How ISO 27001 Domains and Controls Keep Your Company Safe

As technology becomes increasingly integrated into business processes, security vulnerabilities are on the rise. More and more companies are feeling the backlash, and it has created serious concerns across nearly all sectors.

Costs from cybercrime are mounting. According to ASD’s Annual Cyber Threat Report 2024–25, the average self-reported cost of cybercrime per business report in Australia rose 50% to $80,850. Small to mid-sized businesses in particular are at risk because they often lack the security of larger organisations who have dedicated IT security teams. With limited resources, they may feel susceptible and powerless.

One way that companies are shielding themselves is by adhering to the information security standard ISO 27001. Published by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), its goal is to align security practices and methodologies with modern standards. The current edition is ISO/IEC 27001:2022. Here are the details of ISO 27001 and how obtaining certification can keep your company safe.

Security Improvements

The 2013 edition of the standard replaced and improved upon its predecessor, ISO 27001:2005. As cyber criminals become increasingly sophisticated and attacks more prevalent, it was necessary to implement changes to properly address the full scope of security threats that companies contend with. ISO/IEC 27001:2022 has since replaced the 2013 edition, and 2013 certificates expired when the transition period ended on 31 October 2025.

There’s a larger emphasis on security monitoring through metrics, setting objectives and analysing performance.

In order to accomplish this, new controls were added in 2013 that continue in the 2022 edition. Some of these include:

• Information security in project management (2013: 6.1.5; 2022: 5.8) – This control makes it necessary to make information security a compulsory part of project management, regardless of the nature of a project.
• Restrictions on software installation (2013: 12.6.2; 2022: 8.19, Installation of software on operational systems) – This control restricts users from installing unauthorised software on company systems.
• System security testing (2013: 14.2.8; 2022: 8.29, Security testing in development and acceptance) – This control makes it compulsory to implement and follow software testing procedures.

Combined, these controls strengthen security considerably. Organisations that comply with ISO 27001 and obtain certification are better equipped to deal with modern cyber threats and can strengthen their overall security infrastructure.

From 14 Domains to 4 Themes

One way the 2013 standard differed from the 2005 standard is that it had 14 domains versus what was formerly 11. These domains covered a wide variety of security elements including key areas such as:

• Company security policy
• Asset management
• Physical and environmental security
• Access control
• Security incident management
• Compliance

The 2022 edition reorganised the Annex A controls. The 114 controls of the 2013 edition became 93 controls grouped into four themes instead of 14 domains, with some controls merged and 11 new ones added, such as threat intelligence, information security for the use of cloud services and data leakage prevention.

Upon implementation, your company can improve its security in many ways. Here are some specific examples.

How ISO 27001 Improves Your Security

Mandatory Information Security

One of the main aims of ISO 27001 is to strengthen security across the board. It recognises that every project has inherent vulnerabilities that could potentially be exploited. To ensure homogeneity, your company will mandate information security regardless of the shape and scope of a project. It will be obligatory in nearly all situations.

Taking this kind of diligent approach is a huge step toward mitigating what has become an incredibly pervasive problem. With ASD reporting that the average self-reported cost of cybercrime for a small business rose 14% to $56,600 in 2024–25, proactivity is essential.

Tighter Control on Software Installation

Your company is put in jeopardy anytime unauthorised software is installed onto company systems. Without parameters in place, you’re opening yourself up to attacks such as malware, ransomware, phishing and denial of service (DoS).

Another focal point of ISO 27001 is to control what software can be installed, for example by requiring approval before anything is installed on operational systems. This prevents rogue software from infiltrating your systems and endangering your network.

Heightened Security on User Access

Maintaining strict access control is a necessity. If unauthorised users are able to gain access to your network and are exposed to sensitive information, the walls of security can come crumbling down in a hurry. There’s a strong emphasis on access control to ensure the utmost in security protocol.

This makes it far more difficult for unauthorised individuals to cross security borders and creates a choke-point. By limiting access to only a handful of verified users, you’re able to continually keep tabs on what’s happening on your network. As a result, you greatly reduce the chance of sensitive data falling into the wrong hands.

Physical Security

One element of cyber security that’s sometimes overlooked is protecting the physical equipment at a facility. After all, computers, hardware, servers, etc. must be located somewhere within a physical environment. If intruders are able to gain access to this equipment, it can have devastating consequences that can be just as bad if not worse as a purely digital attack.

Another aspect of the standard is to tighten the physical security of your company’s on-site premises; the 2022 edition groups 14 physical controls together, including a new physical security monitoring control. This can be done in several ways including the installation of surveillance cameras, commercial access control and even biometrics solutions involving fingerprint or retina scanning. The end result is comprehensive security that covers both digital as well as physical components.

Deeper Risk Assessment

A big part of being proactive and keeping calamities at bay is simply being aware of the risks you’re facing and the challenges you’re up against. There’s a heavy emphasis on the identification and assessment of potential risks and using a methodology that makes sense for your company and is fully customised for your unique processes.

