ISO 27000 AND INFORMATION SECURITY MANAGEMENT SYSTEMS:
STANDARDS AND PRACTICE Review Article Keywords: ISO 27001 • ISMS • Information Security • Risk Management • Annex A Controls • PDCA • Certification ABSTRACT Information stands out as the most valuable asset of today's digital economy, and the rapid rise in cyber threats and data breaches is forcing organisations to treat information security as a strategic management issue. In this context the ISO/IEC 27000 family of standards, and its certifiable core ISO/IEC 27001 Information Security Management System (ISMS), have become the common language of information security management worldwide. This review article addresses comprehensively the ISO 27000 family of standards, the structural changes introduced by the ISO/IEC 27001:2022 revision, the PDCA-cycle-based ISMS architecture, the Annex A structure covering 93 controls, risk management methodology, mandatory documentation requirements, the certification process, the integration of ISO 27001 with Turkish legislation, implementation examples in Türkiye, global certification growth trends and the 2025 transition requirement. According to ISO Survey 2024 data, the standard has reached 96,709 valid certificates worldwide, recording growth of over one hundred per cent since 2018. That growth makes concrete the permanent place of information security among corporate priorities.
Keywords: ISO 27001, ISO 27002, ISMS, information security management system, PDCA cycle, Annex A controls, risk management, statement of applicability, SoA, asset inventory, certification, TSE, TÜRKAK, KVKK, cybersecurity ABSTRACT Information has emerged as the most valuable asset in today's digital economy, and the rapid increase in cyber threats and data breaches is compelling organizations to treat information security as a strategic management issue. In this context, the ISO/IEC 27000 family of standards and its certifiable core, ISO/IEC 27001 Information Security Management System (ISMS), have become the common language of information security management worldwide. This review article comprehensively addresses the ISO 27000 standards family, structural changes brought by the ISO/IEC 27001:2022 revision, PDCA cyclebased ISMS architecture, the Annex A structure covering 93 controls, risk management methodology, mandatory documentation requirements, certification process, integration of ISO 27001 with Turkish legislation, implementation examples in Turkey, global certification growth trends and the 2025 transition requirement. According to ISO Survey 2024 data, the standard has reached 96,709 valid certificates worldwide, achieving growth of over 100% since 2018.
Keywords: ISO 27001, ISO 27002, ISMS, information security management system, PDCA cycle, Annex A controls, risk management, statement of applicability, SoA, asset inventory, certification, TSE, TÜRKAK, KVKK, cybersecurity 1. Introduction Information security has become one of the most critical corporate governance issues of the 21st century. IBM's 2024 Cost of a Data Breach Report shows that the global average cost of a data breach reached USD 4.88 million, the highest figure of the past four years and a ten per cent increase on 2020. In the healthcare sector that figure reached USD 9.77 million, retaining the highest sectoral value for the fourteenth consecutive year. These data show beyond dispute that information security is no longer merely an IT matter but a management discipline of strategic importance for corporate governance, legal compliance and business continuity.
In this context ISO/IEC 27001 stands out as the international standard addressing information security management with a systematic, risk-based philosophy of continuous improvement. According to ISO's (ISO, 2022) definition, the standard 'provides companies of any size and from all sectors of activity with guidance for establishing systems to deal with risks related to the data they own or handle.' According to ISO Survey 2024 data, the standard almost doubled on the previous year in 2024 to reach 96,709 valid certificates, with 179,877 certified sites (HEIC, 2025).
In Türkiye a broad range of organisations — chiefly public institutions, the finance sector and telecommunications companies — are moving towards ISO/IEC 27001 certification. TSE continues its certification and training activities under TS EN ISO/IEC 27001:2023, and in 2024 a mapping table was prepared between the Information and Communication Security Guide published by the Presidential Digital Transformation Office and the ISO 27001 controls (Denetci.org, 2025).
The aim of this article is to set out comprehensively the ISO 27000 family of standards and ISMS practice in both its technical and its managerial dimensions. The article is structured under the headings of the structure of the standards family, the 2022 revision, ISMS architecture, risk management, Annex A controls, the certification process, the legal framework in Türkiye and implementation examples.
2. The ISO 27000 Family of Standards 2.1 The Structure and Logic of the Family The ISO/IEC 27000 series is a broad family of standards covering information security management. Each member of the ISO 27000 family has a specific subject on which it focuses: while ISO 27001 is the core presenting the big picture, the other family members are consulted in order to implement those subjects (Yüksektepeli, 2013). This structure enables a modular and scalable information security management infrastructure to be built. The basic logic of the family is this: ISO 27001 defines 'what must be done' while ISO 27002 explains 'how it will be done' (Secureframe, 2025). Although ISO 27001 is a certifiable standard, ISO 27002 is a guide organisations apply to improve their performance and cannot be certified. The other family members are positioned as complementary documents deepening this core on a sectoral or topic basis.
