary; demonstrates audit value-add CONSEQUENCE None. But ignoring repeated OFIs may surface as minor NC eventually. Different CBs use slightly different thresholds for "major." When in doubt, ask the auditor to articulate the requirement they consider violated.

What ISO 27001 actually rewards

The audit is of the management system, not the controls. Most teams think ISO 27001 means "implement Annex A's 93 controls." Wrong question. The CB audits whether your ISMS — your governance, risk management, internal audit, management review, and continual improvement processes — actually operates. Annex A is the output. A team with weak ISMS but strong individual controls fails. A team with disciplined ISMS but pragmatic Annex A choices passes.

Stage 1 is not a formality. Stage 1 reviews your documented ISMS — scope, policy, risk assessment, SoA, internal audit results, management review records — and tells you whether you're ready for Stage 2. Most teams treat it as a paperwork check; experienced auditors use it to flag every weakness in advance. If Stage 1 raises 8 findings, expect Stage 2 to raise more. The correct response to Stage 1 findings is full remediation, not "we'll address it during Stage 2."

You don't pass ISO 27001 by implementing controls. You pass by demonstrating that you run a system that decides which controls to implement and verifies they work.

Surveillance audits change focus year-over-year. Year 1 typically tests Cl. 4–10 + about a third of your in-scope Annex A controls. Year 2 covers a different third (with mandatory clauses always re-tested). Year 3 is the recertification audit — full scope re-examined, like a smaller Stage 2. The CB's audit plan rotates, but Cl. 9 (performance evaluation) and Cl. 10 (improvement) are always tested. Don't let your internal audit program lapse between certifications.

The 2022 transition deadline (October 31, 2025) has passed. Any organization still on ISO 27001:2013 is now uncertified — their certificate is invalid. The 2022 update reorganized 114 controls in 14 categories into 93 controls in 4 themes (Organizational, People, Physical, Technological), introduced 11 new controls, and merged or replaced others. Treat any reference to "Annex A.5–A.18" as legacy; the current map is "A.5–A.8" by theme.

II.
Layer 02 — Control universe

Clauses 4–10 are mandatory; Annex A is the toolkit

ISO/IEC 27001:2022 main body
+ Annex A (93 controls, 4 themes)

The architecture — management system + selected controls

CLAUSES 4–10 · MANAGEMENT SYSTEM · MANDATORY "How you decide what to do — and verify you did it." Cl. 4 Context Internal/external issues Interested parties · scope Cl. 5 Leadership Top mgmt commitment Policy · roles Cl. 6 Planning Risk assessment Treatment plan · SoA · obj. Cl. 7 Support Resources · competence Awareness · documentation Cl. 8 Operation Implementation of treatment + Annex A Cl. 9 Performance Monitoring · internal audit Management review Cl. 10 Improvement CAPA · continual improvement selects ANNEX A · 93 CONTROLS · 4 THEMES · CHOSEN VIA SoA A.5 · ORGANIZATIONAL 37 controls policies, roles, supplier mgmt, classification — A.5.1 policies for info security — A.5.7 threat intelligence (NEW) — A.5.19–A.5.23 supplier relationships — A.5.29 disruptions to ICT (NEW) — A.5.30 ICT readiness for BC (NEW) — A.5.34 privacy and PII protection — A.5.36 compliance with policies Largest theme · governance & supplier A.6 · PEOPLE 8 controls screening, training, sanctions, remote work — A.6.1 screening — A.6.2 terms & conditions — A.6.3 awareness, training — A.6.4 disciplinary process — A.6.5 termination duties — A.6.6 confidentiality NDAs — A.6.7 remote working — A.6.8 reporting events Smallest theme · HR-driven A.7 · PHYSICAL 14 controls premises, equipment, environmental — A.7.1–A.7.4 perimeter, entry — A.7.5 environmental hazards — A.7.6 working in secure areas — A.7.7 clear desk/screen — A.7.10 storage media — A.7.11 supporting utilities — A.7.13 maintenance — A.7.14 secure disposal Often "N/A" for cloud-only orgs A.8 · TECHNOLOGICAL 34 controls access, crypto, dev, network, monitoring, BCDR — A.8.1 user endpoint devices — A.8.2–A.8.5 privileged access · IAM · auth — A.8.7 protection against malware — A.8.9 configuration management (NEW) — A.8.10 information deletion (NEW) — A.8.11 data masking (NEW) — A.8.12 data leakage prevention (NEW) — A.8.16 monitoring activities (NEW) — A.8.23 web filtering (NEW) — A.8.25–A.8.28 secure dev, code, test — A.8.29 security testing — A.8.31 separation of dev/prod — A.8.32 change management Eleven controls in the 2022 edition are new (vs 2013); marked NEW above. The rest are merged, restructured, or unchanged.

