ISO 27001 for Regulated Firms: What the Standard Requires of Your People

ISO/IEC 27001 is the certification a finance, healthcare or legal client is most likely to name in a procurement questionnaire, and the one most often misunderstood by the organisation trying to obtain it. It is not a cybersecurity product and it does not certify that a firm is secure. It certifies that a firm operates a management system for information security — a set of documented processes for deciding what to protect, choosing controls, and demonstrating that the people involved are competent to run them.

That last part is where most implementations are weakest, and it is written into the standard in two short clauses that are worth reading in full.

First, a date that matters

The current edition is ISO/IEC 27001:2022, published on 25 October 2022. The transition from the 2013 edition has closed: UKAS’s published timetable required certification bodies to complete the transition of all their clients by 31 October 2025, under the arrangements set out in IAF mandatory document MD 26.

So as of now, a certificate against ISO/IEC 27001:2013 should no longer be in circulation. If a supplier produces one, or if internal training material still teaches the 2013 structure, both are out of date. This is the single most common factual error in current content on the standard.

What the standard is actually made of

The management system requirements sit in clauses 4 to 10, and they are the auditable part:

• 4 Context of the organization — understanding the organisation and its context, the needs and expectations of interested parties, and determining the scope of the management system
• 5 Leadership — leadership and commitment, policy, and organisational roles, responsibilities and authorities
• 6 Planning — actions to address risks and opportunities, including information security risk assessment and risk treatment, objectives, and planning of changes
• 7 Support — resources, competence, awareness, communication and documented information
• 8 Operation — operational planning and control, risk assessment and risk treatment
• 9 Performance evaluation — monitoring and measurement, internal audit and management review
• 10 Improvement — continual improvement, nonconformity and corrective action

Annex A then provides the reference list of information security controls, which clause 6.1.3 describes as a comprehensive list of control objectives and possible controls. The word possible is doing real work: Annex A is a reference set to compare against, not a checklist to implement wholesale.

The Statement of Applicability is the document that gets audited

Clause 6.1.3 requires the organisation to produce a Statement of Applicability containing the necessary controls, the justification for their inclusion, whether they are implemented, and the justification for excluding any of the Annex A controls.

That final limb is the one firms underestimate. Excluding a control is permitted, but the exclusion must be reasoned and recorded. An auditor reading a Statement of Applicability is reading the organisation’s own argument about its risk, and a thin justification is a finding regardless of how good the implemented controls are.

Competence: clause 7.2, in full

Clause 7.2 requires that the organisation shall:

a) “determine the necessary competence of person(s) doing work under its control”
b) “ensure that these persons are competent on the basis of appropriate education, training, or experience”
d) “retain appropriate documented information as evidence of competence”

Three obligations, each separately auditable. The organisation has to define what competence the role needs — which means writing it down rather than assuming it. It has to be satisfied the person has it, by education, training or experience. And it has to keep evidence.

In practice the third obligation is where audits bite, because firms frequently have competent people and no documentation proving it. A certificate from a course, a record of experience assessed against a defined requirement, a training log tied to a role specification — something has to exist, and a general assertion that the team is experienced does not satisfy the clause.

Awareness: clause 7.3, which is not the same thing

Clause 7.3 applies far more widely. Persons doing work under the organisation’s control shall be aware of:

a) “the information security policy”
b) “their contribution to the effectiveness of the information security management system”
c) “the implications of not conforming with the information security management system requirements”

Note the scope: persons doing work under the organisation’s control, not employees. That reaches contractors, temporary staff and in many arrangements outsourced service personnel. And note limb (b) — awareness of one’s own contribution to the system, which is a higher bar than having read a policy. A generic annual e-learning module that never mentions the organisation’s own policy or what this role contributes does not obviously meet it.

The distinction between 7.2 and 7.3 is the one to get right when designing a training programme. Competence is role-specific, defined and evidenced. Awareness is universal, organisation-specific and behavioural. They need different content and different records.

Who certifies, and who checks the certifier

Certification is issued by a certification body, which is itself accredited by a national accreditation body under International Accreditation Forum rules. That chain is why an accredited certificate means something and an unaccredited one does not.

IAF mandatory document MD 13:2022 sets out the knowledge areas an accreditation body’s assessors must hold, and the list is a reasonable proxy for the expertise the whole system assumes: management system terminology and principles including ISO/IEC 27000; audit techniques from ISO/IEC 27007 and ISO/IEC TS 27008; ISO/IEC 17021-1 and ISO/IEC 27006; ISO/IEC 27001 itself; general legal and regulatory requirements; generic information security technology and risk management including ISO/IEC 27005; and the client’s own processes and operations. Each assessor must individually hold the first five areas; the last two may be held across the team.

MD 13 also ties competence to the technical area being assessed, requiring knowledge of the typical business activities, the ICT, and the information security technologies and practices specific to that area. Sector knowledge is treated as part of competence rather than a nice-to-have — which is the same principle that makes sector-framed training more useful than generic security awareness.

Why regulated firms get asked for it

For finance, healthcare and legal organisations the pressure usually arrives through a third party rather than a regulator. A client’s procurement process asks for the certificate; a panel tender makes it a condition; an insurer asks at renewal. The certificate functions as a transferable assurance that saves every counterparty running its own audit.

That makes it a commercial document as much as a technical one, and it is why board-level ownership matters — a point we cover in our guide to board cyber governance and audit committee oversight. For law firms in particular, where client confidentiality obligations run alongside it, see our guide to breach response, confidentiality and privilege. Our CPD course library covers the governance, risk and audit disciplines the management system clauses assume.

Frequently asked questions

Is a 2013 certificate still valid?

It should not be in use. Certification bodies were required to complete the transition of all client certificates by 31 October 2025 under the UKAS timetable and IAF MD 26, so current certificates should reference ISO/IEC 27001:2022.

Does ISO 27001 certification mean a firm is secure?

No. It means the firm operates a management system meeting the standard’s requirements, with controls selected and justified against its own risk assessment. It is an assurance about process and governance, not a guarantee about outcomes.

Do all Annex A controls have to be implemented?

No. Clause 6.1.3 treats Annex A as a comprehensive list of possible controls, and requires the Statement of Applicability to record the justification for excluding any of them. Exclusion is permitted; unexplained exclusion is not.

Does awareness training cover contractors?

Clause 7.3 applies to persons doing work under the organisation’s control, which is broader than employees and will generally include contractors and comparable arrangements.

Is general security awareness training enough for clause 7.2?

No. Clause 7.2 is role-specific: the organisation must determine the competence a role requires, ensure the person holds it through education, training or experience, and retain documented evidence. Awareness training addresses clause 7.3, which is a separate requirement.