The same machine, pointed at security

The senior course "AI management system: ISO 42001" already taught you the machine. It covered clauses 4 through 10, Plan-Do-Check-Act, an Annex A of controls adopted selectively, internal audit and management review. It also covered nonconformity, corrective action and continual improvement. If you took that course, you know the shape of a Harmonized Structure management-system standard well. ISO/IEC 27001 is the same machine. It's no cousin standard with new apparatus to learn. It's the original template ISO 42001 borrowed its Annex A pattern from, run on information security instead of AI.

So this course won't re-explain what a management system is, what PDCA does or how an internal audit works. Lesson 5 of the senior course "Compliance: the regulatory landscape" previewed the family resemblance between the two standards, and this course goes the rest of the way in. It spends its time on what's specific to information security and new. That means the document an ISO 27001 auditor reaches for first, and the risk assessment a security programme runs that an AI impact assessment doesn't replace. It also means the parts of Annex A's four themes that land on an engineering team's desk.

What carries over unchanged

If a sentence below sounds like déjà vu, that's the point. The underlying clause is identical:

• Clauses 4 to 10 are the same skeleton: context of the organization, leadership, planning, support, operation, performance evaluation, improvement. ISO 27001 fills them with information-security content, where ISO 42001 filled them with AI-governance content. The scaffolding doesn't change between standards.
• PDCA is the same cycle. Plan the management system, run it, check it against evidence, and act on what the check finds. Lesson 6 of this course is the Check and Act half, audits and corrective action, and it will feel familiar.
• Annex A is the same pattern: a reference list of controls, adopted selectively instead of wholesale, each one justified. ISO 42001's Annex A covered AI lifecycle controls. ISO 27001's Annex A, the original the pattern came from, covers information-security controls across four themes, which lesson 4 covers in depth.
• Internal audit and management review are the same two-meeting structure. Someone organizationally independent checks whether the controls are being followed. Leadership periodically asks whether the controls themselves are still the right ones. Lesson 6 revisits this, pointed outward this time, at a certification body's auditor as well as an internal one.
• Continual improvement is the same closing clause. Nonconformities get corrected, corrective actions get tracked, and the system as a whole is expected to improve on a schedule, not only when something breaks.

What is new in this course

Five things earn their own lesson because the ISO 42001 course didn't cover them in depth:

1. The Statement of Applicability: the document an ISO 27001 auditor opens first. ISO 42001 requires one too, but the AI management course only mentioned it in passing. Lesson 2 is built around it.
2. Risk assessment and risk treatment, in the asset, threat and vulnerability shape ISO 27001 uses. It's related to the risk-versus-impact split ISO 42001 taught, but distinct. Lesson 3 draws that line, because conflating the two is the most common mistake of a team coming from the AI course.
3. Annex A's four themes after the 2022 revision, and which controls reach a Rails engineering team's daily work. Lesson 4.
4. Scope definition, the decision that sets what a certificate means in practice. Lesson 5.
5. The certification lifecycle from the other side of the table: being audited by an accredited certification body instead of running an internal audit. Lesson 6.

ISO/IEC 27001:2022, current as of this course

The current edition is ISO/IEC 27001:2022. It restructured Annex A from the 2013 edition's fourteen domains into four themes, which lesson 4 covers in depth. The transition window for certificates against the 2013 edition has closed, so a live ISO 27001 certificate today means the 2022 edition. A 2024 amendment requires organizations to consider whether climate change is a relevant issue, in their context and in what interested parties expect (clauses 4.1 and 4.2). It added no Annex A controls, so treat it as a nuance of context, not a new control family.

Two related standards are worth naming precisely so you don't confuse them. ISO/IEC 27002 is companion guidance that expands on how to implement each Annex A control. It isn't certifiable itself: you certify against 27001 and use 27002 as the how-to. ISO/IEC 27701 covers privacy information management, alongside GDPR- and LGPD-shaped obligations. Its 2025 edition became a standalone management-system standard, so it no longer requires 27001 underneath. Many organizations still certify both together, because the two share the same structure.

What this course covers

1. This lesson: why ISO 27001 is the same Harmonized Structure machine ISO 42001 already taught, pointed at information security, and the five things that are new.
2. The Statement of Applicability: every Annex A control justified as applicable or excluded, and why an auditor reads this document first.
3. Risk assessment and risk treatment: asset-based and scenario-based approaches, risk owners, treatment plans and residual risk. The lesson also shows how this differs from the AI impact assessment ISO 42001 taught.
4. Annex A after the 2022 revision: the four themes, and the controls that land on an engineering team. They include secure development, change management, access control, cryptography, logging, supplier relationships, vulnerability management and backup.
5. Scope definition: the decision that sets what the certificate covers, and the failure mode of a scope so narrow the certificate means little to a customer reading it.
6. The certification lifecycle: stage 1 and stage 2 audits, surveillance audits, the three-year cycle, and how nonconformities close, from the auditee's side of the table.
7. Putting it together: what certification proves and doesn't prove to a customer, the honest engineering answer to a security questionnaire, and a Rails-shaped checklist.

One note before any of that: nothing in this course is legal advice. Whether your organization needs ISO 27001, what your scope should be and how your Statement of Applicability should read are decisions for counsel and a qualified security lead who know your systems. This course teaches the shape of the standard well enough that you can have that conversation instead of guessing.