Free on-demand masterclass · ~27 minutes
ISO/IEC 27001:2022 Explained — for people who already run ISO 9001
ISO/IEC 27001 is built on the same Harmonized Structure as ISO 9001, so a quality manager already knows about four fifths of it. This masterclass is the other fifth: the formal risk method in 6.1.2, the Statement of Applicability in 6.1.3 and the four ways it fails Stage 1, the 93 Annex A controls theme by theme with the eleven new in 2022, the rhythm of evidence, the eight findings auditors write again and again, how the standard lines up with POPIA — and what it does not certify — and a realistic 44-week path from decision to certificate. Narrated slides, no fluff, watch on demand.
Free companion tool
The masterclass tells you what the standard asks. The free Gap Analysis Checklist is the working file for it — the Clauses 4–10 tab with what each requirement asks and the evidence an auditor expects, the Annex A tab with all 93 controls, an Applicable? column that seeds your Statement of Applicability and the eleven new-in-2022 controls flagged, a Summary tab that scores readiness by clause group and theme, and a 44-week timeline that recalculates from your start date.
Get the free ISO 27001:2022 Gap Analysis Checklist (all 30 clause requirements and 93 Annex A controls scored, with an Applicable? column that seeds your SoA, a readiness summary and a 44-week timeline)
Free, instant download. We'll only email you the occasional practical quality update — no spam, unsubscribe anytime.
What you'll learn
01 · Why now, and the edition facts
Customers flowing security down the supply chain, POPIA s19 and two R5m fines, King V, insurers — and why the 2022 edition (with Amendment 1:2024) is a stable target: no revision in progress, the 2013 edition expired 31 October 2025.
02 · Two halves, and the clause-by-clause map
Clauses 4–10 you mostly know; Annex A is a completeness check, not a checklist. What each clause keeps from ISO 9001 and what ISO 27001 adds — interfaces and dependencies in scope, two named roles, the Information Officer.
03 · The heart: 6.1.2 and 6.1.3
The risk process as a flow — criteria first, then identify with owners, analyse, evaluate, treat, compare with Annex A — and the five things an auditor tests: criteria, repeatability, owners, coverage, timing.
04 · The Statement of Applicability
The four columns an SoA must carry, the two it should, and the four ways it fails Stage 1 — generic justifications, unreasoned exclusions, untrue status, never updated — with the one fix for all four.
05 · Support, operation, evaluation
Measurable and monitored objectives, 6.3 planning of changes, awareness as a programme, cloud and external providers under control, documented measurement results, auditing both halves, the new management-review input.
06 · Annex A: 93 controls, 11 new, 5 attribute tags
The four themes and what lives in each, the eleven controls new in 2022 to check first, and the ISO 27002 attribute tags that answer a NIST-speaking customer without a second document.
07 · What ISO 9001 practitioners reuse — and the tempo problem
Document control, audit programme, management review, competence, corrective action and the 6.3 record all carry over; the risk method, the SoA and the evidence rhythm do not.
08 · Where implementations fail, POPIA, the 44-week path, mistakes
Eight recurring findings; POPIA s19, s22 and Regulation 4 mapped to the clauses; why certification is not a POPIA certificate and Cybercrimes Act s54 is still not in force; a realistic timeline; six mistakes to avoid.
Score your own gap in an afternoon
The masterclass explains the standard. The free ISO 27001:2022 Gap Analysis Checklist below scores your organisation against all of it — the 30 clause requirements and the 93 Annex A controls, with an Applicable? column that seeds your Statement of Applicability, a readiness summary by clause group and theme, and the 44-week timeline from your own start date. Every reference matches a page in the Clause Explorer.
Independent explainer written from the ISO/IEC 27001:2022 clause and Annex A structure, including Amendment 1:2024, in Qlause's own words; no standard text is reproduced. Work from your licensed copies of ISO/IEC 27001:2022 and 27002:2022. Qlause is not a certification body; certification to ISO/IEC 27001 is not a POPIA certificate. Regulatory facts are as at the recording date, 3 October 2026.