ISO/IEC 27001:2022 certification for protecting information assets, assessed against 93 controls.
Quote on application
ISO/IEC 27001 lets an organisation set up an information security management system (ISMS) and manage its confidentiality, integrity and availability objectives. For software companies, data centres, and providers of financial and health services it is strong evidence that supports KVKK compliance.
The 2022 version
Annex A controls were reduced from 114 to 93 and grouped into four themes: organisational (37), people (8), physical (14) and technological (34). New controls such as cloud security, threat intelligence, data masking and data leakage prevention were added. The transition period for certificates issued to the 2013 version ended in October 2025.
Audit approach
The Statement of Applicability (SoA), the risk treatment plan and the effectiveness of relevant controls are examined with evidence. Penetration test and business continuity records are requested as samples.
Tips for preparation
An asset inventory, access authorisation matrix, backup and restore tests, a penetration test report and an incident response plan are the evidence requested most often at audit. In the 2022 version it is particularly important to have assessment records for cloud services and outsourced suppliers.
Scope of service
- Fully aligned to the 2022 version
- SoA and risk treatment review
- Remote and on-site hybrid audit
- KVKK compliance support
ISO 27001 Information Security Certification — get a quote
Fill in the form and we will get back to you as soon as possible.