Skip to content
Knowledge Hub/Article
Article

What Is ISO 27001? How Certification Works and Who Must Have It

ISO 27001 is the information security management system standard. The 2022 edition, its 93 controls, how certification works and who must have it in Türkiye.

Oğuzhan Gerçek··10 min read
What Is ISO 27001? How Certification Works and Who Must Have It

Short answer: ISO/IEC 27001 is the international standard that sets out the requirements for establishing, operating and continually improving information security as a management system. It is published jointly by ISO and IEC; the current edition came out in October 2022, and certificates issued against the 2013 edition stopped being valid on 31 October 2025. The standard certifies a management system, not a product: you define the scope, an accredited certification body audits it, and the certificate is valid for three years. In Türkiye it is a regulatory requirement in areas such as energy, electronic communications, e-invoice private integration and authorized economic operator (YYS) status.

What is ISO 27001?

The standard's full title is ISO/IEC 27001, Information security, cybersecurity and privacy protection — Information security management systems — Requirements. Its subject is the information security management system (ISMS): the set of policies, processes, roles and technical controls built to protect the confidentiality, integrity and availability of information. The standard does not tell you which firewall to buy; it asks how you identify risks, why you chose the controls you chose, and how you prove the system works.

According to ISO's own page, the current edition is the third, published in 2022. 27001 does not stand alone; it is the certifiable member of the 27000 family: ISO/IEC 27002 is the implementation guidance for the controls, 27017 and 27018 add controls for cloud services, and 27701 extends the system to personal data. Certificates are issued against 27001 only; the others are guidance.

A short definition is in our glossary. We cover the standard's place in security in our cyber security article and the certification timeline in our ISO 27001 certification process article.

How the standard is built: clauses 4 to 10 and Annex A

The mandatory requirements sit in clauses 4 to 10. In order: the organization's context and the scope of the ISMS (4), leadership and policy (5), risk assessment, risk treatment and objectives (6), resources, competence, awareness and documentation (7), operation (8), monitoring, measurement, internal audit and management review (9), nonconformity and continual improvement (10). A certification audit looks for evidence of every one of them.

Annex A is the list of controls. The 2022 edition has 93 controls grouped into four themes: organizational (37), people (8), physical (14) and technological (34). The document in which you record which controls you apply and which you exclude, with reasons, is the Statement of Applicability (SoA); it is among the first documents an auditor asks for. Excluding a control is allowed; excluding it without a reason is not.

What changed from 2013 to 2022?

In the 2013 edition Annex A had 114 controls across 14 domains. The 2022 edition merged controls down to four themes and added 11 new ones: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. Most of the new controls are the daily work of IT operations, which is why the transition created more work on the infrastructure side than in the documentation.

The transition timetable was set by IAF, the umbrella body of accreditation bodies: under its mandatory document MD 26, certification bodies had to move their clients to the new edition by 31 October 2025; certificates issued against the 2013 edition are no longer valid after that date. Every certificate issued today is against the 2022 edition.

How do you get ISO 27001 certified?

The certificate is issued not by ISO, which writes the standard, but by an accredited certification body. In Türkiye accreditation is granted by TÜRKAK; for international recognition the body must be accredited by TÜRKAK or by another accreditation body that is party to the IAF mutual recognition arrangement. Where regulation requires a certificate, one from a non-accredited body is usually not accepted.

The path runs in this order: the scope is defined (which units, sites and systems), a gap analysis compares the current state with the standard, a risk assessment is carried out and the Statement of Applicability is written, the controls are put in place and start producing evidence, an internal audit and a management review are held, and then the certification body reviews the documentation in Stage 1 and checks in Stage 2 that the controls actually work. The certificate is valid for three years; there is a surveillance audit in years one and two and recertification at the end of year three. What the timeline depends on, and the most common misunderstanding, are in our certification process article.

If you use a consultant, one rule does not change: the organization that prepares you cannot be the one that certifies you. The independence principle forbids it, and certification bodies reject such applications.

Who must have it in Türkiye?

