"We need ISO 27001." The request may come from a customer's supplier questionnaire, from duties under Taiwan's Cyber Security Management Act, or from a board member who saw a peer's announcement. ISO/IEC 27001 is the international standard for information security management systems (ISMS): it sets the requirements for establishing, implementing, maintaining and continually improving an ISMS, and an organisation can either just implement it or also have a certification body audit it and issue a certificate[1].

This article is for the IT managers, security staff and project leads who have to "bring the certificate home". It first clarifies what a certificate does and does not prove, then covers the 2022 revision, how CNS 27001 and the Cyber Security Management Act (the Act) relate to it, how certification audits work, and finally an implementation path and checks you can run yourself before the auditors arrive.

What a certificate proves, and what it does not

ISO/IEC 27001 is about a management system: by applying a risk management process, the organisation preserves the confidentiality, integrity and availability of information and gives interested parties confidence that risks are adequately managed[1]. ISO/IEC 27002, often mentioned in the same breath, is guidance on controls; ISO states plainly that it cannot be certified to, and that organisations get certified to ISO/IEC 27001, which references the 27002 guidance[2].

The standard also limits cherry-picking: an organisation claiming conformity may not exclude any requirement in clauses 4 to 10[3]. Annex A controls are different: the organisation decides which ones it needs based on its risk assessment, then explains its inclusions and exclusions in a Statement of Applicability (SoA; see below)[3].

Scope decides what the certificate means

The standard requires the organisation to determine the boundaries and applicability of the ISMS to establish its scope, considering internal and external issues, the requirements of interested parties, and the interfaces and dependencies between its own activities and those of other organisations, and to make the scope available as documented information[3]. A certification body's recertification audit likewise assesses the effectiveness of the management system for the scope of certification, and where part of the scope fails to meet the requirements, the certification body can reduce the scope of certification[4].

In other words, a certificate covering one data centre or one product line says nothing about systems, sites or subsidiaries outside that scope. Nor is it a product security certification, and it is no guarantee against incidents. When a supplier hands you a certificate, check at least whether the scope statement covers the services and sites you actually use, the edition of the standard, the validity dates, the issuing certification body, and whether it carries an accreditation body's mark (see below). ISO also asks that standards be cited with their full reference, for example "certified to ISO/IEC 27001:2022" rather than just "ISO 27001"[1].

If what your customer actually wants is a SOC 2 report, see SOC 2, ISO 27001 and security questionnaires for the differences. ISO 27001 certifies an organisation, which is a different thing from personal credentials such as lead auditor certificates; for those, see Choosing a security certification.

What changed in 2022: Annex A restructured, and the transition deadline

ISO published ISO/IEC 27001:2022 on 25 October 2022[5]; it is the third edition, and the 2013 edition has been withdrawn[1]. The biggest change is in Annex A: the controls went from 114 in 14 clauses to 93 in 4 themes, of which 11 are new, 24 merge earlier controls and 58 are updated[5]. The four themes are organisational controls (5.1 to 5.37), people controls (6.1 to 6.8), physical controls (7.1 to 7.14) and technological controls (8.1 to 8.34)[3]. The matching ISO/IEC 27002:2022 also gives each control "attributes" and a "purpose", and no longer groups controls under control objectives[5].

Changes to the main body of the standard are mostly editorial; the most visible one is the new clause 6.3, Planning of changes: when the organisation determines the need for changes to the ISMS, they shall be carried out in a planned manner[3][5]. In 2024 ISO also published Amendment 1, covering climate action changes[1].

For organisations that already run an ISMS, the International Accreditation Forum (IAF) considered that the impact of the revision need not be significant: the main task is to compare the controls you have determined against the new Annex A and update the SoA, and if that comparison reveals necessary controls that were inadvertently omitted, to update the risk treatment plan and implement them[5].

Every 2013 certificate has now lapsed

IAF's transition document, MD 26, required certification bodies to carry out initial certification and recertification only against the 2022 edition no later than 30 April 2024, and to complete the transition of certified clients by 31 October 2025, at which point all certifications based on the 2013 edition were to expire or be withdrawn[5]. That deadline has passed: a supplier that still offers an ISO/IEC 27001:2013 certificate is offering one that is no longer valid, and you should ask for the 2022 certificate.

CNS 27001 and the Act: who must have third-party certification

CNS 27001 is the national adoption of ISO/IEC 27001:2022

CNS 27001 was first promulgated on 16 June 2006, and the current CNS 27001:2023 was promulgated as an amendment on 30 January 2023[3]. Its foreword states that it is based on the third edition of ISO/IEC 27001 published in 2022, without technical changes, and that it replaces CNS 27001:2014; three errata have since been issued, the latest on 21 August 2025[3]. So when a regulation says "CNS 27001 or ISO 27001", the requirements are the same. The Chinese text is handy for writing procedures and for internal training; just apply the errata, which correct terminology such as the term for "risk owner" in 6.1.3[3].