Table 1. Principal Members of the ISO/IEC 27000 Family of Standards Standard Subject Description ISO/IEC 27000 Terms and Overview Basic concepts, definitions and the general structure of the family ISO/IEC 27001 ISMS Requirements (Certifiable) Requirements for establishing, implementing, maintaining and improving an ISMS ISO/IEC 27002 Code of Practice for Information Security Controls Purpose, guidance and implementation detail for 93 controls ISO/IEC 27003 ISMS Implementation Guide Practical guidance on how to implement ISO 27001 ISO/IEC 27004 Information Security Measurement Techniques Methods for measuring and monitoring ISMS performance ISO/IEC 27005 Information Security Risk Management Methodological framework for risk assessment and treatment ISO/IEC 27006 Requirements for Certification Bodies Guidance for accredited ISMS audit and certification bodies ISO/IEC 27017 Cloud Computing Security Cloud computing information security controls based on ISO 27002 ISO/IEC 27018 Personal Data Privacy in the Cloud Controls for protecting personal data (PII) in the cloud environment ISO/IEC 27031 ICT Readiness for Business Continuity Guide to ICT infrastructure readiness for business continuity ISO/IEC 27032 Cybersecurity Guide Guide to inter-organisational cybersecurity coordination Standard Subject Description ISO/IEC 27035 Security Incident Management Principles and process of information security incident management ISO/IEC 27701 Privacy Information Management Privacy extension of ISO 27001 for GDPR/KVKK compliance Note. Compiled on the basis of Yüksektepeli (2013); Ekşi (2023); KUM Eğitim (2021); ISO (2022). 2.2 The Difference Between ISO/IEC 27001 and ISO/IEC 27002 The difference between ISO 27001 and ISO 27002 is one of the most frequently asked questions in information security practice. As Secureframe (2025) explains: 'You can think of ISO 27001 as the "what" and ISO 27002 as the "how" of compliance.' ISO 27001 is the standard defining the requirements for establishing, maintaining and continuously improving an ISMS, and it can be certified through external audit by independent accredited bodies. ISO 27002 is a complementary guide to ISO 27001, explaining in greater detail the purpose, design and implementation of each control in Annex A.
This relationship may be likened to the difference between a building's development plan and its construction specification: ISO 27001 determines what must be built, while ISO 27002 describes how each room will be fitted out. An organisation may be certified to ISO 27001; but there is no ISO 27002 certification — that standard is purely an implementation guide.
2.3 ISO/IEC 27701: The Privacy Extension and Its Relationship with the GDPR/KVKK ISO/IEC 27701:2019 is an extension standard broadening ISO 27001 for privacy information management. This standard integrates into the ISO 27001 framework the privacy requirements with which organisations must comply as a Personal Data Processor (PII Processor) or Personal Data Controller (PII Controller). Creating a strong compliance bridge with the GDPR and with Law No. 6698 (KVKK) in Türkiye, this standard enables data protection compliance to be built on top of the ISO 27001 ISMS infrastructure.
According to the assessment of Vertacert (2025), the integration of ISO 27001 and the KVKK offers the following practical synergy: the Asset Inventory can be mapped to the Personal Data Processing Inventory; personal data breach risks can be added to the information security risk analysis; the incident management procedure can be revised in line with the KVKK's 72-hour notification obligation; and control A.8.10 of ISO 27001:2022 (Information Deletion) can be combined with the KVKK's Retention and Destruction Policy. 3. The ISO/IEC 27001:2022 Revision: Changes and Innovations 3.1 The Background and Publication of the Revision The current version of ISO/IEC 27001 was published in October 2022. In the nine years since the previous version, ISO/IEC 27001:2013, the technological environment changed fundamentally; new threat and risk categories such as cloud computing, remote working, supply chain attacks and ransomware made an update of the standard essential. As LRQA (2025) recounts, 'the 2022 revision retains much of the core principles and processes of the 2013 standard while containing modernised controls addressing today's cybersecurity environment and refining certain areas.' As regards the transition timetable: the new standard was published on 25 October 2022. From April 2024 initial and recertification audits against ISO 27001:2013 ceased. On 31 October 2025 all ISO 27001:2013 certificates expired or had to be withdrawn (SGS, 2024). From that date every certification audit is conducted only against the 2022 version.
3.2 Structural Changes at Clause Level The ISO 27001:2022 revision introduced many important changes at clause level. According to the comprehensive assessment by A-LIGN (2025), the principal ones are: Clause 4.2 — Needs of Interested Parties: organisations must no longer merely list interested parties but must document explicitly which of those parties' requirements will be addressed through the ISMS. In BALTUM's (2026) words, 'this requires documented analysis; a stakeholder list alone no longer meets the standard.' Clause 4.4 — ISMS Scope: the standard now requires organisations to determine the processes needed for the ISMS and their interactions with one another. This represents a move from purely document-based compliance thinking to process-based thinking. Clause 6.2 — Information Security Objectives: information security objectives must now be monitorable, and how monitoring will be carried out must be documented explicitly. A static register of objectives no longer meets this requirement.
Clause 6.3 — Planning of Changes (NEW): this is an entirely new sub-clause. Changes needed to the ISMS must be carried out in a planned manner. This formalises change management at management system level. Clause 9.3 — Management Review: review inputs must now explicitly include changes in the needs and expectations of interested parties relevant to the ISMS. This is directly linked to the new requirement in Clause 4.2.
Clause 10 — Continual Improvement (Reordering): the order has changed: continual improvement (10.1) now comes before nonconformity and corrective action (10.2). This conveys the message that improvement must be proactive rather than merely reactive. 3.3 Annex A: Restructuring from 114 to 93 Controls The most visible change in ISO 27001:2022 is the restructuring of Annex A. While the 2013 version contained 114 controls in 14 control categories, the 2022 version moves to 93 controls in 4 control categories. As SGS (2024) explains, '11 controls have been newly added, 24 controls have been merged from existing controls and 58 controls have been updated.' This transformation is not a reduction but a modernisation and recategorisation of the controls. The 11 newly added controls are particularly notable. These controls include Threat Intelligence (A.5.7), Information Security for Use of Cloud Services (A.5.23), ICT Readiness for Business Continuity (A.5.30), Physical Security Monitoring (A.7.4), Configuration Management (A.8.9), Information Deletion (A.8.10), Data Masking (A.8.11), Data Leakage Prevention (A.8.12), Monitoring Activities (A.8.16), Web Filtering (A.8.23) and Secure Coding (A.8.28). These controls respond directly to the new security requirements brought by cloud infrastructure, remote working and hybrid environments.
