What ISO/IEC 27001 is and how it extends to OT environments
ISO/IEC 27001 is the most widely adopted international standard for information security management systems (ISMS): it defines a structured process to identify risks, select appropriate controls and improve them over time, with certification issued by accredited third-party bodies.
The 2022 version, aligned with the updated Annex A controls (93 controls across 4 categories), strengthened the weight of technical controls, including monitoring (A.8.16), vulnerability management (A.8.8) and network security (A.8.20-A.8.23), all relevant to OT environments.
Many organisations that certify their ISMS effectively cover only the IT perimeter, leaving operational networks out; this is a common audit gap, because the ISMS scope must explicitly include OT assets if they contribute to critical business processes or handle sensitive information.
Extending ISO 27001 to OT means applying the same principles - risk identification, technical and organisational controls, continual improvement - to a context with different constraints: legacy systems that cannot be patched, operational availability taking priority over confidentiality, non-standard-IT industrial protocols.
ISO/IEC 27001
ISO/IEC 27001:2022 - Information Security Management Systems
Certifiable standard for information security management. Together with Annex A:2022 (93 controls organised in 4 themes: organisational, people, physical, technological), it is the benchmark most often required in tenders, enterprise contracts and supply chains.
- 01Definition of the Statement of Applicability (SoA) and scope
- 02Documented risk assessment and risk treatment plan
- 03Implementation of applicable Annex A controls
- 04Internal audit, management review and continuous improvement
- 05Technical controls: A.8 (Technological), including A.8.7 malware protection, A.8.8 vulnerability management, A.8.16 monitoring activities
MON5 provides objective technical evidence for many Annex A:2022 controls applied to the OT perimeter - usually the least covered area in IT-focused ISMS. Continuous monitoring (A.8.16), vulnerability management (A.8.8), asset inventory (A.5.9) and network management (A.8.20-A.8.23) are automatically documented.
- →A.5.9 Inventory of information and associated assets
- →A.8.8 Management of technical vulnerabilities (CVE + EPSS)
- →A.8.16 Monitoring activities on the OT network
- →A.8.20-23 Network security and segregation (zones/conduits)
- →Exportable reports as evidence for certification audits
- ISMS (Information Security Management System)
- The information security management system required by ISO 27001: policies, processes, roles and controls to manage information risk on an ongoing basis.
- Annex A
- ISO 27001's normative annex listing the reference security controls (93 in the 2022 version, grouped into organisational, people, physical, technological) to be selected based on the risk assessment.
- Statement of Applicability (SoA)
- Document listing the selected or excluded Annex A controls, with the corresponding justification, and central to the auditor's verification.
- Risk Treatment Plan
- The plan describing how identified risks are treated: mitigated through controls, transferred, accepted or avoided.
- ISMS scope
- The definition of the organisational and technical boundaries covered by the certification; it must explicitly include OT networks if relevant to the organisation's critical processes.
- Surveillance audit
- Periodic audit (typically annual) conducted by the certification body after initial issuance, to verify ongoing compliance over time.
Does ISO/IEC 27001 apply to industrial OT environments?+
Yes. ISO 27001 applies to any information system, including OT. Certification requires an ISMS that covers operational networks and industrial assets, not just traditional IT systems.
Which ISO 27001 Annex A controls are most relevant for OT cybersecurity?+
A.5.9 (asset inventory), A.8.8 (vulnerability management), A.8.16 (monitoring of activities) and A.8.20-A.8.23 (network security) are the controls most directly applicable to industrial OT environments.
Does MON5 produce evidence useful for an ISO 27001 audit?+
Yes. MON5 generates up-to-date asset inventory, anomaly logs, prioritised CVE/EPSS vulnerability reports and network topology documentation — direct evidence required by ISO 27001 auditors.
Does OT need to be certified separately from IT under ISO 27001?+
No, OT typically falls within the same organisational ISMS if the scope explicitly provides for it; no separate certification is needed, but the controls applied must account for the specific constraints of industrial environments.
What happens if the ISMS doesn't explicitly cover OT?+
The organisation can still obtain certification, but with a scope limited to IT: if OT assets contribute to critical business processes, an experienced auditor will still raise the gap as an unmanaged residual risk.
How long is the ISO 27001 certification cycle?+
The certificate is valid for three years, with annual surveillance audits and a full recertification audit at the end of the third year.
What are the most common mistakes when applying ISO 27001 to OT?+
Underestimating availability as a higher priority than confidentiality, applying aggressive patching incompatible with legacy systems, and lacking an up-to-date OT asset inventory to base the risk assessment on.
Does MON5 replace the work of an ISO 27001 consultant?+
No. MON5 provides the objective technical evidence (asset inventory, vulnerabilities, anomalies, topology) that feeds the risk assessment and technical controls; a consultant remains necessary to build the ISMS, governance documentation and organisational processes.
Let's figure out what you really need.
Show us the OT perimeter and the regulations you need to cover: we will tell you what MON5 documents directly, where complementary work is needed, and which tier to start from - no hard selling.