ISO/IEC 27001 is the international standard that sets out the requirements for organisations to establish, operate and continually improve an information security management system (ISMS). It protects the confidentiality, integrity and availability of information on the basis of risk assessment. Annex A of the current 2022 edition contains 93 controls grouped into four themes; certificates are issued by accredited bodies for a three-year period.
Scope of the standard
ISO/IEC 27001 is published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The current text is the third edition, published in October 2022; an amendment in 2024 (Amd 1:2024) added climate change to the context analysis. The transition period from the 2013 edition ended on 31 October 2025; certificates valid today are issued against the 2022 edition.
The standard is a management system, not a list of technologies. Clauses 4–10, structured the same way as ISO 9001, cover the context of the organisation, leadership, risk assessment, support, operation, performance evaluation and improvement. Guidance on how to implement the controls is found in a separate standard, ISO/IEC 27002.
Annex A: 93 controls, 4 themes
| Theme | Number of controls | Example topics |
|---|---|---|
| Organisational | 37 | Information security policy, access rights, supplier relationships, cloud services, incident management, business continuity |
| People | 8 | Pre-employment screening, confidentiality agreements, awareness training, remote working |
| Physical | 14 | Office and server room entry, equipment protection, clear desk, physical security monitoring |
| Technological | 34 | Authentication, backup, logging, encryption, protection against malware, secure coding |
The 114 controls of the 2013 edition were merged and updated, bringing the total down to 93. Eleven controls are new: threat intelligence, information security for use of cloud services, ICT readiness for business continuity, physical security monitoring, configuration management, information deletion, data masking, data leakage prevention, monitoring activities, web filtering and secure coding.
How does it work?
- The scope of the system is defined: which units, locations and processes are included.
- Information assets and the risks to them are assessed.
- A treatment decision is made for each risk: mitigate, accept, avoid or transfer.
- A Statement of Applicability is prepared, recording which of the 93 controls are applied or excluded, and why.
- Policies and controls are put into operation and staff are trained.
- An internal audit and a management review are carried out, after which an accredited body performs a two-stage certification audit.
The certificate is valid for three years and is maintained through annual surveillance audits. The steps are described in detail in the entry how to obtain ISO 27001 certification.
Which data is protected in logistics?
- Customers' commercial data: Invoice values, buyer and seller details, freight agreements. If these fall into a competitor's hands, the result is a direct commercial loss.
- Shipment data: Licence plate, route, real-time location, delivery time. For high-value cargo, this information directly affects the risk of theft.
- Customs data: Contents of declarations, GTİP (Turkish HS/tariff code) and value information, access rights to the BİLGE and NCTS systems.
- Personal data: Drivers' ID, passport and visa details; consignees' contact data. In Turkey these fall under Personal Data Protection Law No. 6698 (Kişisel Verilerin Korunması Kanunu, KVKK), and the TİO regulation also requires certificate holders to comply with this legislation.
- Integrations: Customer portals, tracking devices, e-CMR and ERP connections.
Sector-specific risks are covered in the entry ISO 27001 in logistics, while physical supply chain security is covered in the entry ISO 28000.
Common mistakes
- Limiting the scope to the IT department alone; operations and customs teams are the units with the most access to data.
- Copying the Statement of Applicability from a template without linking it to actual risks.
- Failing to control the system access of subcontracted carriers and external customs brokers.
How does Voltim Global support you?
Voltim Global holds ISO 28000 supply chain security and ISO 50001 energy management system certificates. For services in which location and shipment data is shared, such as real-time tracking, data access and sharing rules can be agreed separately with the customer.