Figure 1. ISO/IEC 27001:2022 Annex A: 93 Controls — Distribution Across 4 Categories 4. ISMS Architecture: The PDCA Cycle and the Clause 4–10 Structure Figure 2. The ISMS PDCA Cycle — Mapping to ISO/IEC 27001:2022 Clauses 4–10 4.1 The PDCA Cycle and the Philosophy of Continual Improvement ISO/IEC 27001 is founded on the management of the ISMS within the framework of the Plan-Do-Check-Act (PDCA) cycle. This approach creates a common structural language with ISO 9001 Quality Management Systems and other ISO management standards, facilitating the establishment of an integrated management system. The ISMS is not a static compliance framework but a dynamic management mechanism able to respond to changes in the threat environment and to transformations in the organisational context (ISO, 2022).
The PDCA cycle as reflected in the ISMS: the Plan phase takes place through the organisation's determination of its context, its interested parties, the ISMS scope, its information security risks and its objectives in relation to those risks (Clauses 4–6). The Do phase is completed through the actual implementation of the controls and policies determined, the activation of support mechanisms and the conduct of ISMS operations (Clauses 7–8). The Check phase is carried out through monitoring, measuring, analysing and evaluating ISMS performance (Clause 9). The Act phase covers the remedying of nonconformities and continual improvement activities (Clause 10). 4.2 Clause 4: The Context of the Organisation Clause 4 of ISO 27001:2022 requires the organisation to understand its internal and external factors systematically, in order to prevent the ISMS from becoming a template detached from the business context. As BALTUM (2026) stresses, the 2022 revision 'encourages a comprehensive analysis including interested parties, the processes needed and the roles within the ISMS.' Internal factors include the size and structure of the organisation, management culture, existing IT infrastructure, employee profile and the complexity of business processes. External factors may be assessed under the headings of legal and regulatory obligations, customer and supplier requirements, the competitive environment and the sectoral threat landscape. In the Turkish context, Law No. 6698 (KVKK), Electronic Communications Law No. 5809 and the Information Security Guide (CBdDO, 2024) stand out in particular among external factors.
4.3 Clause 5: Leadership and Top Management Commitment ISO 27001 positions information security not merely as the responsibility of the IT department but as a corporate governance matter owned directly by top management. As Konfirmity (2026) stresses, 'the standard requires organisational context, leadership commitment and supplier management. Environmental risks, business continuity and people controls concern managers, procurement and HR departments. A siloed approach results in audit failure.' Top management's commitment to the ISMS takes concrete form in approving the information security policy, integrating the ISMS with business objectives, allocating the necessary resources, assigning roles and responsibilities and holding management review meetings regularly. In the ISO 27001 certificate of the Turkish Ministry of Trade (2024) that commitment is expressed as follows: 'It was established in order to ensure the confidentiality, integrity and availability of the information assets held by our General Directorate, to safeguard technological resources and to create information security awareness.' 5. Risk Management: The Cornerstone of ISO 27001 5.1 Risk Assessment Methodology ISO/IEC 27001 places risk management at the heart of the ISMS. The standard does not dictate a risk assessment methodology; instead it requires the organisation to document and apply its own methodology consistently. This documentation of methodology is critically important for auditors to understand the process and verify its repeatability (Vertacert, 2025).
The commonly used risk assessment approach involves the following steps: Asset Identification — inventorying the organisation's information assets (hardware, software, data, human resources, physical environments). Threat Analysis — potential threats to each asset (cyber attack, natural disaster, human error, supplier breach) are defined. Vulnerability Identification — the weaknesses each asset carries in relation to each threat are determined. Risk Score Calculation — risk levels are quantified using a Likelihood × Impact formula or a similar methodology. The concrete scenarios offered by Vertacert (2025) bring the risk assessment process to life: scenarios such as 'flooding of the server room' or 'an accounting employee clicking a phishing email' show how threat–vulnerability combinations are modelled. If the score arising from these scenarios exceeds the acceptable risk threshold, one of the strategies of mitigation, avoidance or transfer is selected. 5.2 Risk Treatment Options Risk treatment is the process of deciding what to do about risks following the assessment stage. ISO 27001 offers four basic risk treatment options.
• Mitigate: reducing the risk to an acceptable level by applying a control. This is the most common method; the Annex A controls serve as the primary tool for this option. • Transfer: transferring the risk to a third party by taking out insurance or purchasing an external service. Cyber security insurance is the most common example. • Avoid: abandoning entirely the activity giving rise to the risk. Not offering certain services where the cost of regulatory compliance is very high is an example. • Accept: consciously accepting the risk. This is chosen where the risk level remains below the acceptable threshold or where the cost of mitigation exceeds the risk.
5.3 The Statement of Applicability (SoA) The Statement of Applicability (SoA) is described as the most critical audit document of the ISMS. As DSR Belgelendirme (2026) recounts, the SoA is 'the most critical audit document, showing which of the 93 controls have been selected.' Under the standard the SoA must contain the list of controls selected, the justification for including or excluding each control, its implementation status and how the selected control is implemented (A-LIGN, 2025). The SoA is the 'fingerprint' of the ISMS: the SoAs of two organisations cannot be identical, because risk profile, sector, scope and business context differ in every organisation. The set of controls that comes to the fore for a manufacturer operating in the automotive sector and for a hospital processing health data will differ greatly. This individualisation is the basic mechanism that makes ISO 27001 applicable irrespective of sector or size.