The standard is voluntary; the obligation comes from sector regulation. The certain cases:

  • Electricity market (EPDK): An amendment to the Electricity Market Licence Regulation (Official Gazette 29217, 26 December 2014) requires generation licence holders with 100 MW or more of installed capacity (excluding OSB generation licences) and distribution licence holders (excluding OSB distribution licences) to operate their corporate IT systems and industrial control systems in line with TS ISO/IEC 27001 and to prove it through a certification body accredited by TÜRKAK; the obligation took effect on 1 March 2016.
  • Electronic communications (BTK): The Regulation on Network and Information Security in the Electronic Communications Sector (Official Gazette 29059, 13 July 2014) requires operators to establish an ISMS covering all authorized services and critical systems; the standard it is based on is TS ISO/IEC 27001.
  • e-Invoice private integration (GİB): With the June 2026 update of its Private Integration Guide, the Revenue Administration made a TÜRKAK-accredited ISO certificate a condition for private integrator applications; ISO 27001 is the first of them.
  • Authorized economic operator (Ministry of Trade): The Regulation on the Facilitation of Customs Procedures requires ISO 9001 and ISO 27001 certificates for a YYS application; under the 2017 amendment the certificates must cover every administrative building and facility where customs and foreign trade operations are carried out.

Outside regulation you will meet it in two more places: public tender specifications and the supplier contracts of large customers. Even where the certificate is not mandatory it can become a precondition for bidding; our article on questions to ask when choosing an MSP looks at this from the supplier side.

ISO 27001 vs KVKK, ISO 27002 and SOC 2

ISO 27002 is not certifiable; it is the guidance that explains how to implement the controls in Annex A of 27001. A supplier who says "we comply with 27002" holds no certificate.

KVKK is a law, ISO 27001 a standard. Article 12 of the law requires data controllers to take appropriate technical and organizational measures but defines no certificate; ISO 27001 is the common way to show that those measures are in place and audited, but it is not KVKK compliance itself. The extension of the standard for personal data is 27701.

SOC 2 is not a standard but an assurance report prepared by an independent auditor; it is based on the American AICPA framework and is mostly requested from service providers with US customers. An ISO 27001 certificate is valid for three years, whereas a SOC 2 report describes a specific period. Business continuity has its own standard, ISO 22301; the additional rules for banking are in our BDDK article.

What does ISO 27001 consultancy cover, and what drives the cost?

A consultant does not implement the standard for you; they help you define the scope, run the gap analysis, prepare the risk assessment and the Statement of Applicability, write policies and procedures that match how the organization actually works, carry out the internal audit and manage the relationship with the certification body through the audit. What we do on this side is on our ISO standards page.

The total cost has three parts, and the figure is driven by scope: the organization's own preparation (building the missing controls, new tools where needed), consultancy, and the certification body's audit fee. The certification body calculates audit time from the number of employees, the number of sites and the complexity of the systems; the narrower the scope, the shorter the audit and the lower the fee. Keeping the scope as narrow as "the customer asked for it" allows is possible, as long as you know the certificate says nothing about the systems left outside it.

Which controls fall to the infrastructure side?

Most of the 34 controls in Annex A's technological theme are the daily work of IT operations: access and identity management, patch management, log collection and monitoring, backup, network segregation, DLP and configuration management. The evidence for these controls is produced in the systems, not in the documents: the patch report, the backup restore record, the access review minutes. If you have handed the infrastructure to a provider, the provider has to produce that evidence and your contract has to give you the right to audit; how we run this layer is on our infrastructure management and security operations pages.

Frequently asked questions

What does ISO 27001 mean? The information security management system standard: the certifiable international standard, published jointly by ISO and IEC, that defines the requirements for an organization to establish and maintain information security through a risk-based management system.

How long is an ISO 27001 certificate valid? Three years. Surveillance audits take place in years one and two, and recertification is required at the end of year three. A major nonconformity in a surveillance audit can lead to the certificate being suspended.

Is ISO 27001 mandatory? The standard is voluntary, but regulation requires a certificate in some sectors: electricity generation of 100 MW and above and electricity distribution (EPDK), an ISMS for electronic communications operators (BTK), e-invoice private integration (GİB) and authorized economic operator status (Ministry of Trade). Public tenders and corporate customers can also require it by contract.

What is the difference between ISO 27001 and ISO 27002? 27001 sets the requirements and is certifiable; 27002 is the implementation guidance for the same controls and is not certifiable.

How many controls does ISO 27001 have? 93 in the 2022 edition: 37 organizational, 8 people, 14 physical and 34 technological. The 2013 edition had 114 controls across 14 domains.

Who issues an ISO 27001 certificate? An accredited certification body; in Türkiye accreditation is granted by TÜRKAK. An organization that provides the consultancy cannot certify the same client.

Sources