ISO/IEC 27001 — Information Security

What is ISO/IEC 27001?

ISO/IEC 27001 is the international standard for Information Security Management Systems. It defines requirements for a risk-based, continually improving ISMS, supported by 93 Annex A controls covering organisational, people, physical and technological measures.

Who needs to comply

• Any organisation seeking an internationally recognised certification
• Vendors required to provide assurance to enterprise customers
• Regulated entities mapping local obligations to a global baseline
• Groups consolidating multiple frameworks into one management system

Why it matters now

• Regulators, customers and partners increasingly require evidence of an attested control set.
• ISO/IEC 27001 provides a defensible baseline that maps cleanly into adjacent frameworks.
• A single control set serves multiple audits, reducing cost and audit fatigue.
• Boards and audit committees expect quantified, ongoing assurance — not point-in-time reports.

How MAST helps

• Lead Auditor and Lead Implementer-certified consultants for ISO/IEC 27001.
• Local delivery in the UAE, KSA and India with on-site and remote options.
• Templates, accelerators and a unified control catalogue that map across frameworks.
• Managed-service options for continuous compliance after certification.

Scope & boundaries

Defining the right scope is the single biggest determinant of ISO/IEC 27001 success. Too narrow and the certificate is meaningless to buyers; too broad and the programme stalls under its own weight. The boundary below is our starting point and is tuned to each client during a two-week scoping sprint.

• Legal entities, business units and brands in scope
• Geographies, data residency boundaries and cross-border flows
• Cloud accounts, on-premise estates and end-user computing devices
• In-scope products, services or customer segments — and the data they process
• Third parties and sub-processors handling in-scope data on your behalf
• Shared services (identity, HR, payroll, finance) that touch the in-scope estate

Key controls & requirements

ISO/IEC 27001 is structured around the control families below. MAST maintains a unified control catalogue that maps each requirement to your existing controls, so one implementation satisfies multiple audits.

• A.5 Organisational controls
• A.6 People controls
• A.7 Physical controls
• A.8 Technological controls
• Clauses 4–10: leadership, planning, support, operation, performance evaluation and improvement

Compliance steps

A pragmatic 12 to 16 week roadmap from gap to audit-ready ISO/IEC 27001. Compresses for smaller scopes and extends for multi-entity programmes; every stage ends with a formal gate review.

Common pitfalls — and how we avoid them

The failure patterns we see most often on ISO/IEC 27001 programmes. None are about the standard itself — they are about how it is run.

• Statement of Applicability that lists controls without justification for exclusions — an immediate Stage 1 finding.
• Risk methodology not aligned to ISO/IEC 27005, with no documented criteria for acceptance and treatment.
• Annex A 2022 themes (organisational, people, physical, technological) mapped from a 2013 SoA without re-evaluation.
• Asset inventory missing information assets, cloud tenancies and SaaS — only physical IT assets captured.
• Supplier security clauses (A.5.19–A.5.23) referenced in policy but not flowed into actual contracts.
• Internal audit performed by the same team that built the ISMS — independence challenged by the certification body.