6. Asset Inventory and Classification 6.1 Types of Information Asset Creating an asset inventory is one of the first steps in establishing an ISMS. According to KUM Eğitim (undated), information assets are addressed in the following categories: Software assets — enterprise applications, operating systems, licensed software, bespoke development products. Hardware assets — servers, workstations, network devices, storage systems, mobile devices.
Data assets — databases, customer records, financial data, trade secrets and personal data. Service assets — cloud services, internet connectivity, data centre services. Human assets — key personnel holding critical information, managers, system administrators. Physical assets — server rooms, office buildings and security infrastructure. In the asset inventory an owner must be assigned for each asset and a criticality score determined in terms of confidentiality (C), integrity (I) and availability (A) (Vertacert, 2025).
6.2 The CIA Triad: Confidentiality, Integrity, Availability The CIA (Confidentiality-Integrity-Availability) triad, the fundamental trio of information security, defines the protective dimensions on which all ISMS controls focus. As CTR (undated) puts it, 'information security is the protection of the confidentiality, integrity and availability of information.' Confidentiality: information is accessible only to authorised persons. Encryption, access control and the principle of least privilege support this dimension. Integrity: information is protected from unauthorised alteration and its accuracy is assured. Digital signatures, hash verification and change monitoring mechanisms protect this dimension.
Availability: the assurance that authorised users can access information at the moment they need it. Backup systems, load balancing and business continuity plans support this dimension.
7. Annex A Controls: An In-Depth Examination of the Four Categories 7.1 Organisational Controls (37 Controls: A.5.1 – A.5.37) Organisational controls cover the policy, process and management dimension of the ISMS. Under A.5.1, information security policies must be approved by top management, documented and reviewed at regular intervals. A.5.2–A.5.4 govern roles, responsibilities and segregation of duties: to prevent conflicts of interest, the same individual must be prevented from both approving and implementing a change. The A.5.7 Threat Intelligence control, newly added in the 2022 version, requires the organisation to collect and analyse relevant information security threats. This control makes it mandatory to formalise threat intelligence platforms (SIEM, ISAC sharing mechanisms) within the ISMS. A.5.23 is a new control covering information security for cloud services; it defines requirements for cloud supplier assessment, contractual security clauses and a cloud data management policy. The A.5.36 Compliance with Policies, Rules and Standards for Information Security control requires the organisation to verify regularly the compliance of all employees and relevant parties with its own information security policies and procedures. The A.5.37 Documented Operating Procedures control requires operating procedures for information processing facilities to be documented and made available to relevant users. 7.2 People Controls (8 Controls: A.6.1 – A.6.8) People controls cover employees' relationship with information security processes. The A.6.1 Screening control requires pre-employment verification processes — identity confirmation, reference checks and, where applicable, security vetting — for all personnel with access to information processing facilities.
The A.6.3 Information Security Awareness, Education and Training control requires the organisation to provide all employees with information security awareness training consistent with their duties and responsibilities, and to record that training. Auditors generally examine annual training completion rates and whether training content reflects the current threat environment.
The A.6.7 Remote Working control, which came to the fore with the 2022 version, defines the security measures needed for accessing and processing information while working remotely. Responding directly to the security gap created by the remote and hybrid working models permanently institutionalised by the COVID-19 pandemic, this control covers VPN policies, mandatory screen locking and home network security standards. 7.3 Physical Controls (14 Controls: A.7.1 – A.7.14) Physical controls cover the physical security of server rooms, office buildings and other sensitive areas. A.7.1–A.7.2 define security perimeters and physical entry controls, covering the use of card readers, security cameras and visitor registration systems.
A.7.4 Physical Security Monitoring is a new control added in the 2022 version. Requiring continuous monitoring against unauthorised physical access to sensitive areas, this control lays direct groundwork particularly for data centre physical security monitoring systems. The A.7.8 Equipment Siting and Protection control covers positioning hardware with regard to both physical and environmental threats (heat, humidity, flooding). A.7.9 Security of Assets Off-Premises defines security requirements for laptops, smartphones and portable storage devices. A.7.14 Secure Disposal of Equipment requires the secure destruction of data remaining on storage media.
7.4 Technological Controls (34 Controls: A.8.1 – A.8.34) Technological controls form the category covering the technical security dimension of the ISMS most comprehensively. A.8.1 User Endpoint Devices defines the security policies to be applied on laptops, smartphones and tablets. A.8.2 Privileged Access Rights covers the management of administrator accounts and the application of the principle of least privilege.
A.8.9 Configuration Management is one of the new controls in the 2022 version. It requires security configurations for all components, including hardware, software, services and networks, to be established, documented, implemented, monitored and reviewed. This control directly supports the integration of a DevSecOps culture into the ISMS framework.
The A.8.11 Data Masking and A.8.12 Data Leakage Prevention (DLP) controls reflect the increased importance the 2022 version attaches to data protection. Under the DLP controls, organisations must apply technical measures against the unauthorised copying, transmission or disclosure of sensitive data. A.8.23 Web Filtering covers controls for restricting employees' access to malicious or inappropriate web content. A.8.28 Secure Coding, added in the 2022 version, is a control of critical importance particularly for organisations that develop software. It requires the application of coding practices consistent with OWASP principles and secure software development lifecycle (SDLC) methodologies.
