Does i-Prot issue the certification?

No. The certification is issued by an accredited, independent certification body. i-Prot prepares and supports the organization up to that audit.

Can it be combined with other standards?

Yes. The multiframework approach reuses controls and evidence with standards like ISO/IEC 27701 or SOC 2, reducing incremental effort.

How long does certification take?

It depends on scope and initial maturity. The assessment defines a realistic phased plan, with value delivered at each stage.

Frameworks · ISO/IEC 27001:2022

ISO/IEC 27001: certify your information security management system.

Q: What’s the difference between 27001:2013 and 2022?

The 2022 version reorganizes Annex A into 93 controls grouped into four themes (organizational, people, physical and technological) and adds new controls. Organizations certified under 2013 must transition to 2022.

We prepare and support your organization to certify ISO/IEC 27001:2022 — with an ISMS that stays valid between surveillance audits.

Assess this framework Talk to a specialist

diagram · frameworks · iso/iec 27001:2022

Who it applies to

ISO/IEC 27001 applies to any organization that manages sensitive information and needs to demonstrate that it protects it. It’s especially relevant when certification is a commercial or contractual requirement.

What the framework requires

The standard requires establishing, maintaining and improving a risk-based Information Security Management System (ISMS), together with the applicable controls from Annex A.

Clauses 4–10

Context, leadership, planning, support, operation, evaluation and improvement.

Risk management

Risk assessment and treatment as the core of the system.

Annex A · 93 controls

Organizational, people, physical and technological.

Statement of applicability

The SoA justifies which controls apply and why.

Risks of not acting

Being excluded from tenders and contracts that require a valid certification.
Managing security without a risk-based framework or formal evidence.
Facing audits with recurring findings and last-minute remediation.
Losing traceability between controls, risks and evidence.

The i-Prot proposal

We design and implement the ISMS, define the risk assessment and the statement of applicability, and prepare the organization for the certification audit. All integrated into the CGF governance cycle, so the certification holds over time.

How we work with this framework

Assessment and gap analysis

Gaps against the clauses and Annex A of 27001:2022.

Risk assessment and SoA

Risk methodology, treatment plan and statement of applicability.

Controls implementation

Annex A controls, policies and procedures with evidence.

Internal audit and review

Internal audit, management review and closure of findings.

Certification and upkeep

Support in the certification audit and continuous operation.

Deliverables

Gap analysis
Implementation plan
Controls matrix
System documentation
Evidence
Internal audit
Management review
Roadmap

How it connects with CGF

CGF uses ISO/IEC 27001 as a source of requirements. This framework mainly covers the Design, Implement, Operate & measure, and Improve stages of the cycle.

See the CGF methodology →

Complyze and ISO/IEC 27001

Complyze centralizes the 93 Annex A controls, their evidence and compliance status, and keeps progress by clause visible. Frameworks are the natural entry point to the platform.

Frequently asked questions

Ready to certify ISO/IEC 27001?

Tell us your context and we’ll propose a path to certification tailored to your organization.

By submitting you accept our privacy policy.

You may also be interested in

BCRABCRA: cumplí los requisitos de ciberseguridad del Banco Central.View page →ENSENS: cumplí el Esquema Nacional de Seguridad del sector público.View page →HIPAAHIPAA: protegé la información de salud y demostrá cumplimiento.View page →