Preparing for ISO 27001 means the set of activities an organization carries out to build and run an Information Security Management System (ISMS) that an accredited certification body can assess. In practice, it is about organizing people, processes and technical controls around real risks.
For companies running on AWS, Azure or other cloud providers, the challenge is understanding what the standard requires, what the provider already covers and what stays with your team. This guide covers the steps, what changed in the 2022 version and how to avoid common pitfalls.
In short
- ISO/IEC 27001 is the ISMS requirements standard and the only one used in certification audits.
- The transition to the 2022 version ended on 31 October 2025, so preparation now starts directly from it.
- Annex A of the 2022 version has 93 controls in 4 themes, but not all of them must be implemented: the selection comes from the risk assessment and is justified in the Statement of Applicability (SoA).
- A cloud provider's certificate does not certify your company, although it can make the process easier.
- Preparing and certifying are different roles: certification is done by an accredited certification body.
What is ISO 27001 and why does only the 2022 version count today?
ISO/IEC 27001 is the requirements standard for an ISMS and the only one used in certification audits. The transition from the 2013 version to the 2022 version ended on 31 October 2025, and 2013 certificates stopped being valid after that date. Today, preparation starts directly from the 2022 version.
The 36-month transition window was set by IAF MD 26, counted from the standard's publication on 25 October 2022. Since 1 May 2024, initial certifications and recertifications were already issued only against the 2022 version.
It helps to tell two documents apart. ISO/IEC 27001 sets out the ISMS requirements. ISO/IEC 27002:2022 provides guidance for implementing controls and is not certifiable. In other words, 27002 helps you implement, while 27001 is what gets audited. The Brazilian ABNT edition (ABNT NBR ISO/IEC 27001:2022) is paid, as is the official ISO text.
How do you prepare for ISO 27001, step by step?
Start by defining the context and scope of the ISMS, then establish leadership and policy, assess risks, select controls and record the Statement of Applicability. Next, implement, train your people, run an internal audit and a management review. Only then does the accredited certification body assess the system.
- Context and scope. Define which units, systems, cloud environments and interested parties are part of the ISMS. Amendment 1:2024 added notes to clauses 4.1 and 4.2: the organization must determine whether climate change is a relevant issue and consider interested-party requirements related to climate.
- Leadership and policy. Management must sponsor the ISMS, set the information security policy and assign responsibilities.
- Risk assessment. Identify assets, threats and vulnerabilities, evaluate impact and likelihood, and define the treatment for each risk.
- Statement of Applicability (SoA). List the Annex A controls that apply, the status of each one and the justification for any exclusions.
- Implementation. Carry out the risk treatment plan with policies, procedures and technical configurations.
- Awareness and training. Make sure people know the policy and their role in the ISMS.
- Internal audit and management review. Check that the ISMS works as described and bring the results to management, correcting deviations.
- Certification audit. An accredited certification body assesses the ISMS against the standard.
Good preparation leaves organized evidence along the way, not only at the end. Decision records, access reviews and continuity tests tell the story of the ISMS to the auditor.
What changed in Annex A of the 2022 version?
ISO/IEC 27001:2022 reorganized Annex A into 93 controls across 4 themes, compared with 114 controls in 14 domains in the 2013 version. Because the official text is paid and was not consulted directly, the counts below come from consultancy material, such as the Scrut controls guide. Confirm them against the official text before using them in formal documents.
| Theme | Controls |
|---|---|
| Organizational | 37 |
| People | 8 |
| Physical | 14 |
| Technological | 34 |
The 2022 version introduced 11 new controls. Several have a direct impact on cloud environments:
- A.5.7 Threat intelligence: using information about threats to guide protection decisions.
- A.5.23 Information security for use of cloud services: criteria for choosing a provider, defining responsibilities and planning for service exit.
- A.5.30 ICT readiness for business continuity.
- A.8.9 Configuration management: keeping configurations secure and documented, for example with infrastructure as code.
- A.8.10 Information deletion, A.8.11 Data masking and A.8.12 Data leakage prevention: data lifecycle and protection.
- A.8.16 Monitoring activities: logs and detection of anomalous behavior.
- A.8.28 Secure coding: secure practices in development.
The remaining new controls are A.7.4 (physical security monitoring) and A.8.23 (web filtering).
Do I need to implement all 93 controls?
Not necessarily. Selection starts from the risk assessment, and every exclusion must be justified in the SoA. A control that is out of scope or irrelevant to your risks can be excluded, as long as the justification is coherent.
How does shared responsibility work in the cloud?
A cloud provider's certification does not certify the customer. AWS states that a company is not automatically certified by association: AWS's certificate covers its own security management process, within a scope of services and data centers, and can make the customer's process easier.
Microsoft follows the same logic for Azure: customers can use the certificate in their own assessment, but remain responsible for engaging an assessor and for the controls and processes of their own organization. Azure Policy initiatives mapped to ISO 27001 controls help show what belongs to the customer, to Microsoft or is shared, but they give only a partial view of compliance.
In practice, this means:
- Use the provider's reports and certificates as input to supplier assessment (A.5.23).
- Define who handles identities, configurations, data and monitoring on the company's side.
- Document the service exit strategy and change management.
- Treat Brazil's LGPD (data protection law) in an integrated way, since access control, retention and data deletion controls serve both goals.
For help with this mapping, see our Security, Governance and Cloud page.
What common mistakes get in the way, and how do you avoid them?
Many pitfalls are organizational, not technical. A simple checklist helps you stay on track:
- A scope that is vague or too large for current maturity.
- A risk assessment done once and forgotten, with no periodic review.
- An SoA copied from a template, without real justifications.
- Relying on the provider's certificate as if it covered the whole company.
- Policies that are written but have no evidence of being practiced.
- Internal audit and management review left to the last minute.
- Ignoring the climate change notes in clauses 4.1 and 4.2. Confirm with the certification body how it handles the amendment.
Before the audit, confirm: approved scope, risks treated, SoA up to date, internal audit completed, management review recorded and evidence easy to access.
Frequently asked questions
Can I still get certified to ISO 27001:2013?
No. The transition ended on 31 October 2025, and 2013 certificates stopped being valid after that date. New certifications and recertifications are issued against the 2022 version.
What is the difference between ISO 27001 and ISO 27002?
ISO/IEC 27001 sets the ISMS requirements and is the standard used in audits. ISO/IEC 27002:2022 provides guidance for implementing controls and is not certifiable.
Does an AWS or Azure certificate certify my company?
No. The provider's certificate covers its own process, within a defined scope, and can make your assessment easier. Your company remains responsible for its own controls and for engaging an assessor.
Are all Annex A controls mandatory?
No. Controls are selected based on the risk assessment, and every exclusion must be justified in the Statement of Applicability.
Who performs the certification?
An accredited certification body. Consultancies such as Cloud Minds Trusted help with preparation but do not issue the certificate.
Conclusion
Preparing for ISO 27001:2022 is a matter of method: a clear scope, well-assessed risks, justified controls and consistent evidence. In the cloud, this includes knowing precisely what belongs to the provider and what belongs to your company.
Cloud Minds Trusted supports technical teams in this preparation, from scoping and risk mapping to organizing evidence, without replacing the certification body. If you would like to discuss your scenario, talk to our team.