Table 2. The 11 New Controls Added to Annex A of ISO/IEC 27001:2022 Control No. Control Name Scope / Requirement A.5.7 Threat Intelligence Collection and analysis of relevant information security threats A.5.23 Information Security for Cloud Services Security process for the acquisition, use, management and exit of cloud services A.5.30 ICT Readiness for Business Continuity Alignment of ICT with business continuity objectives and requirements A.7.4 Physical Security Monitoring Continuous monitoring against unauthorised physical access to sensitive areas A.8.9 Configuration Management Establishment, monitoring and review of security configurations for all components Control No. Control Name Scope / Requirement A.8.10 Information Deletion Secure deletion of unnecessary information on systems, devices and media A.8.11 Data Masking Application of sensitive data masking based on privacy and compliance requirements A.8.12 Data Leakage Prevention Implementation of DLP tools and policies to prevent unauthorised data disclosure A.8.16 Monitoring Activities Network and system monitoring for the detection of anomalies and unusual behaviour A.8.23 Web Filtering Control of access to websites hosting malware and unauthorised content A.8.28 Secure Coding Application of secure coding principles to reduce software vulnerabilities Note. Compiled on the basis of SGS (2024); A-LIGN (2025); secureframe.com (2025); goteleport.com (2025).
8. The ISMS Implementation Roadmap Figure 3. The ISMS Implementation Roadmap — An 8-Stage Process Model (ISO/IEC 27001:2022) 8.1 Gap Assessment The first step in establishing an ISMS is the systematic identification of the gaps between the current state and the ISO 27001 requirements. On A-LIGN's (2025) advice, 'in the transition from the 2013 version, organisations should conduct a gap assessment mapping the existing ISMS against the 2022 version and determine which changes are required.' This assessment must cover two dimensions: the clause compliance gap (Clauses 4–10 requirements) and the Annex A control gap (particularly gaps relating to the 11 new controls). 8.2 Mandatory Documentation Requirements ISO/IEC 27001 requires certain documents and records to be in place. The list of mandatory documents compiled by isodestek.com (2025) includes the following: Mandatory Documents: ISMS Scope Document — defines the boundaries of the ISMS and which units and assets it covers (Clause 4.3). Information Security Policy — the commitment document approved by top management. Information Security Objectives — monitorable objectives and the methodology for how they will be monitored. Statement of Applicability (SoA) — shows which of the 93 controls have been selected and the justifications. Risk Treatment Plan (RTP) — the actions to be taken against the risks identified. Risk Assessment Procedure — the methodology for how risks will be identified and rated.
Mandatory Records: records of training, experience and skills. Monitoring and measurement results. The internal audit programme and its results. Management review results. Records of nonconformity and corrective action. Risk assessment results and evidence of implementation of the risk treatment plan. 8.3 Internal Audit and Management Review ISO 27001's continual improvement mechanism operates through internal audit and management review. Internal audit assesses whether the ISMS meets the requirements of the standard and whether the planned processes are being implemented effectively. As onlinestandart.com (2025) recounts, internal audit and management review must be complete before the external audit. Management review is a meeting process in which top management periodically assesses ISMS performance. With the 2022 revision, the inputs to that meeting must include follow-up actions from previous reviews, changes in internal and external issues, information security performance indicators and changes in the needs and expectations of interested parties.
9. The Certification Process 9.1 Stage 1 Audit: Document Review The ISO 27001 certification process consists of a two-stage independent external audit. In the first stage audit, the experienced auditor of the accredited certification body examines the organisation's mandatory documentation comprehensively — particularly the ISMS scope, information security policy, risk assessment procedure and Statement of Applicability. The purpose of this stage is to determine whether the organisation is ready for the second stage. 9.2 Stage 2 Audit: On-Site Audit As DSR Belgelendirme (2026) recounts, the basic question of the second stage certification audit is: 'Are you implementing the ISMS documents you have prepared?' At this stage the auditor observes on site how the controls are implemented in the field, employees' compliance with security policies, the effectiveness of technical measures and the consistency of records. The results and recommendations of the Stage 2 audit are generally notified the same day. Nonconformities identified during the audit are classified at two levels: major nonconformities denote failure to meet a mandatory requirement or the total absence of an implementation, and prevent the certificate from being issued. Minor nonconformities describe situations where the requirement is partly met but contains deficiencies; the certificate can be obtained once corrective action is completed within a specified period (Johanson Group, 2024).
9.3 Surveillance Audits and Renewal The process does not end once the certificate is obtained. An ISO 27001 certificate is valid for three years, during which annual surveillance audits are mandatory. As DSR Belgelendirme (2026) states, 'the reputation of ISO certification rests on the principle of continual improvement.' At the end of the third year a recertification audit is conducted and a new certificate issued. This process is made concrete in the example of the Information Technologies General Directorate of the Turkish Ministry of Trade: 'Our General Directorate, which has held ISO 27001 certification since 13.12.2022, published its current certificate on 10.12.2024' (BTGM, 2024). 10. Mandatory Documentation and Records 10.1 Mandatory Documented Information ISO/IEC 27001:2022 identifies 16 types of documented information explicitly required in the clauses of the standard. According to the list from isodestek.com (2025) these documents are: the ISMS scope, the information security policy, information security objectives, the statement of applicability, the risk treatment plan, the risk assessment and risk treatment report, information security duties and responsibilities, the asset inventory, acceptable use of assets, the access control policy, operating procedures for IT management, secure system engineering principles, the supplier security policy, the information security incident response procedure, the implementation of information security continuity and the identification of applicable legal/contractual requirements. 10.2 Mandatory Records In addition to documents, ISO 27001 also defines records that must be kept as evidence of certain activities. These mandatory records are: records of training, experience, skills and qualifications; monitoring and measurement results; the internal audit programme and its results; management review results; and records of nonconformity and corrective action.