It’s about implementing assessment policies that fit your specific needs and taking the necessary steps to determine where your greatest weaknesses lie. Once you’ve done this, you’ll have a better idea of how to prioritise your efforts and where your attention should be placed initially. From there, you can take appropriate action to optimise security as a whole.

Supplier Security Policy

Your organisation may be partnered with several different suppliers at any given time. Even though your company may be meticulous about its information security, it doesn’t mean that all of your suppliers are. This can be problematic because an oversight on their end can potentially compromise the security of your organisation.

One of the controls (2022: 5.19, Information security in supplier relationships) requires processes to manage the security risks associated with suppliers’ products and services, supported by security requirements in supplier agreements (5.20). This topic will be thoroughly discussed, and agreements will be made to reduce unnecessary vulnerabilities.

Doing so increases security for both parties and ensures that you’re on the same page about setting parameters. In turn, you’ll have greater confidence and more peace of mind with your supplier interactions, and security threats are less likely to occur.

Streamlined Incident Reporting

The way in which you respond to an incident is critical. A swift, systematic response enables your company to effectively handle the issue and take necessary action. It minimises the damage and costs, while simultaneously expediting the recovery time. You’ll know exactly what needs to be done to address the situation and which steps must be taken to get operations back on track.

With ASD’s Australian Cyber Security Centre responding to more than 1,200 cyber security incidents in 2024–25, it’s not a matter of if but when. ISO 27001 certification, with its incident management controls, can increase your chances of an effective resolution and reduce your stress even in a worst-case scenario.

Continued Compliance with Current Best Practices

Information security involves an ever-evolving set of practices. It’s an eternal cat and mouse game where organisations must stay one step ahead of cyber criminals. The best way to do that is to remain compliant at all times and conform to information security policies and standards as well as relevant laws and regulations.

ISO 27001 certification allows you to adjust and fine-tune your company’s security policies to ensure compliance with what’s regarded as current best practices. Even as technologies advance, you’ll be better prepared for whatever attackers may throw at you.

Better Overall Organisation

Finally, you’ll experience a higher level of organisation as it relates to information security. Some specific examples include having:

• A clearly outlined strategy in place
• Effective policies to address key areas
• An established outline of incident management procedures
• A business continuity procedure to minimise downtime

When you put all of this together, your company will have a more systematic approach to mitigating cyber security risk.

Keeping Your Company Safe

Cyber threats continue to grow more costly for Australian businesses. ASD’s Annual Cyber Threat Report 2024–25 found that, while the number of cybercrime reports fell 3%, the average self-reported cost per business report rose 50%.

This obviously presents a challenge for today’s businesses, but there is a solution. One of the best ways to keep your company safe is being ISO 27001 certified. It helps you address many of the most pressing security obstacles and reduce the common threats that companies face today. Not only does this protect your company right now, you’ll be better equipped for whatever security concerns arise in the future.

In-post image credits: joffi / Pixabay; louisehoffmann83 / Pixabay

Frequently Asked Questions

Is ISO 27001 certification mandatory in Australia?

No general law requires Australian businesses to be ISO 27001 certified; certification is voluntary. However, customers, tenders and contracts may ask for it, and some regulations recognise it. APRA’s CPS 234 doesn’t require certification but overlaps with it, and the Critical Infrastructure Risk Management Program (CIRMP) Rules list AS ISO/IEC 27001 among the frameworks responsible entities can comply with.

What is an information security management system (ISMS)?

An ISMS is the set of policies, processes, people and controls an organisation uses to manage risks to its information in a systematic way. ISO 27001 defines the requirements an ISMS must meet, from understanding the organisation’s context and assessing risk to monitoring performance and continually improving. The Annex A controls are the safeguards organisations select from to treat the risks they identify.

What is the difference between ISO 27001 and ISO 27002?

ISO 27001 is the standard an organisation is certified against: it sets out the requirements for an ISMS and lists the Annex A controls. ISO 27002 is a supporting guidance document that explains each of those controls in more detail and how they can be implemented. Organisations are not certified to ISO 27002, but it is widely used when designing and applying controls.

How long is an ISO 27001 certificate valid?

An ISO 27001 certificate is generally valid for three years. To keep it, the certification body carries out surveillance audits each year, and a recertification audit must be completed before the certificate expires to start a new three-year cycle. Changes to your ISMS, scope or risks between audits should be managed through your normal processes.

Can ISO 27001 and the Essential Eight be used together?

Yes. ISO 27001 is a risk-based management system that covers governance, people, physical and technology controls, while ASD’s Essential Eight is a prioritised set of technical mitigation strategies with maturity levels. Many Australian organisations use the Essential Eight to strengthen specific technical controls within their ISO 27001 ISMS, as the two complement rather than replace each other.

What changed in the 2024 amendment to ISO 27001?

In February 2024, ISO published Amendment 1 to ISO/IEC 27001:2022, titled “Climate action changes”. It adds a requirement for organisations to determine whether climate change is a relevant issue when considering their context, and a note that relevant interested parties can have requirements related to climate change. The Annex A controls themselves did not change.