ISO/IEC 27001:2022

ISO/IEC 27001:2022 is the international standard for Information Security Management Systems (ISMS). Edition 3 (2022) defines 93 Annex A controls across 4 themes: Organisational (37), People (8), Physical (14), and Technological (34). Certification demonstrates that your organisation systematically manages information security risks to protect confidentiality, integrity, and availability of information.

ISO 27001 certification typically takes 6–12 months depending on organisation size, complexity, and existing security controls. The process includes risk assessment, ISMS documentation, control implementation, internal audit, and a two-stage certification body audit. ICPL provides detailed milestone plans.

ISO 27001:2022 restructured Annex A from 114 controls across 14 sections to 93 controls across 4 themes. 11 new controls were added, covering threat intelligence, cloud security, ICT readiness for business continuity, data masking, DLP, and secure coding. Organisations certified to the 2013 version must transition by October 2025.

While MAS does not mandate ISO 27001 certification directly, MAS TRM Guidelines require financial institutions to demonstrate robust IT governance and information security controls. ISO 27001 is the most recognised framework for mapping to MAS TRM requirements and is expected by regulators and enterprise clients.

ISO 27001 is not legally mandatory in Singapore. Organisations pursue it because enterprise clients, government supply chains and procurement teams require it as a vendor qualification, because it supports regulatory expectations such as MAS TRM, or because a security incident would carry serious commercial consequences. If your customers send security questionnaires or your contracts reference information security controls, ISO 27001 is usually the expected answer.

The core set includes the ISMS scope statement and information security policy, the risk assessment methodology with a risk register and treatment plan, the Statement of Applicability (SoA) covering all 93 Annex A controls, supporting policies (access control, incident management, supplier security, cryptography, business continuity), internal audit reports, management review minutes, corrective action records, and operational evidence such as access logs, the asset register and training records. ICPL develops the documentation suite with you — your team provides the operational context.

Cost depends on the ISMS scope (organisation-wide versus a product line), headcount, number of locations and systems, your existing control maturity, and the volume of remediation the gap assessment identifies. Consultancy fees are quoted after a free gap assessment — ICPL does not publish fixed prices because scope varies widely. Certification body audit fees are separate and are paid directly to the certification body. The EDGE grant may offset up to 50% of qualifying consultancy costs for eligible SMEs, subject to Enterprise Singapore’s assessment.

Yes — significantly. Access control, incident management, vendor management, risk assessment, governance and security training requirements overlap across all three frameworks. A certified ISMS covers a substantial portion of DPTM’s operational security controls and SOC 2’s Security (CC) criteria. What does not transfer automatically: DPTM’s personal-data-specific practices (consent, DPIAs, retention) and SOC 2’s requirement to demonstrate operating effectiveness with evidence collected over a 6–12 month window.

The certificate is valid for 3 years. A surveillance audit is conducted each year to confirm the ISMS continues to operate, and a full recertification audit is required at the end of the cycle. In between, you maintain the risk register, internal audit programme and management reviews. ICPL provides ongoing ISMS maintenance support, including surveillance audit preparation and transition planning for future standard revisions.