The trap most teams fall into

Treating Clauses 4–10 as overhead. Teams new to ISO 27001 build a control library against Annex A and consider themselves done. Then Stage 1 raises a finding on Cl. 4.3 (scope), another on Cl. 6.1.2 (risk methodology), another on Cl. 9.2 (no internal audit). The CB doesn't audit Annex A in isolation — it audits whether your process for selecting, implementing, and verifying Annex A actually exists.

The 11 new 2022 controls are not optional. Threat intelligence (A.5.7), ICT readiness for BC (A.5.30), data masking (A.8.11), DLP (A.8.12), monitoring activities (A.8.16), web filtering (A.8.23), secure coding (A.8.28), and configuration management (A.8.9) — these are the controls cloud-native organizations actually need and where 2013-era programs are weakest. Auditors are explicitly looking for evidence here in 2024–2026 audits because the transition is fresh.

Annex A controls answer "what" you do. The clauses answer "how do we know you keep doing it."

The themes are not equally weighted in audit time. A.5 (Organizational, 37 controls) and A.8 (Technological, 34) account for 60–70% of audit time. A.6 (People, 8) and A.7 (Physical, 14) are simpler and faster — though A.7 frequently gets marked "not applicable" by cloud-only organizations, which the auditor will challenge if your customers' data ever sits in offices, on laptops, or on physical media.

III.
Layer 03 — Evidence

The Statement of Applicability is the audit

Cl. 6.1.3(d) · the SoA
Cl. 9.2 · internal audit

The SoA — declaring what applies, what doesn't, and why

Each Annex A control is asked: "Does this apply to your scope?" OUTCOME 1 · APPLICABLE & IMPLEMENTED "Yes, and we do it." — Justification: how the risk maps — Reference to the policy/procedure — Owner and operating cadence — Evidence stored and available "A.8.5 — secure authentication implemented via Okta SSO + MFA on all admin accounts." OUTCOME 2 · APPLICABLE & PLANNED "Yes, in progress." — Risk treatment plan dates this — Interim compensating controls listed — Risk acceptance signed by mgmt — Resource commitment documented "A.8.16 — monitoring deployment in Q2; manual review until then." OUTCOME 3 · NOT APPLICABLE "No, and here's why." — Specific reason tied to scope — Risk ruled out of treatment plan — Auditor must agree the exclusion is genuine, not avoidance "A.7.13 — equipment maintenance N/A. No org-owned hardware in scope." SoA must list ALL 93 controls — even those marked N/A. Auditors test every line. "Not applicable" without a sound reason is a finding.

