ISO/IEC 27001 certifies an information security management system, not a toolchain. For a DevOps lead that means your pipelines become evidence: change control, access, logging and supplier handling must be repeatable and recorded. The third edition from 2022 has 93 Annex A controls, and the transition deadline for certified clients was 31 October 2025.
What does the standard actually require?
It requires a risk-based management system: you define scope, assess risks, choose controls, run them and review them on a cycle. Annex A is a reference list of controls you select from. You justify each inclusion or exclusion in a Statement of Applicability. An external certification body audits that system, so the paper trail matters as much as the technical setup.
Per the public summary of the 2022 revision, 11 controls were new, 24 were merged and 58 were updated. Several new ones land squarely on engineering, such as secure coding, configuration management and monitoring activities.
Which parts land on a DevOps lead?
Think in terms of evidence you can already generate:
- Change and release: pull request approvals, protected branches and deployment logs show controlled change.
- Access: who can deploy to production, how access is granted and removed, and how secrets are stored.
- Configuration: infrastructure as code with review is stronger evidence than a wiki page.
- Logging and monitoring: what is logged, retention, and who reviews alerts.
- Suppliers: which open source and SaaS dependencies you rely on, and how you vet them.
- Secure development: test gates, dependency scanning and a documented process.
An auditor samples. If you can pull ten recent production changes with approver, test result and timestamp in minutes, that audit area is easy.
What do you decide, and what is not yours?
Scope belongs to leadership, but you should argue for it. A narrow scope (one product, one environment) is cheaper and honest. A scope that excludes the production pipeline will not satisfy buyers who ask for the certificate.
Risk acceptance is also not yours. You flag the gap, someone accountable signs the exception.
Your calls are practical: which controls you automate, where evidence is stored, and what you stop doing because it cannot be evidenced.
Common traps
Documenting a process nobody follows is the classic one. Another is treating certification as a project with an end date; surveillance audits follow, and the system has to keep running. Finally, do not copy a control list from a template without checking that it matches what your team actually does.
How to check or apply this
- Ask who owns the ISMS and what the current scope statement says.
- Map your pipeline stages to the Annex A themes and list the evidence each already produces.
- Pick three controls to automate evidence for first: change approval, access review and dependency inventory.
- Set a retention period for pipeline logs and write it down.
- Do a mock sample: pull ten changes and see what is missing.
What does an audit sample look like in practice?
Auditors rarely read every record. They pick a handful of items and trace each one end to end. For delivery work, a typical sample is five or ten production changes from the audit period. For each, they want to see the request, the review, the test result, the approval and the deployment record, all tied by an identifier.
The weak point is usually exceptions. An emergency fix pushed outside the normal path is fine if the process allows it and the record shows a follow-up review. It becomes a finding when nobody can explain why the usual gate was skipped. Write the emergency path down before you need it.
Access reviews get sampled the same way. Expect to show that leavers lost production access within your stated time, and that someone with authority reviewed the list on schedule.
Quick check
Does ISO 27001 mandate specific tools?
No. It mandates a managed process with risks assessed and controls justified. Tools only matter as sources of evidence.
Is the 2013 edition still valid for certificates?
Not for certified clients. Accredited bodies had to finish moving clients to the 2022 edition by 31 October 2025, per the public summary below.
Sources
Last reviewed: 18 October 2026.