As DSR Belgelendirme (2026) observes, it is not mandatory to write a separate document for each clause; more than one requirement can be met in a single document. Conversely, more than one document may be needed for some requirements. The documentation architecture must be adapted to the size and complexity of the organisation.
11. The ISMS in Türkiye: Legal Framework and Implementation Examples 11.1 The Relationship Between Turkish Legislation and ISO 27001 In Türkiye ISO/IEC 27001 is adopted and applied as a Turkish standard under the name TS EN ISO/IEC 27001:2023. The TSE (Turkish Standards Institution) offers both certification and training services under this standard, and independent certification bodies operating under TÜRKAK accreditation also provide certification services. Law No. 6698 on the Protection of Personal Data (KVKK) offers a strong compliance synergy with ISO 27001. The technical and administrative measures the law prescribes for personal data security overlap with the great majority of the ISO 27001 controls. Particularly in the areas of access control, encryption, data destruction and breach notification, the integrated application of the two frameworks constitutes the most rational approach in terms of both efficiency and compliance. The mapping table between the Information and Communication Security Guide published by the Presidential Digital Transformation Office in 2024 and the ISO 27001 controls is a critical integration tool for public institutions. As Denetci.org (2025) recounts, that table 'was prepared to help institutions and organisations integrate the ISMS processes they already operate with the implementation steps of the Guide.' 11.2 Implementation Examples in the Public Sector Many public institutions in Türkiye hold ISO 27001 certification. The Ministry of Environment, Urbanisation and Climate Change began ISMS establishment work in 2014 and obtained certification after completing the TSE audit. The Ministry's ISMS document is structured within the following framework: the information systems and infrastructure offered by the Ministry to employees or relevant parties, and all information, documents and products produced using those systems, belong to the Ministry unless legal provisions or a protocol require otherwise (ÇŞİDB, undated). The Information Technologies General Directorate of the Turkish Ministry of Trade obtained ISO 27001 certification in December 2022 and then, in 2024, successfully completed its Second Surveillance Audit and published its current certificate. The Ministry's rationale for the ISMS is expressed as follows: 'to ensure the confidentiality, integrity and availability of the information assets held by our General Directorate, to safeguard technological resources and to create information security awareness' (BTGM, 2024).
11.3 Private Sector Practice and Motivations Interest in ISO 27001 certification in the Turkish private sector has increased markedly in recent years, particularly in the finance, telecommunications, defence and IT services sectors. According to isonedir.com (undated), ISO 27001 certification offers the following advantages: increased customer confidence, a gateway to international trade (particularly in accessing the EU market), reduction of data breach and cyber attack risks, satisfaction of legal and regulatory obligations, and the strengthening of corporate reputation.
Certification costs in Türkiye vary considerably depending on a range of factors. As DSR Belgelendirme (2026) recounts, the principal elements affecting pricing are: the size of the organisation (the total number of employees directly affects audit duration), sectoral risks (the complexity of the sector of operation and data sensitivity), breadth of scope (single site or multi-site) and the existing level of security maturity. 12. Global Certification Trends and Market Growth Figure 4. Global ISO/IEC 27001 Certification Growth 2018–2024 (ISO Survey 2024) 12.1 ISO Survey 2024: The Highest Growth in Its History The 2024 edition of the ISO Survey, published annually by ISO, recorded historic growth in the field of information security management. According to HEIC's (2025) analysis: 'The number of valid certificates almost doubled, rising from 48,671 in 2023 to 96,709 in 2024. The number of certified sites also reached 179,877.' This increase confirms that the priority given to cybersecurity and data protection has grown markedly worldwide. A significant methodological change is also apparent in the 2024 data: for the first time the ISO Survey used anonymised and aggregated data compiled from the IAF CertSearch global database. This methodological shift produced a far more reliable and comprehensive data set than in previous years, which relied on voluntary reporting by certification bodies. It becomes clear in this context that the fall in the 2023 data reflected not a real decline but under-reporting (Prozorov, 2025).
12.2 Geographical Distribution and Türkiye's Position Examining the geographical distribution of ISO 27001 certification, the Asia-Pacific region — particularly Japan, China and India — maintains global leadership. In Europe the United Kingdom, Germany and Italy are among the leading countries. According to DISC InfoSec's (2025) analysis, Poland, South Korea and the United States have also recorded marked growth in recent years.
Although no current publicly shared data exists on the number of ISO 27001 certificates in Türkiye, TSE's active certification programmes and the growing interest in ISMS training are important indicators that certificate numbers are increasing. The mapping table prepared by the Presidential Digital Transformation Office for public institutions and the growing regulatory pressure from the BTK for information security requirements continue to accelerate demand for certification in Türkiye.
12.3 The 2025 Transition Requirement and Sectoral Effects As of 31 October 2025 all ISO 27001:2013 certificates lost their validity. According to BALTUM's (2026) assessment, 'for organisations that treated the ISMS as a static compliance exercise, this transition required significant work.' The basic requirements in that transition process are: conducting a gap analysis against the 2022 edition, updating the statement of applicability and risk treatment plan to correspond to the revised controls in Annex A, and verifying the effectiveness of the new or changed controls selected as applicable by the organisation.