Internal audit (Cl. 9.2) & Management review (Cl. 9.3) — the engine room

CONTINUAL CYCLE — REQUIRED BEFORE STAGE 2 1 · Audit programme scope · frequency · methods based on importance of processes & prior results Cl. 9.2.2(a) 2 · Auditor selection competent · objective cannot audit own work may be external consultant Cl. 9.2.2(b) 3 · Conduct audits cover all clauses + Annex A over the audit cycle objective evidence collected ISO 19011 principles 4 · Report & CAPA findings to mgmt corrective actions tracked root cause analyzed Cl. 9.2.2(d) · 10.2 5 · Records retain audit programme + findings + actions CB will review these Cl. 9.2.2(e) findings inform next audit programme · continual cycle MANAGEMENT REVIEW · CL. 9.3 · TOP MANAGEMENT MUST CHAIR Inputs the auditor will look for in the meeting minutes — Status of actions from prior reviews — Changes in external/internal issues — Feedback on info security performance — Internal audit results & trends — Risk assessment & treatment status — Performance against objectives — Improvement opportunities — Resource needs identified — Decisions made (recorded) — Date & attendees (top mgmt presence verified)

Where ISO 27001 evidence work breaks down

The SoA is treated as a checkbox. Many teams produce an SoA listing 93 controls with one-line "applicable / yes" justifications. That fails Stage 2. Each entry must explain which risk the control treats, where the policy lives, how the control operates, and what evidence demonstrates it. The SoA is a 50–100 page document, not a spreadsheet. It is the most-read artifact in the audit.

Internal audit done late or by the wrong person. Cl. 9.2 requires that internal audits be performed by competent, objective auditors. A junior employee auditing their own manager fails. Many small organizations hire an external consultant for internal audits — entirely valid, often advisable. What's not valid is having no internal audit before Stage 2, or running it the week before the CB shows up. Auditors look for trend data — internal audit findings improving over multiple cycles is itself evidence of a working ISMS.

Management review without management. Cl. 9.3 requires top management to participate. "Top management" means the people accountable for the organization's overall direction — typically CEO, CTO, or equivalent, not the head of security. Meeting minutes signed only by the CISO with no top-management presence is a near-certain finding. Look for the agenda, attendees, decisions, and resource commitments.

The CB doesn't audit your ISMS once. It audits whether your ISMS audits itself.

Risk methodology is the silent killer. Cl. 6.1.2 requires you to define the risk assessment methodology — the criteria, the scale, the owners, the cycle. Many teams skip this and dive into the assessment, then the auditor asks "how did you decide this risk is High?" and there's no documented answer. Define methodology first; assessment second. The methodology document is short (often 5–10 pages) but mandatory.

