ISO/IEC 27001

What it is

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a structured way to manage information security risk through policies, risk assessment, controls and continual improvement. It exists so organisations can show, through independent certification, that they manage security systematically.

Who it applies to

• Organisations of any size and sector worldwide that want a certifiable security management system
• Suppliers whose customers require ISO 27001 certification in contracts or tenders
• Cloud and IT service providers, where certification is often a baseline sales requirement
• Organisations using it to structure work for NIS2, DORA or GDPR security obligations

Key points

• The core is risk based: you assess information security risks and choose controls to treat them
• The Statement of Applicability lists every Annex A control, whether it applies and why
• Top management must be visibly involved, set objectives and review the ISMS
• Internal audits and management reviews are mandatory parts of the cycle
• The 2022 edition added controls such as threat intelligence, cloud services security, data leakage prevention and secure coding
• Scope matters: certification covers only the defined scope, so check a supplier's scope, not only its certificate

Where to start

1. 1Define the ISMS scope and get management commitment
2. 2Run a risk assessment and draft the Statement of Applicability
3. 3Do a gap assessment of clauses 4 to 10 and Annex A, then close the gaps
4. 4Run an internal audit and management review before booking a certification audit