# ISO 27001 audit preparation: what the standard asks for and how to get the technical controls ready

> What ISO/IEC 27001:2022 requires, how its 93 Annex A controls are organized, and how to have the technical ones working and evidenced before your audit.

Author: Samuel Hinojosa (CEO & Founder, WITS) · Updated: 2026-10-25 · https://security.wits.mx/en/guides/iso-27001-audit-prep/

## What is ISO 27001 and what is it for?

ISO/IEC 27001 is the international standard that sets the requirements for an information security management system (ISMS). It helps you manage risks to your information in a structured way and, if you choose, prove it with a certificate issued by an independent body. The current edition is from 2022, with a 2024 amendment.

[ISO/IEC 27001:2022](https://www.iso.org/standard/27001) was published in October 2022 as the third edition, replacing the 2013 version. In February 2024 ISO published [Amendment 1](https://www.iso.org/standard/88435.html), «Climate action changes», which asks organizations to consider climate change as part of their context; it adds no security controls. ISO and the IEC publish the standard jointly, which is why the full name carries both.

Certification is optional. ISO notes that some companies implement the standard for its good practices while others pursue the certificate to reassure customers. In practice, what makes it necessary is usually an enterprise customer, a procurement questionnaire or a contract that lists it as a requirement.

> **Who certifies** ISO doesn't certify or issue certificates, as its [certification page](https://www.iso.org/certification.html) states. External certification bodies do, ideally accredited ones. WITS doesn't certify either. We help you prepare the technical controls and the evidence for your audit.

## What does the standard require: clauses and Annex A?

ISO 27001 has two parts. Clauses 4 to 10 describe the management system: context of the organization, leadership, planning, support, operation, performance evaluation and improvement. That's where risk assessment and treatment, internal audit and management review live. Annex A is the reference catalog of controls you compare your chosen controls against.

In the 2022 edition, Annex A has 93 controls in four themes, according to certification body [DQS](https://www.dqsglobal.com/blog/new-iso-27001-2022-key-changes). Eleven are new, including threat intelligence, information security for cloud services, configuration management and secure coding. Detailed guidance for each control lives in [ISO/IEC 27002:2022](https://www.iso.org/standard/75652.html).

| Annex A theme | Controls | Examples |
|---|---|---|
| 5. Organizational | 37 | Policies, access control, suppliers, cloud services, incident management, continuity |
| 6. People | 8 | Screening, terms of employment, awareness, remote working |
| 7. Physical | 14 | Perimeters, office entry, equipment, storage media |
| 8. Technological | 34 | Privileged access, authentication, vulnerabilities, configuration, backup, logging, networks, cryptography, secure development |

Not every control applies to every company. Clause 6.1.3 requires a Statement of Applicability: the document where you state which controls you apply, which you don't and why. The auditor reviews that statement and then asks for evidence that what you declared actually works.

## Which technical controls can Security OS help you prepare?

Companies rarely get stuck writing the policy. They get stuck proving the technical control exists and works. «We use MFA» isn't evidence; a report listing every cloud user with their second factor is. Security OS audits your cloud, repositories, code and servers, fixes issues with your approval, and records the before and after for each control.

| Annex A control | What we review and fix | Evidence you keep |
|---|---|---|
| 5.15 to 5.18 Access control, identity, authentication information and access rights | Users, roles and keys in the cloud and GitHub; access held by former staff and vendors | Dated access inventory with a before-and-after comparison |
| 8.2 Privileged access rights and 8.5 Secure authentication | Root account, admins, MFA, unrotated keys, SSH access | MFA status per user and status of every key |
| 8.8 Management of technical vulnerabilities | OS, PHP and dependency versions; published flaws that affect you | Prioritized findings with fix and close date |
| 8.9 Configuration management | Configuration baseline for cloud and servers, and drift from it | Baseline and differences between runs |
| 8.13 Information backup | Database and storage backups, copies protected from deletion | Backup configuration and restore test record |
| 8.15 Logging and 8.16 Monitoring activities | Cloud activity logging, detection alerts and who receives them | Logging configuration and active alerts |
| 8.20 Networks security and 8.24 Use of cryptography | Open ports, firewall, TLS, disk and database encryption | Network rules and encryption status per resource |
| 8.25 and 8.28 Secure development and secure coding | Code review (SQL injection, XSS, secrets, dependencies) and branch protection | Findings with file and line, and their fix |

Each fix arrives prepared with what changes, why and how to roll it back. Nothing is applied without your approval. You end up with two runs of the same audit engine, before and after, control by control: material your consultant can fold into the ISMS and that you can present to the auditor. The auditor decides what evidence to accept; our job is to make sure yours is complete and dated.

