ISO/IEC 27001:2022
The 2022 Annex A control set, with evidence mapped from your connected tools and a crosswalk that carries the same evidence into ISO 42001.
What ISO/IEC 27001:2022 is
ISO/IEC 27001 is the international standard for an information security management system. It is the certification most commonly demanded outside the United States and, increasingly, inside it: a certificate from an accredited body says an external auditor has examined your ISMS and found it to work, which is a materially stronger claim than a self-assessment.
The 2022 revision restructured Annex A from the fourteen clauses of the 2013 version into four themes — organisational, people, physical and technological — and introduced eleven new controls covering threat intelligence, cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding. If your control matrix still says A.12.6, it is against the 2013 version and needs mapping forward.
The certification itself is against clauses 4 through 10 — context, leadership, planning, support, operation, performance evaluation, improvement — with Annex A as the reference control set you select from and justify in a Statement of Applicability. That distinction matters when tooling claims to "cover ISO 27001": most of it, CMDash included, covers Annex A.
Who it applies to
- Any organisation selling to European, UK, Middle Eastern or APAC enterprise buyers, where 27001 is the default ask.
- US organisations whose customers have begun asking for 27001 alongside or instead of SOC 2.
- Organisations planning ISO 42001 — 27001 is the system 42001 extends, and doing them in the other order is more work.
- Anyone who needs one framework to anchor the rest. 27001 has the most seeded crosswalk mappings of any non-CSF framework here.
How it is structured in CMDash
CMDash seeds the Annex A:2022 controls across the four themes, using 2022 numbering (A.5 organisational, A.6 people, A.7 physical, A.8 technological). Clauses 4–10 — the management-system requirements an auditor actually certifies against — are not modelled as controls.
| Organizational Controls | 37 |
| People Controls | 8 |
| Physical Controls | 14 |
| Technological Controls | 34 |
These counts are the control rows CMDash actually seeds, checked against the seed files by a test on every build.
Scope: Annex A controls. Clauses 4–10 are not modeled as controls.
The control text
ISO standards are sold per copy and may not be redistributed, so the control text cannot be embedded in this product.
CMDash ships the control identifiers, the titles, and its own evidence-requirement guidance. If you hold a licence, you can import the official text yourself through the framework CSV import, which records it as customer-provided.
Buy from the ISO Store →Sold per copy by the publisher
What CMDash does for ISO/IEC 27001:2022
- The full Annex A:2022 control set with per-control evidence requirements, owners, statuses and dated evidence.
- The densest crosswalk coverage in the catalogue: seeded mappings to NIST CSF 1.1 and 2.0, SOC 2, PCI DSS, TISAX, HITRUST CSF and ISO 42001. TISAX in particular maps almost one-to-one, which is why an automotive supplier with a 27001 programme is much closer to TISAX than they expect.
- The ISO 42001 crosswalk is the specific reason to run both here: the ISMS artefacts you already collect answer a meaningful share of the AI management system, and the mapping shows you which.
- Optional evidence propagation: attach an artefact to one control and CMDash can create linked evidence records on crosswalked controls above a confidence threshold you set. It is off by default and the provenance of every propagated record is retained.
- The regulatory radar maps NIS2 obligations onto specific Annex A controls, so a 27001 programme produces an NIS2 readiness signal without a separate assessment.
- Every control is a tracked row with an owner, a status (not started, in progress, implemented, not applicable, at risk, failing), reviewer notes, and its own evidence requirements — not a checkbox on a spreadsheet.
- Evidence is uploaded against a specific control, dated, and kept on that control, so an assessor can see what was true when.
- Gaps export to a POA&M CSV — every control that is not implemented and not marked out of scope, with owner, status and evidence requirements.
- Policies you author in CMDash link to the controls they govern, so each control row shows which living policies stand behind it.
- A time-boxed, read-only external assessor seat can be scoped to just this framework, with an expiry date you set and a record of every page they opened.
What it shares with your other frameworks
CMDash seeds control-to-control crosswalk mappings, each with a confidence score. They are what stops the same artefact being gathered twice, and they are how a second framework costs a fraction of the first.
Where the evidence comes from
CMDash reads from the security tools you already run and turns what they report into control evidence. These are the integrations whose data lands closest to ISO/IEC 27001:2022’s control groups — you decide which control each signal evidences, and CMDash keeps it current from then on.
Where CMDash stops
Published on purpose. A buyer who discovers a limit after signing is a support ticket and a refund conversation; a buyer who reads it here is making an informed decision.
- ISO sells the text of 27001. CMDash ships control identifiers, titles and its own evidence guidance; it does not reproduce Annex A wording. You need a licensed copy of the standard.
- Clauses 4–10 are not modelled as assessable controls, and neither is the Statement of Applicability as a distinct document type. Both are real certification requirements and both sit outside what these control rows cover.
- CMDash is not a certification body. An accredited body issues the certificate; CMDash gets you to the audit with the evidence assembled.
Common questions
Does CMDash include the ISO 27001 control text?
No, and that is deliberate. ISO licenses the text of its standards, so CMDash ships the control identifiers and titles plus its own evidence-requirement guidance, and links you to the publisher. A tool that hands you the full Annex A wording without a licence has redistributed someone else's copyrighted content into your compliance record.
We are certified against the 2013 version. What changes?
The control substance largely survives; the structure and numbering do not. Ninety-three controls in four themes replace 114 in fourteen clauses, mostly by merging, and eleven controls are genuinely new — threat intelligence, cloud services, configuration management, data masking, DLP, web filtering, secure coding and the rest. CMDash seeds the 2022 set only, so a 2013 control matrix has to be mapped forward.
ISO 27001 or SOC 2?
Geography and buyer, mostly. SOC 2 is a US attestation report produced by a CPA firm; 27001 is an international certification of a management system. If your buyers are American, SOC 2. If they are not, 27001. If they are both, the seeded crosswalk between them means the second one costs far less than the first.
How does this help with ISO 42001?
42001 is built on the same management-system skeleton, and CMDash seeds a direct crosswalk between the two Annex A sets. Supplier management, access control and incident response carry across well. Impact assessment, data provenance and AI life-cycle documentation do not — those are new work either way.
Also in Security Programs
Paid plans cap how many frameworks you run at once, never which ones — ISO/IEC 27001:2022 is available on every paid plan.
View pricingReady to see your posture?
Start a 30-day free trial of any paid plan — a card is required, and it converts unless you cancel — or sign up for Free with no card at all.