Konfirmity's (2026) observation is particularly striking: 'Certification is no longer merely a tick-box exercise. Auditors now examine control effectiveness. Evidence must show that controls have operated over time and reduced risk. Buyers too use certificates as a starting point and then request detailed assurance artefacts. Compliance without real security exposes organisations to costly breaches.' 13. The ISMS, Cybersecurity Maturity and the Relationship with Other Frameworks 13.1 A Comparison with the NIST CSF ISO 27001 and the NIST Cybersecurity Framework (CSF) constitute two important reference frameworks for information security management. Their basic differences may be summarised as follows: ISO 27001 is a management system standard and can be certified, whereas the NIST CSF is a voluntary framework and cannot be certified. ISO 27001 enjoys global acceptance while the NIST CSF is primarily US-centred. Even so, the two frameworks have overlapping control areas and can be applied in an integrated manner.
13.2 Integration of ISO 27001 and ISO 22301 The integrated application of the ISO 22301 Business Continuity Management System standard with ISO 27001 combines two complementary management system frameworks under a single integrated structure. Controls A.5.30 and A.8.16 of ISO 27001 relate directly to business continuity. Particularly for organisations operating critical infrastructure, this integration makes it possible to meet both security and continuity objectives under a single management system. 13.3 The Effects of Artificial Intelligence and Cloud Security on the ISMS The EU Artificial Intelligence Regulation that entered into force in 2024, and the dominance of cloud services in enterprise IT infrastructure, are transforming the scope and content of the ISMS fundamentally. Controls A.5.23 (Information Security for Cloud Services) and A.5.7 (Threat Intelligence) of ISO 27001:2022 reflect this transformation. But the integration of AI systems into decision-making processes, together with new attack vectors such as data poisoning and model theft, brings forth new threats beyond the existing ISO 27001:2022 control set. The 2022 version of ISO/IEC 27001 does not yet cover generative AI threats, which had not largely become mainstream at its date of publication. To close this gap, new standards for AI security are being developed within the ISO/IEC SC 27 working group, and the ISO/IEC 42001 Artificial Intelligence Management System standard defines management requirements specific to AI systems.
14. Success and Failure Factors in ISMS Implementation 14.1 Critical Success Factors Research based on international ISMS implementation experience shows that successful implementations share several common characteristics.
• Top management commitment: as Konfirmity (2026) stresses, 'a siloed approach results in audit failure.' The ISMS is not merely an IT project but a corporate management system owned by top management.
• A risk-focused approach: the decisive difference is that the ISMS reflects the real risk profile. Risk assessment specific to the organisation, rather than template implementations, increases both security effectiveness and audit success.
• Correct determination of scope: too broad a scope leads to wasted resources and an unmanageable system. Too narrow a scope leaves critical assets outside. Scope is a conscious decision balancing business risk and the organisation's capacity. • A culture of continuity: the ISMS being an inseparable part of operations rather than a process activated only during the audit period is the most critical guarantee of long-term success.
14.2 Common Implementation Errors The most frequently seen ISMS implementation errors are:
• Document-focused compliance: controls existing on paper but not implemented in the field is the most frequently encountered cause of failure in the Stage 2 audit.
• An out-of-date risk assessment: failing to update the risk assessment on an annual cycle while the threat environment changes constantly is a common error blinding the ISMS to real risk.
• Neglect of awareness training: however strong the technical controls, the human factor remains the weakest link. Annual mandatory training must be designed with the seriousness it deserves.
• Disregard of supplier management: with supply chain attacks becoming ever more widespread, the inclusion of third-party security assessment within the ISMS scope is now essential.
15. Conclusion ISO/IEC 27001 and, more broadly, the ISO 27000 family of standards constitute the international framework transforming information security management into a systematic, risk-based and measurable discipline. The 96,709 valid certificates recorded by ISO Survey 2024 and the growth rate exceeding one hundred per cent since 2018 show beyond dispute that this framework has become a globally accepted management standard.
The 2022 revision represents a critical alignment update for the standard: the planned change management requirement of Clause 6.3, the 11 new Annex A controls and the structural 'attribute'-based control framework — all of these changes respond to the requirements of today's threat environment such as cloud, remote working, supply chain attacks and artificial intelligence. With the 31 October 2025 transition date, only the 2022 version now retains validity. In Türkiye, ISMS implementation is gaining momentum in both the public and the private sector. The Presidential Digital Transformation Office's table mapping the ISO 27001 controls to the Information and Communication Security Guide, the KVKK's technical measure requirements and TSE's active certification programmes make concrete Türkiye's determined steps towards raising its information security management capacity to international standards. In conclusion, the ISO 27001 certification process is not merely a compliance exercise but a strategic management investment that protects information assets, safeguards business continuity and builds trust with stakeholders. Konfirmity's (2026) sharp observation summarises this conclusion: 'Compliance without real security exposes organisations to costly breaches.' Managing the ISMS as a living and evolving system constitutes the only realistic guarantee of sustainable information security in the digital age.
References A-LIGN. (2025, April 3). Unveiling ISO 27001:2022: The 9 critical updates you need to know. https://www.a-lign.com/articles/unveiling-iso-270012022-the-9-critical-updates-youneed-to-know BALTUM. (2026, March 12). ISO 27001:2022 transition — What you need to know before the deadline. https://baltum.org/blog/iso-27001-2022-transition-guide/ BTGM. (2024). ISO 27001 Bilgi Güvenliği Yönetim Sistemi. T.C. Ticaret Bakanlığı Bilgi Teknolojileri Genel Müdürlüğü. https://btgm.ticaret.gov.tr/haberler/iso-27001-bilgiguvenligi-yonetim-sistemi CTR. (undated). ISO 27001 Bilgi Güvenliği Yönetim Sistemi.
