ISO/IEC 27001
The information security management system: a structured approach to protecting company information.
Voucher MIMIT code VCCFA2600000933-D9How it works
From gap analysis to the certificate, then the three-year cycle: surveillance audits in the first and second year, recertification in the third. We support you at every stage.
-
1
Analysis and planning
With the gap analysis we assess the risks and plan the work needed to build the ISMS.
-
2
Implementation and Monitoring
Deploy the required security controls and procedures. Continuously monitor the system’s effectiveness through internal audits and regular reviews.
-
3
Certification and Maintenance
We prepare you for the certification audit and, once the certificate is issued, keep conformity in place with the periodic audits and continuous improvement.
The console in action
A tour of the console, then tasks from start to finish, on the screens you will use. Each recording is split into chapters: pick one to start from there.
The ISO/IEC 27001 Standard
ISO 27001 is the leading international standard for information security, designed to support organizations of any size or industry in adopting an Information Security Management System (ISMS), ensuring a structured and effective approach to data protection.
It serves as a key tool for designing a comprehensive and effective corporate security plan. Today, ISO 27001 is recognized as one of the most thorough standards, consisting of carefully selected guidelines and controls. It goes beyond IT security, encompassing physical/environmental and organizational security as well.
ISO 27001 safeguards the core aspects of information security, summarized in the three pillars of cybersecurity:
Confidentiality
Ensures that data is accessible only to authorized individuals, preventing unauthorized access.
Integrity
Ensures that information is accurate, complete, and unaltered without authorization, preserving its reliability.
Availability
Ensures access to data and systems when needed, preventing disruptions or data loss.
How ISO/IEC 27001 certification works
ISO/IEC 27001:2022 certifies that an organization manages information security through a risk-based Information Security Management System (ISMS). The standard has two parts: the mandatory management clauses (4-10) and Annex A, the catalogue of security controls to be selected based on risk.
The mandatory clauses (4-10)
They define how the ISMS is built and maintained. They are requirements, not options.
- Context of the organization and scope definition
- Leadership and management commitment
- Planning and risk assessment
- Support: resources, competence, documentation
- Operations and risk treatment
- Performance evaluation and internal audits
- Improvement and management of nonconformities
Annex A: 93 controls across 4 themes
The 2022 revision reorganized the controls from 114 to 93, grouped into four themes and with 11 new controls (including threat intelligence, cloud security, and data masking).
- A.5 - Organizational controls (37)
- A.6 - People controls (8)
- A.7 - Physical controls (14)
- A.8 - Technological controls (34)
The certification path in five stages
1
Gap analysis
Defining the ISMS scope and comparing it against the standard's requirements.
2
Implementation
Policies, risk assessment, treatment plan, and Statement of Applicability.
3
Internal audit
Internal verification and management review before the certification body.
4
Certification audit
Stage 1 (documentation) and Stage 2 (control effectiveness), conducted by an accredited body.
5
Surveillance
Annual surveillance audits and full recertification every three years.
ISO 27001, NIS 2 and GDPR: how they fit together
An ISO 27001 ISMS does not replace legal obligations, but it provides the risk management structure NIS 2 and GDPR ask for, and it produces evidence you can reuse. Most of the NIS 2 baseline measures and of the security of processing principle (GDPR art. 32) are already answered by the Annex A controls.
In Italy, the UNI/PdR 174:2025 reference practice explicitly links ISO/IEC 27001 to NIS requirements, letting already-certified organizations build on the work they have done.
ISO/IEC 27001 certification is not mandatory - so why get certified?
The main European and international rules on information security, such as the NIS 2 Directive and the ISO/IEC 27000 family of standards, set the frame for keeping operations running, protecting sensitive data and managing cyber risk. Alongside them sits the DORA regulation for the financial sector, which is not among the services we offer but shapes the regulatory context. Implementing an ISMS to ISO/IEC 27001 takes real effort, and the benefits are considerable.
Benefits
Security
- raise the level of information security
- significantly reduce the likelihood of cyber attacks
- increase resilience against potential attacks
- enhance your ability to respond to and recover from attacks
Brand Image
- a certified company is perceived as more reliable and trustworthy
- certification strengthens your brand credibility
- a requirement for participating in certain public tenders
- a prerequisite to qualify as a supplier for large enterprises
Manage ISO 27001 with Cyber Console
Cyber Console is our platform for managing ISO 27001 controls, activities and documentation: a structured flow, automatic versioning and audit-ready documentation.
Explore the platform
Frequently asked questions about ISO 27001
ISO/IEC 27001 is the international standard that certifies an Information Security Management System (ISMS). Certification attests that the organization manages information security with a systematic, risk-based approach, validated by an accredited certification body.
For most organizations the path takes 6 to 12 months, depending on size, number of sites, and the maturity of existing controls. After implementation, the Stage 1 (documentation) and Stage 2 (control effectiveness) certification audits take place.
The cost depends on the ISMS scope, the organization's size, and the number of sites, and consists of the implementation effort plus the certification body's fee. Aegister starts with an assessment to define scope and gaps and provide a realistic estimate.
ISO 27001 is the certifiable standard: it contains the ISMS requirements and Annex A with its 93 controls. ISO 27002 is the implementation guidance that explains in detail how to apply each control, but it is not certifiable.
No, ISO 27001 is not mandatory. However, a certified ISMS covers most NIS 2 baseline measures and the security-of-processing principle (GDPR Art. 32), producing reusable evidence. In Italy, the UNI/PdR 174:2025 practice explicitly links ISO/IEC 27001 to NIS requirements.
ISO 27001 insights
Guides, analysis and updates on ISO 27001 certification and information security management.
Made with AI
08 Oct 2026
NIS 2 vs ISO 27001: what certification covers and the gaps
Your company holds or plans ISO/IEC 27001 and falls under NIS 2. What the certification already covers, the obligations D.Lgs. 138/2024 adds (registration, management body accountability, notification to CSIRT Italia, the ACN baseline measures, supply chain) and a control mapping to reuse the ISMS without doing the work twice.
05 Oct 2026
Cyber Console 2.0: redesigned from top to bottom
Cyber Console reaches version 2.0: an interface redesigned from top to bottom, one search for the whole console, video guides to using the console and new functions for NIS 2 and ISO 27001, incident notification and perimeter protection.
Made with AI
29 Apr 2026
Cybersecurity Audit: What It Is, How It Works, and How to Prepare
A cybersecurity audit checks whether security governance, controls, evidence and technical practices are suitable for the chosen framework. This guide explains audit types, phases, preparation steps and common failure patterns for NIS 2, ISO 27001, DORA and ACN baseline readiness.