Related standards, risk concepts and the legal, regulatory and certification context
Related standards
ISO/IEC 27002:2022 provides implementation guidance and attributes for the Annex A controls but is not certifiable. ISO/IEC 27003 covers implementation, 27004 measurement, 27005 information security risk management, 27017 cloud services, 27018 cloud PII, 27035 incident management, 27036 supplier relationships, and 27701 extends the ISMS to privacy. ISO 31000 gives generic risk management principles.
Risk vocabulary
Risk is usually expressed as a combination of the consequences of an event and its likelihood, assessed against defined criteria that include the organisation's risk appetite. Likelihood, impact, inherent and residual risk, risk owner, risk acceptance and risk treatment options (modify, retain, avoid, share) recur in questions. Accepted residual risk belongs to an accountable owner, not to the auditor.
Legal and regulatory context
Clause 4.2 and Annex A (A.5.31 legal, statutory, regulatory and contractual requirements) require identification and maintenance of obligations - GDPR, sector regulation, contractual security schedules. An auditor tests that the register exists, is current, and is reflected in policy and controls.
Certification context
Certification bodies operate under ISO/IEC 17021-1 with ISO/IEC 27006 as the ISMS-specific interpretation, and are accredited (for example by a national accreditation body). The cycle is: two-stage initial audit, a certificate valid for three years, surveillance audits at least once a year (the first within twelve months of the certification decision), then recertification before expiry. Impartiality rules bar the same body from consulting and certifying.
Traps
- Assuming ISO/IEC 27002 certification exists.
- Believing surveillance audits are optional or may be skipped and backfilled.
- Confusing accreditation (of the certification body) with certification (of the client).
Rule of thumb
Remember '3 – 12 – 3': a three-year certificate, annual surveillance with the first inside twelve months, recertification in good time before the three years expire.