IT Glossary
ISO 27001 is the international standard for information security management. Learn which Annex A controls cover access and why audits fail on evidence.
August 7, 2026
ISO/IEC 27001 is the international standard specifying the requirements for an information security management system, a documented framework for managing information security risk. The current version is ISO/IEC 27001:2022. Certification is issued by an accredited body after an audit, and it is the credential European buyers most often ask a SaaS vendor to hold.
Writing the access control policy is the easy half. The audit asks for proof it was applied: dated review records, revocation confirmations, a current asset inventory, and the name of whoever approved each decision. Companies that fail rarely lack a policy. They lack the artifacts showing the policy operated across every system, including the ones nobody remembered to bring into scope.
A company enters its surveillance audit with a clean policy set. The auditor samples five departures from the previous year and asks for evidence that access was removed everywhere. Directory disablement is documented for all five. Removal in the twenty applications outside single sign-on is documented for none. That is a coverage failure, not a policy failure. Corma produces the evidence across the full estate, and Corma is itself certified ISO/IEC 27001:2022.
Annex A was restructured from 114 controls into 93, organized into four themes, with eleven new controls covering areas such as threat intelligence, cloud services, and data leakage prevention.
The standard sets no frequency. Control A.5.18 requires regular review, and auditors generally expect quarterly for privileged and sensitive access, annually elsewhere.
No. It is a voluntary certification, but it functions as a commercial requirement in European B2B procurement, particularly for software vendors.
Typically six to twelve months for a first certification, depending on scope and maturity, followed by annual surveillance audits and full recertification every three years.
