Published · By the Aesparrow Security Research Team
Short answer
ISO/IEC 27001 is the international standard for establishing, implementing, maintaining and continually improving an information security management system (ISMS). It requires organisations to assess information security risks and treat them with appropriate controls, and it can be independently certified by an accredited certification body.
What is an ISMS?
An information security management system (ISMS) is the set of policies, processes, roles and controls an organisation uses to manage information security risk in a systematic way. ISO 27001 defines what a compliant ISMS must include — from leadership commitment and risk assessment to internal audit and continual improvement.
What does ISO 27001:2022 contain?
- Clauses 4–10: mandatory management-system requirements: context, leadership, planning, support, operation, performance evaluation and improvement.
- Annex A: 93 reference controls grouped into organisational, people, physical and technological themes.
- Statement of Applicability (SoA): documents which Annex A controls apply and why.
- ISO/IEC 27002: companion guidance explaining how to implement each control.
Why implement ISO 27001?
- Win and keep customers: certification answers security questionnaires and is often a tender requirement.
- Reduce risk: a risk-based approach focuses investment on the threats that matter.
- Meet multiple obligations: ISO 27001 controls map to SOC 2, GDPR, HIPAA and NIST.
- Build a security culture: clear roles, training and continual improvement.
What is the difference between ISO 27001 implementation and certification?
Implementation is the work your organisation does — often with an ISO 27001 consultant — to build and operate the ISMS. Certification is the independent audit by an accredited certification body: a Stage 1 documentation review and a Stage 2 audit of how the ISMS operates. A certificate is valid for three years, with annual surveillance audits.