ISO 27001:2022

Overview

ISO/IEC 27001:2022 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The 2022 revision reorganized controls into four domains (organizational, people, physical, and technological) with 93 controls. CodeMiners maintains active ISO 27001:2022 certification, with annual surveillance audits conducted by an accredited certification body.

Governing Body

International Organization for Standardization (ISO) and International Electrotechnical Commission (IEC)

Scope of Certification

Covers the establishment, implementation, maintenance, and continual improvement of an ISMS within the context of the organization. Applicable to all types and sizes of organizations, addressing information security risk management across people, processes, and technology.

Audit and Assessment Process

Initial certification requires a two-stage audit by an accredited certification body: Stage 1 reviews documentation and readiness; Stage 2 evaluates implementation effectiveness. Certification is valid for three years with annual surveillance audits and a full recertification audit in year three.

Key Requirements

1. Information security policy and organizational roles
2. Risk assessment and risk treatment planning
3. Statement of Applicability (SoA) for all 93 controls
4. Internal audit program and management review
5. Incident management and business continuity integration
6. Supplier relationship security management
7. Competence, awareness, and training programs

Compliance Entitlements

• Globally recognized information security management framework
• Systematic risk assessment and treatment methodology
• 93 security controls across four domains
• Annual surveillance audits confirm continued compliance

Client Benefits

• Provides assurance that CodeMiners manages information security through a certified management system
• Accepted by regulatory bodies and enterprise procurement globally
• Reduces the need for clients to conduct independent security assessments
• Demonstrates a structured approach to protecting client data assets

Related Certifications