# ISO/IEC 27001

> International standard for information security management systems, and how to build your ISMS and Statement of Applicability in cSquare.

Source: https://docs.csquaregrc.com/frameworks/iso-27001


ISO/IEC 27001:2022 specifies an **information security management system (ISMS)**: clauses 4 to 10 plus the Annex A controls. Certification is by an accredited body in two stages.

## Set up ISO 27001 in cSquare

1. **Create the program** from the ISO 27001 template. It includes all 93 Annex A controls in four themes: organizational, people, physical and technological.
2. **Define ISMS scope** (clause 4): locations, teams, systems and interfaces.
3. **Run your risk assessment** in the [risk register](/guides/risks) (clause 6). ISO expects risk to drive control selection.
4. **Build your Statement of Applicability** with the Control Applicability Wizard. Every exclusion keeps its justification.
5. **Approve ISMS documents**: scope, information security policy, risk methodology, risk treatment plan.
6. **Run an internal audit and management review** (clause 9) before stage 1.

```text
Draft our ISO 27001 ISMS scope statement based on our organization profile, including in-scope locations, systems and exclusions with justifications.
```

```text
Review my Statement of Applicability: list excluded Annex A controls whose justification is weak, and controls included without a linked risk.
```

## Certification stages

- **Stage 1:** documentation review of the ISMS.
- **Stage 2:** evidence that controls operate as documented.
- **Surveillance audits** follow yearly, with recertification every three years.

## Reuse

Map to SOC 2 to reuse evidence. See [Control mapping](/concepts/control-mapping).