Guide
ISO/IEC 27001 - in brief
ISO/IEC 27001 is the international standard for information security management systems (ISMS). It helps organisations protect the confidentiality, integrity and availability of information - customer and employee data, financial information, know-how - through risk assessment and appropriate controls.
The current version is ISO/IEC 27001:2022. Annex A contains 93 controls in 4 themes - organisational, people, physical and technological - including 11 controls that were new in the 2022 edition. The transition from the 2013 version ended on 31 October 2025.
The standard does not prescribe specific software. It requires you to assess the risks to your information and choose controls that match them. The certificate is issued by an independent accredited certification body after an audit; Baltov Consult is a consultant - we prepare your system and your team for that audit.
Who is ISO/IEC 27001 for
The standard is useful for any organisation that treats information as a valuable asset:
- IT, cloud and software companies
- Banks, insurers and financial institutions
- Entities under NIS2 - essential and important
- Hospitals, laboratories and healthcare facilities
- Accounting, legal and consulting firms
- Municipalities and government institutions
What ISO/IEC 27001 requires
At its core is the information security risk assessment: which assets matter, what threats and vulnerabilities exist and what the consequences would be. Based on it, the organisation selects its controls and documents them in a Statement of Applicability - which controls apply, which do not and why.
Also required are an information security policy, roles and responsibilities, training, incident management, business continuity, supplier control, monitoring, internal audits and management review.
The benefits
The certificate is widely recognised proof of information security - corporate clients, tenders and partners ask for it. It also saves you from filling in dozens of security questionnaires.
The system reduces the risk of breaches, data leaks and disruptions, and it is the most direct route to the cybersecurity measures under NIS2 and the Bulgarian Cybersecurity Act - although it does not cover them automatically.
In practice, confidentiality means role-based access rights, encrypted laptops and confidentiality agreements; integrity means change control, activity logs and checks on data entry; availability means backups with tested restoration, backup power and a continuity plan.
How implementation works
- Scope and assetsWhich activities, sites and systems fall within the scope, and an inventory of the information assets.
- Risk assessmentThreats, vulnerabilities and consequences - and a plan for treating the risks.
- Statement of ApplicabilitySelection and justification of the Annex A controls.
- Policies and controlsAccess, passwords, backups, incidents, suppliers and training.
- Internal audit and reviewWe check the system and prepare the management review.
- Certification auditWe prepare the organisation for the audit by an independent certification body.
What you get
- Inventory of information assets
- Risk assessment and risk treatment plan
- Statement of Applicability
- Information security policy and rules
- Incident management procedure
- Business continuity plan
- Trained staff and internal auditors
- Preparation for the certification audit