Other ISO/IEC standards

What it is

This group covers ISO and IEC standards that sit around ISO 27001 and extend it to specific topics such as privacy, incident management, business continuity, supplier security and AI. Most follow the same management system structure, so they can be run as one integrated system.

Who it applies to

• Organisations already running ISO 27001 that want to extend it to privacy or AI
• Organisations needing certifiable business continuity, for example under DORA or NIS2 resilience expectations
• Buyers and suppliers managing information security in supplier relationships
• Organisations developing or using AI that want a structured management system for it

Key points

• Know which standards are certifiable requirements and which are guidance only
• Shared management system structure makes it practical to integrate them with an existing ISO 27001 ISMS
• ISO/IEC 27701 helps demonstrate GDPR accountability but does not by itself prove GDPR compliance
• ISO 22301 gives a structure for business impact analysis, continuity plans and exercises
• ISO/IEC 42001 is the first certifiable AI management system standard and is often used alongside EU AI Act preparation
• Cloud specific guidance is available in ISO/IEC 27017 and, for personal data in public clouds, ISO/IEC 27018

Where to start

1. 1Pick the standards that match a concrete need: a customer, a regulator or a known risk
2. 2Extend the existing ISMS scope, risk method and audit programme rather than building separate systems
3. 3Buy the current edition from ISO or your national standards body before planning work
4. 4Ask your certification body whether it is accredited for the standard you want