OTVista
Get early access

ISO/IEC 27001 and 27002 Compliance

Build an ISO/IEC 27001 management system that also covers your operations

ISO/IEC 27001 is the international standard for an information security management system (ISMS). OTVista helps organizations implement or extend an ISMS, including into operational technology, and prepare the documentation, risk treatment and evidence a certification audit will examine.

Service sheet
Service
ISO/IEC 27001 and 27002 Compliance
Scope areas
11
Potential deliverables
7
Engagement
Scoped to you

In short

ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system. Organizations define a scope, assess information security risks, select controls (Annex A lists 93 controls in the 2022 edition) and record the decisions in a Statement of Applicability. ISO/IEC 27002 gives implementation guidance for those controls. Certification is issued by an accredited certification body after a two-stage audit.

The challenge

Many organizations hold, or are asked by customers to obtain, ISO/IEC 27001 certification. The ISMS is often written for office IT, and plants, control systems and engineering teams are either left out of scope or forced into controls that do not fit them. Auditors and customers increasingly ask how operational technology is covered.

Others start from nothing and are unsure what the standard actually requires: which documents are mandatory, how detailed the risk assessment must be, and how to show that controls operate rather than just exist. The 2022 revision also restructured Annex A into four themes, so older ISMS documentation often needs reworking.

Scope and activities

The scope is agreed during scoping. A typical implementation or readiness engagement covers the management system clauses and the Annex A controls that apply to you.

  • Context and ISMS scope

    Interested parties, requirements and a defensible scope statement, including whether and how OT sites and systems are included (clauses 4.1–4.3).

  • Leadership and information security policy

    Management commitment, roles and responsibilities, and a top-level policy that works for both IT and OT (clause 5).

  • Risk assessment and treatment

    A repeatable risk method, a risk register and treatment plan aligned with your corporate risk criteria (clauses 6.1.2, 6.1.3 and 8.2–8.3).

  • Statement of Applicability

    Each of the 93 Annex A controls marked as included or excluded, with justification and implementation status.

  • ISO/IEC 27002 control implementation

    Practical implementation guidance across the organizational, people, physical and technological control themes.

  • Topic-specific policies and procedures

    Access control, asset management, backup, incident management, supplier relationships, secure configuration and others the SoA requires.

  • Objectives, competence and awareness

    Measurable security objectives, competence records and awareness for staff, including OT roles (clauses 6.2 and 7).

  • Operational technology extension

    Applying ISMS controls to control systems with IEC 62443 or ISO/IEC 27019 for technical depth, and documenting OT-specific exceptions.

  • Monitoring, internal audit and management review

    Metrics, an internal audit programme and management review inputs and outputs (clause 9).

  • Nonconformity and continual improvement

    Corrective action handling and an improvement log (clause 10).

  • Certification readiness

    A readiness review before the stage 1 and stage 2 audits by your chosen certification body.

ISO/IEC 27001 documentation we prepare or review

ISO/IEC 27001 requires certain documented information. The exact set depends on your scope and Statement of Applicability.

Mandatory ISMS documents

Documented information required by ISO/IEC 27001:2022 clauses 4–10

  • ISMS scope (4.3)
  • Information security policy (5.2)
  • Risk assessment and treatment process (6.1.2, 6.1.3)
  • Statement of Applicability (6.1.3 d)
  • Information security objectives (6.2)
  • Evidence of competence (7.2)
  • Risk assessment and treatment results (8.2, 8.3)
  • Monitoring and measurement results (9.1)
  • Internal audit programme and results (9.2)
  • Management review results (9.3)
  • Nonconformities and corrective actions (10.2)

Topic-specific policies

Examples given in ISO/IEC 27002:2022 control 5.1, selected through your SoA

  • Access control
  • Asset management and acceptable use
  • Information classification and handling
  • Information transfer
  • Supplier relationships
  • Backup
  • Cryptography and key management
  • Information security incident management
  • Management of technical vulnerabilities
  • Secure configuration and endpoint devices
  • Networking security
  • Secure development

Operating procedures and records

Supporting procedures that show controls operate in practice

  • Joiner, mover and leaver process
  • Change management
  • Logging and monitoring review
  • Incident response and lessons learned
  • Business continuity and ICT readiness
  • Supplier assessment records
  • Training and awareness records
  • OT exceptions and compensating measures register

See all policy and procedure sets

Potential deliverables

Final deliverables depend on the agreed engagement.

