Assurance goals
ISO 27001 preparation
How technical testing can inform risk treatment and control evaluation in an ISO/IEC 27001 information security management system.
ISO/IEC 27001:2022 asks organisations to treat information security risks and to evaluate the controls they rely on. Technical testing shows how real systems behave, which can inform that work. It does not replace the management system, the risk assessment or the statement of applicability.
How testing can support this goal
- Evidence for Annex A control 8.8 (management of technical vulnerabilities): identifying weaknesses in systems in use and deciding how to act on them.
- Input for Annex A control 8.29 (security testing in development and acceptance), for example before a significant system or change goes live.
- Findings that feed the risk register, so treatment decisions rest on demonstrated exposure rather than assumptions.
- A check on whether controls work in practice, not only as documented procedures.
What testing does not do
- ISO/IEC 27001 does not require a particular type of test, and no single test demonstrates conformity.
- A test report does not replace the risk assessment, the statement of applicability or internal audit.
- Certification decisions rest with the certification body, not with the testing provider.