ISO 27001:2022

The ISO/IEC 27001 Information Security Management System is the international standard that enables organisations to protect the confidentiality, integrity and availability of their information assets. The current version of the standard is ISO/IEC 27001:2022. CMB Consultancy offers certification services through accredited certification bodies to organisations that want to obtain ISO 27001.

What Is ISO 27001?

ISO/IEC 27001 is the international information security management standard that sets out the requirements for a robust information security management system.

Today, organisations must protect the confidentiality, integrity and availability of the information and information assets they process, store and manage, due both to their own needs and to the laws and contracts they are bound by.

With its risk-based approach, the ISO/IEC 27001 information security standard helps organisations achieve the targeted level of security with the right human resources, procedures and IT infrastructure for protecting information and information assets. ISO/IEC 27001 is suitable for integration into the business processes of companies of any size in any sector.

The ISO/IEC 27001 certificate is proof that your organisation protects critical data, such as financial data and customers’ personal information, in the best possible way using a risk-based approach.

For this reason, ISO 27001 certification is becoming mandatory more and more often, driven by both legal and contractual expectations.

Every year, major financial losses arise from situations that damage information assets, such as external attacks, technical failures, espionage or misuse of information. According to ISO 27001, the aim of an information security management system is to identify corporate risks, analyse them and use appropriate measures to bring them under control.

ISO 27001 is compatible with the Plan-Do-Check-Act (PDCA) cycle, an approach well known from ISO 9001. The information security management system can therefore be easily integrated into an existing management system.

What Changed with the ISO 27001:2022 Revision?

The current version of ISO/IEC 27001 was published in October 2022. The transition period for the previous version, ISO/IEC 27001:2013, ended on 31 October 2025; since that date, certificates issued against the 2013 version are no longer valid.

• The number of Annex A controls was reduced from 114 to 93, and the controls were grouped into four themes: organisational, people, physical and technological controls.
• 11 new controls were added, such as threat intelligence, information security for the use of cloud services, data masking, data leakage prevention and secure coding.
• With Amd 1:2024, published in February 2024, climate change has been added to the issues to be considered when assessing the organisation’s context.

Why Is ISO 27001 Necessary?

It is accepted worldwide that an organisation cannot protect information security and business continuity with technical measures alone, and that a set of measures and controls such as an ISMS (Information Security Management System) must also be in place. Top management and all employees must support the security policies created within the ISMS and apply them effectively. In addition, it increases security when all people and organisations the company works with also act in line with these policies.

Who Does ISO 27001 Concern?

ISO 27001 is suitable for all organisations, large and small, regardless of country or sector. The standard is particularly necessary in sectors where information security is of great importance, such as finance, healthcare, the public sector and information technology. ISO 27001 is also very important for organisations that manage information on behalf of others, such as IT subcontractors. It can be used to assure customers that their information is protected.

In Türkiye, ISO 27001 is mandatory for the following sectors:

• companies signing duty agreements,
• companies signing concession agreements,
• companies providing satellite communication services,
• companies providing infrastructure operation services,
• companies providing fixed telephone services,
• companies providing GMPCS mobile telephone services,
• companies providing mobile virtual network services,
• internet service providers,
• companies providing GSM 1800 mobile telephone services on aircraft,
• companies seeking e-invoice special integrator authorisation,
• exporting companies seeking authorised customs facilitation status,
• companies providing and operating electronic communication networks and infrastructure,
• software, hardware and integrator companies in the IT sector that take part in public tenders.

Regulations Making ISO 27001 Mandatory in Türkiye

Companies in the Energy Sector

With the amendments published in the Official Gazette No. 29217 dated 26.12.2014, the Turkish Energy Market Regulatory Authority (EPDK) made it mandatory for companies in the oil, electricity and natural gas markets to hold an ISO 27001 Information Security Management System certificate. Licence holders in these markets have been obliged to obtain an ISO 27001 certificate from an accredited certification body since 01.03.2016.

Customs Companies

The Authorised Obligor status, introduced by the Turkish Ministry of Customs and Trade under the Regulation on the Facilitation of Customs Procedures published in the Official Gazette of 10 January 2013, is granted to companies that fulfil their customs obligations and have financial adequacy and security standards (ISO 27001 and ISO 9001). The first advantage for manufacturers and exporters with this status is on-site customs clearance: customs procedures for exports are carried out easily at the company’s own premises. Without having to come to or wait at customs, the company completes its procedures safely at its own facility, saving both time and operating costs. The certification also increases the prestige of these companies in the market.

Special Integrator Companies Providing E-Invoice Services

The April 2015 e-Invoice Application Special Integration Guide of the Revenue Administration – Audit and Compliance Management Department states that special integrator companies providing e-invoice services are required to obtain ISO 27001, ISO 22301 and ISO 20000 certificates.

Special integrator companies must hold:

• TS ISO IEC 27001 or ISO 27001 certificates for information security,
• an ISO 22301 certificate for business continuity (Societal security – Business continuity),
• TS ISO IEC 20000 or ISO 20000 certificates for IT service management.

ISO/IEC 27001 Terms and Concepts

Information Security Management System (ISMS): The part of the overall management system, based on a business risk approach, to establish, implement, operate, monitor, review, maintain and improve information security.

Risk analysis: Systematic use of information to identify sources and to estimate the risk.

Risk assessment: The overall process of risk analysis and risk evaluation.

Risk evaluation: The process of comparing the estimated risk against given risk criteria to determine the significance of the risk.

Risk management: Coordinated activities to direct and control an organisation with regard to risk.

Risk treatment: The process of selecting and implementing measures to modify risk.

Statement of applicability: A documented statement describing the control objectives and controls that are relevant and applicable to the organisation’s ISMS.

Benefits of Setting Up an ISO 27001 Information Security Management System

• Awareness of information assets: The organisation becomes aware of which information assets it has and of their value.
• Ability to protect its assets: It defines protection methods through the controls it sets up and protects its assets by applying them.
• Business continuity: It safeguards its business for many years and is able to continue operating in the event of a disaster.
• A relationship of trust with interested parties: It gains the trust of interested parties, especially suppliers, because their information is protected.
• It protects information through a system rather than leaving it to chance.
• Customers rate it more favourably than its competitors.
• It increases employee motivation.
• It prevents legal proceedings.
• It brings high prestige.