https://belgelendirme.ctr.com.tr/iso-27001.html ÇŞİDB. (undated). TSE ISO IEC 27001:2017 Bilgi Güvenliği Yönetim Sistemi. T.C. Çevre, Şehircilik ve İklim Değişikliği Bakanlığı. https://cbs.csb.gov.tr/tse-iso-iec-27001- 2017-bilgi-guvenligi-yonetim-sistemi-88763 Denetci.org. (2025, September 14). Bilgi ve İletişim Güvenliği Rehberi ile ISO 27001 Kontrolleri Eşleştirme Tablosu. https://denetci.org/bilgi-ve-iletisim-rehberi-guvenligiile-iso-27001-kontrolleri-eslestirme-tablosu/ DISC InfoSec Blog. (2025, May 12). Historical data on the number of ISO/IEC 27001 certifications by country. https://blog.deurainfosec.com/historical-data-on-the-numberof-iso-iec-27001-certifications-by-country-across/ DSR Belgelendirme. (2026, March 6). ISO 27001 Bilgi Güvenliği Yönetim Sistemi Belgesi Nedir? https://dsrbelgelendirme.com.tr/iso-27001-belgesi/ DSR Belgelendirme. (2026). ISO 27001 Doküman Listesi.
https://dsrbelgelendirme.com.tr/iso-27001-dokuman-listesi/ Ekşi, B. (2023, August 13). ISO 27000 ailesi hangi standartlardan oluşur. https://www.burakeksi.com/iso-27000-ailesi-hangi-standartlardan-olusur/ goteleport.com. (2025). ISO 27001:2022 requirements explained for 2025. https://goteleport.com/blog/iso-iec-27001-2022-explained/ HEIC. (2025, October 21). ISO 27001 certifications nearly double in 2024 as global organizations prioritize cybersecurity. https://heic.eu/iso-27001-certifications-nearlydouble-in-2024-as-global-organizations-prioritize-cybersecurity/ IBM. (2024). Cost of a data breach report 2024. IBM Security. https://www.ibm.com/reports/data-breach isodestek.com. (2025, January 20). ISO/IEC 27001 BGYS için zorunlu dokümante edilmiş bilgi. https://isodestek.com/iso-iec-27001-bgys-icin-zorunlu-dokumante-edilmis-bilgi/ isonedir.com. (undated). ISO 27001 nedir, ISO 27001 belgesi nasıl alınır? https://www.isonedir.com/iso-27001-nedir/ ISO. (2022). ISO/IEC 27001:2022 — Information security management systems. International Organization for Standardization. https://www.iso.org/standard/27001 Johanson Group. (2024). ISO 27001:2022 transition guide. https://www.johansonllp.com/iso- 27001-transition-guide Konfirmity. (2026). ISO 27001: What changed in 2026 — a guide for busy teams. https://www.konfirmity.com/blog/iso-27001-what-changed-in-2026 KUM Eğitim Danışmanlık. (undated). ISO27001 Bilgi Güvenliği standardında Varlık Yönetimi. https://www.kum.com.tr/iso27001-bilgi-guvenligi-standardinda-varlikyonetimi KUM Eğitim Danışmanlık. (2021). ISO 27000 standartlar serisi kaç standarttan oluşuyor? https://www.kum.com.tr/blog/iso-27000-standartlar-serisi-kac-standarttan-olusuyor LRQA. (2025, May 13). Preparing for ISO 27001:2022 transition by October 2025. https://www.lrqa.com/en-us/insights/articles/preparing-for-iso-270012022-transitionby-october-2025/ onlinestandart.com. (2025, July 1). ISO 27001 Bilgi Güvenliği Kitabı Bölüm 2 — İşletmelere Rehber. https://onlinestandart.com/rehber/iso-27001-bilgi-guvenligi-yonetim-sistemibolum-2/ Polat, Ç. (2026, March 16). Bilgi Güvenliği Yönetim Sistemi (BGYS) Nedir? https://www.cagripolat.com/iso27001/bilgi-guvenligi-yonetim-sistemi-bgys-nedir Prozorov, A. (2025, October 2). ISO Survey 2024: ISO/IEC 27001 certificates. Patreon. https://www.patreon.com/posts/iso-survey-2024-140260314 secureframe.com. (2025, August 25). ISO 27001:2022 and ISO 27002:2022 explained: How to comply before October 2025 deadline. https://secureframe.com/blog/iso-27001-2022 SGS. (2024, May 10). ISO/IEC 27001 transition: What you should know. https://www.sgs.com/en-us/news/2024/05/iso-iec-27001-transition-what-you-shouldknow sigmateknoloji.com.tr. (2022). ISO 27001 Bilgi Güvenliği Yönetim Sistemi. https://sigmateknoloji.com.tr/iso-27001-bilgi-guvenligi-yonetim-sistemi/ TSE. (2026, January 15). TS EN ISO/IEC 27001:2023 Bilgi Güvenliği Yönetim Sistemi Temel Eğitimi. https://www.tse.org.tr/duyuru/tse-bgys-egitimleri-subat-2026/ TSE. (undated). TS ISO/IEC 27001 Bilgi Güvenliği Yönetim Sistemi (BGYS) Belgelendirmesi. https://www.tse.org.tr/bilgi-guvenligi-yonetim-sistemi-bgys-belgelendirmesi-ts-isoiec-27001/ Vertacert. (2025, December 26). ISO 27001 Belgesi Nedir? BGYS kurulumu, 2022 revizyonu ve fiyatları. https://www.vertacert.com/iso-27001-bilgi-guvenligi-yonetim-sistemi/ Yüksektepeli, O. (2013). ISO 27000 ailesi standartları nedir? https://www.mshowto.org/iso- 27000-ailesi-standartlari-nedir.html