National standards are voluntary in principle, but where a competent authority incorporates all or part of one into a regulation, that regulation governs[3]. The Act is such a case.

The Act: levels A and B need third-party certification, level C needs an ISMS

The Regulations Governing the Classification of Cyber Security Responsibility Levels were last amended on 7 January 2026[6]. Under their appendices, government agencies and specific non-government agencies at levels A and B must bring all core information and communication systems under CNS 27001, ISO 27001 or another ISMS standard (or another system or standard with equivalent or better effect, or one developed by a government agency and approved by the competent authority), obtain impartial third-party certification, and keep that certification valid[6]. The deadlines are two years from the first approval of the level (or a change of level) to implement the ISMS and three years to complete third-party certification[6]. Level C only requires all core systems to be brought under an ISMS and kept there, with no third-party certification[6]. For items added or changed by an amendment to the appendices, the deadline runs from the date the amendment takes effect[6]. For how levels are determined and the other duties at each level, see Taiwan's Cyber Security Management Act.

Two details in the appendices shape both the project scope and the choice of certification body[6]:

  • The requirement covers all core systems. A certification scope that covers only some of them does not meet the wording of the appendices.
  • The "third party" in "impartial third-party certification" means a body accredited by the institution entrusted by Taiwan's competent authority under the Standards Act, and the certificate must carry that institution's accreditation mark.

Companies outside the Act's scope can still be asked for it when they take on outsourced work for covered organisations: Article 10 of the Act requires a contractor's procedures and environment for the outsourced work to have sound security management measures or to pass impartial third-party certification[7]. The article says "or": ISO 27001 certification is one way to show this, not the only one. For how to handle such customer requests, see When a customer asks for a "security certification".

How certification works: a two-stage audit and a three-year cycle

Management system certification is a third-party conformity assessment activity, and the standard for certification bodies is ISO/IEC 17021-1:2015, which ISO's website lists as still current[8]. The process below follows the summary of ISO/IEC 17021-1 section 9 published by the accreditation body IAS (International Accreditation Service)[4].

When applying, the organisation provides the desired scope of certification, its sites and processes, any outsourced processes that affect conformity, and whether it has received consultancy on the management system and from whom[4].

  • Stage 1 audit: reviews the management system documentation, evaluates readiness for stage 2, gathers scope information (sites, processes, applicable statutory and regulatory requirements) and evaluates whether internal audits and management reviews are planned and performed. Concerns found in stage 1 may be raised as nonconformities in stage 2; the interval between the stages should allow time to resolve them, and all or part of stage 1 may have to be repeated[4].
  • Stage 2 audit: evaluates the implementation, including effectiveness, of the management system, covering performance monitoring and measurement, compliance with legal and contractual requirements, operational control, and internal audit and management review[4].
  • Certification decision: before deciding, major nonconformities must be closed and minor nonconformities must have a corrective action plan; if the certification body cannot verify the correction of a major nonconformity within 6 months of the last day of stage 2, it must conduct another stage 2 before recommending certification[4].

After certification, the organisation enters a three-year cycle[4]:

  • The first three-year cycle starts on the certification decision date; surveillance audits take place in the first and second years and a recertification audit in the third year, before the certificate expires.
  • Surveillance audits are held at least once per calendar year except in recertification years, and the first surveillance audit after initial certification must be no more than 12 months after the certification decision date.
  • If recertification is completed before expiry, the new certificate's expiry can follow on from the existing cycle; after expiry, certification can be restored within 6 months if the outstanding recertification activities are completed, otherwise at least a stage 2 is required.
  • If the organisation does not allow surveillance or recertification audits at the required frequency, the certification body shall suspend certification, and the certificate is temporarily invalid during suspension.

Choosing a certification body: check the accreditation first

Certification is a certification body auditing an organisation and issuing a certificate; accreditation is an accreditation body assessing the certification body's competence. ISO notes that a certificate from an accredited certification body may bring an additional layer of confidence, because an accreditation body has independently confirmed that body's competence[1].

Accreditation bodies used to recognise each other through IAF's Multilateral Recognition Arrangement (IAF MLA). Since 1 January 2026, the roles of IAF and the International Laboratory Accreditation Cooperation (ILAC) have been taken over by Global Accreditation Cooperation Incorporated (Global ACI), and international recognition is provided through the Global ACI MRA framework; during the transition the old IAF MLA mark may still be used[9]. Taiwan's accreditation body, the Taiwan Accreditation Foundation (TAF), is a Global ACI MRA signatory whose recognised scopes include ISO/IEC 27006-1 and ISO/IEC 27001 (ISMS), recognised since 21 October 2015[10]. TAF's website has a directory of accredited ISO/IEC 17021-1 management system certification bodies, and warns that non-accredited bodies have misused the TAF accreditation mark on non-accredited reports[11]. To check a specific certificate, you can search IAF CertSearch by company name or certificate details; its data comes from certification and accreditation bodies[12]. If you cannot find it there, ask the issuing certification body directly.