  • Gap assessmentCurrent position against every ISO/IEC 27001 clause and the Annex A controls in scope.
  • ISMS scope and context statementScope, boundaries, interfaces and interested parties.
  • Risk methodology, register and treatment planConsistent criteria, assessed risks and selected treatments.
  • Statement of ApplicabilityAll 93 controls with inclusion decisions, justification and status.
  • Policy and procedure setMandatory documents and the topic-specific policies your SoA requires, in your template.
  • Internal audit and management review packAudit programme, checklists and review templates.
  • Certification readiness reportRemaining gaps and a realistic plan before the certification audit.

Engagement approach

  1. Scope

    Agree objectives, ISMS scope, whether OT is included, timeline and the target certification date.

  2. Assess

    Review existing documents and practices against each clause and the Annex A controls.

  3. Build

    Develop the risk method, register, SoA, policies and procedures with your teams.

  4. Operate

    Help run the first cycle of risk treatment, monitoring, internal audit and management review.

  5. Prepare

    Run a readiness review and close remaining gaps before the certification body's audit.

Runs on the OTVista tool

How OTVista carries out ISO/IEC 27001 and 27002 Compliance

This service is delivered in the OTVista tool, not in a pile of spreadsheets. Use the same modules yourself, or have a practitioner run them for you.

  1. Your workspace is set up

    A dedicated OTVista workspace is created for your scope, sites and frameworks.

  2. The work runs in the tool

    An independent OT security practitioner carries out the work in OTVista, with you, instead of in loose spreadsheets.

  3. You keep the result

    Assets, findings, evidence and the roadmap stay live and traceable, ready for the next review or audit.

Tool modules used

The OTVista tool is in early access. Modules are released progressively, and demos show the current release. Ask us which capabilities are available for your environment today. Where a module is not yet released for your scope, the same structure is delivered as an exportable workbook.

Assumptions and limitations

  • OTVista does not issue ISO/IEC 27001 certificates. Certification is carried out by accredited certification bodies that you select.
  • An ISMS must operate for a period before certification. Evidence of risk treatment, internal audit and management review is needed.
  • OTVista does not sell or distribute ISO standards. Obtain licensed copies from ISO or your national standards body.
  • Top management approval of the policy, risk acceptance and the Statement of Applicability remains with your organization.

What helps us get started

  • Any existing security policies, procedures and risk registers
  • Organization chart and the sites or services you want in scope
  • Customer or regulatory requirements driving certification
  • Previous audit reports or certificates, if you are transitioning or recertifying

Sensitive material is exchanged only after an engagement is agreed, using a method we agree with you — never through the website form.

Questions about ISO/IEC 27001 and 27002 Compliance

What is the difference between ISO/IEC 27001 and ISO/IEC 27002?

ISO/IEC 27001 contains the requirements for an information security management system and is the standard organizations certify against. ISO/IEC 27002 is guidance on implementing the controls listed in Annex A of ISO/IEC 27001; organizations do not certify against it.

How many controls are in ISO/IEC 27001:2022 Annex A?

93 controls grouped into four themes: organizational (37), people (8), physical (14) and technological (34). Each one is either included or excluded with a justification in the Statement of Applicability.

Can ISO/IEC 27001 cover operational technology?

Yes. The ISMS scope can include OT sites and systems. Many operators keep ISO/IEC 27001 as the management framework and use IEC 62443, or ISO/IEC 27019 in energy utilities, for OT-specific technical requirements.

How long does ISO/IEC 27001 implementation take?

It depends on scope, existing maturity and resources. Organizations starting with little in place often need several months to build the ISMS and run it long enough to produce audit evidence. We provide an estimate after the gap assessment.

Does ISO/IEC 27001 help with NIS2?

It can provide much of the management structure NIS2 risk-management measures require, such as risk analysis, incident handling and supplier security. NIS2 also has specific obligations, such as incident reporting deadlines and management accountability, that need to be checked separately.

Related services

Further reading

Talk to us about ISO/IEC 27001 and 27002 Compliance

Share your objectives and constraints. We'll help you define a scope that fits your operations.

Request a consultation