If your system runs on AWS, the [AWS security audit guide](https://security.wits.mx/en/guides/aws-security-audit/) details the account-level controls. If you're starting from zero, close [the cybersecurity basics](https://security.wits.mx/en/guides/smb-cybersecurity/) first and check [this week's alerts](https://security.wits.mx/en/alerts/) so you don't walk into the audit on a vulnerable version.

## What stays with you, your consultant and the certification body?

ISO 27001 is a management standard, not a technical checklist. Some of it no tool can do for you:

- Your company: define the ISMS scope, assign owners, approve the security policy and keep the system running over time.
- Your ISMS consultant, if you have one: risk assessment and treatment, the Statement of Applicability, policies and procedures, training and internal audit.
- People and physical controls (themes 6 and 7): hiring, awareness, office access, equipment.
- The certification body: the certification audit and surveillance audits. It should be independent from whoever helped you implement.

> **What we don't do** We don't certify, we aren't a certification body and we don't write your whole ISMS. We focus on the technical side of Annex A: making sure cloud, code and server controls are in place, with before-and-after evidence. If you already work with a consultant, we coordinate with them.

If your customer or industry also asks for a pentest, our [pentest vs. security audit guide](https://security.wits.mx/en/guides/pentest-vs-security-audit/) explains why to close the basics first and who should run the test. For a first data point in five seconds, the [free check](https://security.wits.mx/en/php-check/) reviews the PHP version your site advertises.

Tell us your scope and audit date. We start with a read-only diagnostic. [Get my technical controls ready](https://security.wits.mx/en/guides/iso-27001-audit-prep/#contacto)

## Frequently asked questions

**What is ISO 27001?**

It's the international standard that sets the requirements for an information security management system. It helps you manage risks to your information in a structured way and, optionally, prove it with a certificate from an independent body.

**What is the current version of ISO 27001?**

ISO/IEC 27001:2022, published in October 2022, with Amendment 1 from 2024 on climate action. The 2013 edition has been withdrawn.

**How many controls are in ISO 27001:2022 Annex A?**

93, grouped in four themes: 37 organizational, 8 people, 14 physical and 34 technological. The 2013 edition had 114.

**Do I have to implement all 93 controls?**

Not necessarily. In the Statement of Applicability you state which controls you apply and justify the ones you exclude, based on your risk assessment.

**Who issues the ISO 27001 certificate?**

An external certification body. ISO doesn't certify or issue certificates. Choose an accredited body that is separate from whoever helped you implement.

**What's the difference between ISO 27001 and ISO 27002?**

ISO 27001 holds the requirements that get audited and certified. ISO 27002 is guidance on how to implement each Annex A control; it isn't certifiable.

**Does WITS or Security OS certify me?**

No. We help you prepare the technical side: we implement and evidence access, vulnerability, configuration, backup, logging, network and secure development controls so you reach your audit with complete evidence.

## Sources

- [ISO: ISO/IEC 27001:2022, Information security management systems — Requirements](https://www.iso.org/standard/27001)
- [ISO: ISO/IEC 27001:2022/Amd 1:2024, Climate action changes](https://www.iso.org/standard/88435.html)
- [ISO: ISO/IEC 27002:2022, Information security controls](https://www.iso.org/standard/75652.html)
- [ISO: Certification (ISO does not perform certification)](https://www.iso.org/certification.html)
- [DQS: ISO/IEC 27001:2022, key changes and new Annex A](https://www.dqsglobal.com/blog/new-iso-27001-2022-key-changes)