Implementation path: from scope to the stage 2 audit

The order below follows the clauses of CNS 27001 / ISO/IEC 27001[3]; in a real project some steps run in parallel:

  1. Determine the scope (4.1 to 4.3): list internal and external issues and the requirements of interested parties (including legal and contractual obligations), and draw the boundaries, interfaces and dependencies. Level A and B organisations under the Act should confirm that all core systems are in scope[6].
  2. Management commitment (clause 5): top management must demonstrate leadership and commitment with respect to the ISMS[3]. In practice, someone with authority has to sign off on budget, staffing and cross-department coordination.
  3. Risk assessment (6.1.2): set risk acceptance criteria and criteria for performing risk assessments; identify risks to confidentiality, integrity and availability within the scope and their risk owners; analyse consequences and likelihood, determine risk levels and prioritise them for treatment; retain documented information[3].
  4. Risk treatment and the SoA (6.1.3): choose risk treatment options and determine the necessary controls, then compare them with Annex A to make sure none has been omitted; Annex A is not exhaustive and you may need additional controls. The SoA lists the necessary controls, the justification for including them, whether they are implemented, and the justification for excluding any Annex A control; the risk treatment plan and the residual risks must be approved and accepted by the risk owners[3].
  5. Objectives and changes (6.2, 6.3): set information security objectives that are measurable where practicable, stating what will be done, what resources are needed, who is responsible, when it will be completed and how results will be evaluated; plan any changes to the ISMS[3].
  6. Operation (clause 8): implement the controls as planned and keep records; externally provided processes, products or services relevant to the ISMS must also be controlled; repeat the risk assessment at planned intervals or when significant changes occur[3].
  7. Performance evaluation (clause 9): decide what to monitor and measure; run internal audits at planned intervals, selecting auditors so that the audit process is objective and impartial, and report results to relevant management; top management reviews the ISMS at planned intervals[3].
  8. Apply for certification: stage 1 evaluates whether internal audits and management reviews are planned and performed, and stage 2 examines both[4], so it is best to complete at least one full round of internal audit and management review before you apply.

Pre-audit self-check

The checks below are derived from the requirements of the standard and are meant to surface gaps before stage 1; they do not indicate how often each item is actually raised as a nonconformity:

  • Does the scope document state the boundaries, interfaces and dependencies, and match the scope statement you want printed on the certificate[3]?
  • Can you produce records for every control the SoA marks as implemented, and is every exclusion justified[3]?
  • Does every risk in the risk register have a risk owner, and are approval of the risk treatment plan and acceptance of residual risk on record[3]?
  • After significant changes, such as moving to the cloud, replacing a core system or reorganising, was the risk assessment repeated[3]?
  • Are externally provided processes, such as cloud services and outsourced operations, under control, with evidence[3]?
  • Are internal audits arranged to be objective and impartial, for example by not having auditors audit their own work[3]?
  • Do management review records cover the required inputs, such as nonconformities and corrective actions, audit results, and the status of risk assessment and risk treatment, and record decisions on improvement opportunities and changes to the ISMS[3]?
  • Have the SoA and procedures carried over from the 2013 edition been updated to the numbering and content of the 2022 Annex A[5]?

Action checklist

  • Start by pinning down where the request comes from: which standard and which scope the customer contract requires, whether you are a level A or B organisation under the Act, and which risks the board wants to reduce. Different sources mean different scopes and timelines.
  • Level A and B organisations under the Act: confirm the date your level was approved or changed, work back from the two-year implementation and three-year certification deadlines, and make sure the scope covers all core systems.
  • Write the scope statement and list the systems, sites, outsourced services and interfaces within it; then complete the risk assessment, risk treatment plan and SoA, checking item by item against the 93 controls of the 2022 Annex A.
  • Before applying for the stage 1 audit, complete at least one round of internal audit and management review, and follow up corrective actions on any nonconformities.
  • Before engaging a certification body, check the TAF directory to confirm it is accredited for ISO/IEC 27001; organisations covered by the Act should also confirm the certificate will carry the accreditation mark the appendices require.
  • Put the three-year cycle in the calendar: surveillance audits each year and recertification completed before expiry in year three, so the certificate does not lapse.
  • When reviewing suppliers, confirm the certificate is to the 2022 edition, still valid and scoped to the services you use, and verify it with the issuing body or IAF CertSearch; for the technical side of supply-chain risk, see Supply chain attacks.