Building a successful ISMS
ISO/IEC 27001:2022 governs the Information Security Management System (ISMS): a risk management approach, not just a list of technical controls. Certification attests that an organization has identified its risks, put proportionate measures in place, and maintains this approach over time.
Annex A: 93 controls in 4 categories
The 2022 revision restructured Annex A into 4 categories - organizational, people, physical and technological - compared with 14 domains in the previous version. Not every control has to be implemented: the ISMS documents which ones are applicable (Statement of Applicability) and why, based on a real risk analysis of the certified scope.
In practice, organizational controls (security policy, asset management, supplier management) and technological controls (access control, encryption, logging) account for most of the evidence burden - and they are also what an external auditor examines first.
The certification cycle
A certification audit takes place in two stages: a documentation audit (Stage 1, checking that the ISMS is structured and applicable) followed by an implementation audit (Stage 2, checking that the documented controls are actually followed, with evidence). Certification is then maintained through annual surveillance audits over a 3-year cycle.
The most common difficulty is not writing policies but producing dated evidence that is consistent over time for each control retained - an access log without reliable timestamps, or an access review that happened only once, is generally not enough.
What SAUDITER.BJ automates
The self-assessment walks you step by step through each Annex A control applicable to your scope, with the expected evidence specified at each step. Because ISO 27001 shares many requirements with PCI DSS, the PSSIE or the NIST CSF, evidence uploaded once can cover several frameworks at the same time thanks to cross-mapping.
Suggestion provided for educational purposes - human validation required. This guide does not constitute legal advice and does not replace an accredited external auditor.