ISO 27001 and ISO 22301: what they require and how to certify
ISO 27001 and ISO 22301 are the international standards for information security and business continuity. They’re not legally mandatory, but they’re the best foundation: implementing ISO 27001 gets much of NIS2, DORA and the ENS done. Atalaya GRC also helps you prepare for ISO 27001 certification, manage the controls and reuse them across all your regulations.
No commitment. We’ll walk you through the platform with a real case.
- Reference
- ISO/IEC 27001:2022 · ISO 22301:2019
- Applies from
- Voluntary certification
- Who
- Any organisation
- If you don’t comply
- Reusable base for NIS2, DORA and ENS
What are they?
ISO 27001 defines an Information Security Management System (ISMS) with the Annex A controls. ISO 22301, however, defines a Business Continuity Management System (BCMS). Both rest on the continuous-improvement cycle and therefore complement each other.
How exactly do they differ and how can you certify both together? We also explain it in ISO 27001 vs ISO 22301: differences and joint certification.
Who needs ISO 27001 certification?
Any organisation that wants to demonstrate, against a recognised standard, that it manages its security and continuity well. For example, a client, a tender or a regulated sector often asks for ISO 27001 certification.
What do ISO 27001 certification and ISO 22301 require?
Therefore, cover these essentials on the way to ISO 27001 certification:
Risk analysis and SoA
Firstly, risk analysis and a Statement of Applicability (SoA) justifying the controls applied.
Controls and continuity cycle
Then, implementing the controls of Annex A (ISO 27001) and the business continuity cycle (ISO 22301).
Evidence and ISO 27001 certification audits
Finally, evidence, regular reviews, internal and certification audits, and continuous improvement.
Why is ISO 27001 certification the best starting investment?
Because one control, several regulations: ISO 27001 controls cover much of NIS2’s Article 21, DORA’s ICT risk management and the ENS measures. Therefore, a single ISO 27001 certification pays off across several regulations. We also explain how in ISO 27001 as a shortcut to NIS2, GDPR and DORA.
Not mandatory, but they open doors
Although ISO 27001 and ISO 22301 aren’t legally mandatory, more and more clients, tenders and regulated sectors require them as a condition. They’re the recognised foundation that proves you manage your security and continuity well.
Atalaya GRC
How Atalaya GRC helps
In short, Atalaya GRC puts your ISO standards, and your path to ISO 27001 certification, under control:
- Management of the controls of Annex A and the ISO 22301 cycle, with evidence and an audit trail.
- Automatic reuse: define the control once, then apply it to NIS2, DORA, ENS and GDPR.
- Per-service tracking and, in addition, ISO 27001 certification audit preparation.
- A cost-effective investment: get certified once, then reap the benefits across several regulations at once.
Want to see it with your own controls?
Request a demoFAQ
Frequently asked questions
What is ISO 27001 and what is it for?
It is the international standard for building an information security management system (ISMS). It helps you protect the confidentiality, integrity and availability of your information with a risk-based method and, if you get certified, prove it to clients, tenders and auditors.
Is ISO 27001 mandatory?
Not by law, but a client, a tender or a regulated sector often requires it, and it’s the best foundation for NIS2, DORA or ENS.
What’s the difference between ISO 27001 and ISO 22301?
ISO 27001 manages information security; ISO 22301, business continuity. They complement each other.
Does ISO 27001 help with other regulations?
Yes: it covers much of NIS2, DORA and the ENS, reusing the same controls.
Is certification worth it?
If NIS2, DORA or ENS apply to you, yes: an investment you recoup across several regulations at once.
