What the standard requires, the 93 Annex A controls, the documents auditors ask for, how certification works in Romania, and how ISO 27001 compares with NIS2 and SOC 2 — in plain English.
ISO 27001 — officially ISO/IEC 27001, because it is published jointly by ISO and the IEC (International Electrotechnical Commission) — sets the requirements for an information security management system (ISMS): a repeatable way to protect the confidentiality, integrity and availability of your information by assessing risk, choosing controls, checking they work and improving them.
The current edition is ISO 27001:2022, published in October 2022. Amendment 1:2024 added one requirement: when you look at the issues that affect your ISMS (clause 4.1), you must decide whether climate change is relevant, and interested parties may have climate-related requirements (clause 4.2).
Its companion, ISO 27002:2022, gives guidance on implementing each control. You certify against 27001; 27002 helps you implement it.
The standard has two parts. Clauses 4–10 are mandatory — every one is audited. Annex A is a reference list of controls; your risk assessment decides which you need.
| Clause | What it requires |
|---|---|
| 4 · Context | Internal and external issues, interested parties and their requirements, and the ISMS scope |
| 5 · Leadership | Top management commitment, the information security policy, roles and responsibilities |
| 6 · Planning | Risk assessment and treatment, the Statement of Applicability, security objectives, planning changes |
| 7 · Support | Resources, competence, awareness, communication and documented information |
| 8 · Operation | Running the processes, performing risk assessments and implementing the treatment plan |
| 9 · Performance evaluation | Monitoring and measurement, internal audit and management review |
| 10 · Improvement | Continual improvement, nonconformities and corrective action |
| Theme | Controls | Examples |
|---|---|---|
| Organisational (A.5) | 37 | Policies, roles, asset inventory, access control, supplier and cloud security, incident management, ICT readiness for business continuity, legal requirements |
| People (A.6) | 8 | Screening, terms of employment, awareness and training, disciplinary process, confidentiality agreements, remote working, event reporting |
| Physical (A.7) | 14 | Secure areas, entry controls, physical security monitoring, clear desk and screen, equipment and storage media |
| Technological (A.8) | 34 | Endpoint devices, privileged access, malware protection, vulnerability and configuration management, backup, logging and monitoring, network security, cryptography, secure development |
New in 2022: the controls were reorganised from 114 into 93, and 11 are new — including threat intelligence, information security for cloud services, ICT readiness for business continuity, configuration management, data leakage prevention, monitoring activities and secure coding.
ISO 27001 requires certain documented information. These are the items the clauses explicitly require:
On top of these, you document whatever your own ISMS needs to work (clause 7.5.1) — typically the policies and procedures behind the Annex A controls you selected.
Certificates are issued by certification bodies accredited for information security management systems. In Romania, accreditation is granted by RENAR, the national accreditation body, against ISO 17021-1 and ISO 27006. Check that your certification body is accredited for ISO 27001 — an accredited certificate is the one clients and tenders recognise.
Scope, risk assessment, Statement of Applicability, controls and evidence — and at least one internal audit and management review.
The auditor checks your ISMS documentation, scope and whether you are ready for Stage 2.
The auditor tests whether the ISMS works in practice, through interviews, records and sampling. Nonconformities must be corrected before the certificate is issued.
Shorter audits in the years between, to confirm the ISMS keeps working.
A full recertification audit before the three-year certificate expires.
The 2013 version is gone: under IAF MD 26, certified organisations had until 31 October 2025 to move to ISO 27001:2022. Certificates against the 2013 version are no longer valid.
| ISO 27001 | NIS2 (Romania) | SOC 2 | |
|---|---|---|---|
| What it is | International standard for a management system | Legal obligation (OUG 155/2024, DNSC orders) | Attestation report under AICPA standards |
| Mandatory? | Voluntary — often required by clients or tenders | Yes, for entities in scope | Voluntary — often required by US customers |
| Who checks | Accredited certification body | DNSC, and DNSC-certified auditors | Licensed CPA firm |
| What you get | Certificate, three-year cycle | Self-assessment, audits and supervision | Report (Type 1 or Type 2), shared under NDA |
| Controls | Clauses 4–10 + 93 Annex A controls | 34, 133 or 218 controls by level | Trust Services Criteria you choose |
The three overlap heavily: risk assessment, policies, access control, logging, backups, incident response and supplier management appear in all of them. Built carefully, one set of controls and evidence can serve all three. See NIS2 readiness and SOC 2 readiness.
ArxIT Fortis helps you from the first gap assessment to the certification audit: scope, risk assessment and Statement of Applicability, policies that match how you work, technical controls in your systems, evidence in one portal, internal audit and support through Stage 1 and Stage 2. You decide how much we take on.
ISO 27001 is the international standard that sets the requirements for an information security management system (ISMS): how an organisation manages the confidentiality, integrity and availability of its information through risk assessment, policies, controls, monitoring and continual improvement. The current edition is ISO 27001:2022, amended in 2024.
Annex A of ISO 27001:2022 lists 93 controls in four themes: 37 organisational, 8 people, 14 physical and 34 technological. They are selected through risk assessment; the Statement of Applicability records which apply and why.
Certification bodies accredited for information security management systems. In Romania the national accreditation body is RENAR, which accredits certification bodies against ISO 17021-1 and ISO 27006. Consultants, including ArxIT Fortis, do not issue certificates.
No. Under IAF MD 26, certified organisations had until 31 October 2025 to transition to ISO 27001:2022. Certificates against the 2013 version are no longer valid after that date.
Not on its own. ISO 27001 covers much of the same ground as the NIS2 risk-management measures, so it is a strong foundation, but Romanian entities in scope must still meet the DNSC requirements, including the maturity self-assessment on the NIS2@RO platform.
ISO 27001 is a certifiable international standard for a management system; you receive a certificate from an accredited certification body. SOC 2 is an attestation report issued by a US CPA firm under AICPA standards, describing your controls and, in a Type 2 report, how they operated over a period. ISO 27001 is more common in Europe; SOC 2 is most often requested by US customers.
This guide is general information, not legal advice. ArxIT Fortis is not a certification body.