IV.
Layer 04 — Cross-framework

ISO 27001 — the most translatable framework

Annex A maps cleanly to most others;
the management system is unique
ISO 27001 domain SOX SOC 2 (TSC) NIST CSF 2.0 PCI DSS v4.0.1 HIPAA HITRUST v11 Shared evidence
Cl. 4 — Context of organization ELC · scoping memo CC1.1 GV.OC Req 12.5 §164.306 00.a Org context document, interested parties register, ISMS scope statement
Cl. 5 — Leadership ELC · tone-at-top CC1.2 · CC1.3 GV.RR Req 12.4 §164.308(a)(2) 02.a Info sec policy, leadership communications, role/RACI
Cl. 6.1 — Risk mgmt ELC · risk assessment memo CC3.1 – CC3.4 GV.RM · ID.RA Req 12.3 §164.308(a)(1)(ii)(A) 03.a · 03.b Risk methodology, risk register, treatment plan, SoA
Cl. 9.2 — Internal audit Internal Audit function CC4.1 ID.IM Req 12.10 §164.308(a)(8) 06.h Audit programme, auditor competence records, findings log
Cl. 9.3 — Mgmt review AC oversight CC4.2 GV.OV Req 12.4.1 §164.308(a)(1)(ii)(D) 06.h Mgmt review minutes, decisions log, action items
A.5.15–A.5.18 — Access control ITGC — Access CC6.1 – CC6.3 PR.AA-01 · PR.AA-05 Req 7 · Req 8 §164.308(a)(3) · §164.308(a)(4) 01.b · 01.c · 01.v JML tickets, UAR exports, IAM config, MFA enforcement
A.5.19–A.5.23 — Supplier mgmt ITGC + BPC · TPRM CC9.2 GV.SC Req 12.8 · Req 12.9 §164.308(b) · BAAs 05.k Vendor inventory, due-diligence pkg, contracts, vendor SOC 2s
A.5.24–A.5.28 — Incident mgmt BPC · ITGC ops CC7.3 – CC7.5 RS.MA · RS.AN Req 12.10 §164.308(a)(6) 11.a – 11.c Incident tickets, post-incident reports, comms log
A.5.29 / A.5.30 — BC & ICT readiness BPC · resilience A1.2 · A1.3 RC.RP · RC.CO Req 12.10 §164.308(a)(7) 12.b · 12.c BIA, BCP/DRP, last-test report, RTO/RPO documentation
A.6.3 — Awareness & training ELC · COSO Comp.4 CC1.4 PR.AT-01 · PR.AT-02 Req 12.6 §164.308(a)(5) 02.e · 02.f Completion reports, phishing test results, attestations
A.7 — Physical security ITGC — Operations CC6.4 PR.AA-06 · PR.IR-02 Req 9 §164.310 08.b · 08.j Badge logs, CCTV retention, visitor records, asset disposal
A.8.2 — Privileged access ITGC — Access CC6.1 · CC6.3 PR.AA-05 · PR.PS-01 Req 7.2 · Req 8.2 §164.308(a)(4) 01.q · 01.v PAM logs, SoD ruleset, role-conflict report
A.8.7 — Malware protection ITGC — Operations CC6.8 PR.PS-05 Req 5 §164.308(a)(5)(ii)(B) 09.j EDR/AV deployment reports, scan logs, IOC alerts
A.8.8 — Vulnerability mgmt ITGC — Operations CC7.1 ID.RA-01 · PR.PS-02 Req 6.3 · Req 11.3 §164.308(a)(1)(ii)(B) 10.k · 10.m Scan reports, patch SLAs, exception register
A.8.16 — Monitoring activities (NEW) ITGC — Operations CC7.1 · CC7.2 DE.CM-01 · DE.CM-09 Req 10 §164.312(b) 09.aa SIEM rules, log retention config, alert tuning evidence
A.8.24 — Cryptography ITGC — Operations CC6.1 · CC6.7 PR.DS-01 · PR.DS-02 Req 3 · Req 4 §164.312(a)(2)(iv) 10.f · 09.s KMS config, TLS scan, cert inventory, key rotation logs
A.8.25–A.8.28 — Secure dev ITGC — SDLC CC8.1 PR.PS-06 Req 6.2 · Req 6.3 — 10.a · 10.b SAST/DAST reports, code review records, pen test report
A.8.32 — Change management ITGC — Change CC8.1 PR.PS-06 Req 6.5 §164.308(a)(8) 10.h Change tickets, CAB minutes, PR approvals, deploy logs

Why ISO 27001 evidence travels

ISO 27001's Annex A maps more cleanly to other frameworks than any other source in the Atlas. SOC 2's CC6 ↔ Annex A.5/A.8. NIST CSF's PR.AA ↔ A.5.15. PCI DSS Req 7 ↔ A.5.15/A.8.2. HIPAA's administrative safeguards ↔ A.5/A.6. HITRUST is essentially Annex A reorganized. Build to Annex A and you are 70%+ of the way to every other framework's controls.

What does not travel is the management system. Cl. 4–10 — context, leadership, risk, support, operation, performance, improvement — has no SOC 2 equivalent, no PCI DSS equivalent, only weak parallels in HITRUST. This is the part of ISO 27001 that takes the longest to mature and provides the least immediate reuse value to other audits. It is also the part that gives the certificate its credibility. Customers reading your ISO 27001 cert assume you run a real ISMS, not just a control library.

ISO 27001's controls are reusable across frameworks. The management system that produced them is not — and that's the point.

The dual ISO + SOC 2 strategy is the smart play. Roughly 70% control overlap, with a single evidence collection cycle. The CPA and CB do separate audits but draw from the same artifacts. Many service organizations run one combined readiness program and let two different external bodies form their respective opinions. The cost of doing both is ~1.4× the cost of doing one.