What it covers. The international standard for an information security management system. Clauses 4 to 10 set requirements for context, leadership, planning, support, operation, performance evaluation and improvement. Annex A lists 93 reference controls in four themes, against which a Statement of Applicability is produced.
In practice. Applying it well means defining a meaningful scope, running a repeatable risk assessment, selecting controls based on risk and documenting the choices in a Statement of Applicability. Management reviews performance, internal audits test the system and nonconformities lead to corrective action. Certification audits examine both the management system and evidence that controls operate, for example vulnerability management under A.8.8.
Common gaps. Common gaps are a narrow scope chosen for convenience, a risk assessment disconnected from real decisions and controls documented but not operated. Organisations certified to the 2013 edition had to transition to 2022 by October 2025.