ISO 27001
How it works
The standard requires an organization to: (1) define the scope and context of the ISMS and the expectations of interested parties; (2) systematically assess information security risks, taking account of potential consequences and the likelihood of loss of confidentiality, integrity and availability; (3) select risk treatment options and determine the necessary controls (using the reference set in Annex A) and produce a Statement of Applicability (SoA); (4) operate, monitor, review and continually improve the management system. The ISMS is integrated with the organization processes and management structure and scaled to its needs. Conformance can be confirmed by a certificate issued by an independent, usually accredited certification body; the certificate applies only within the scope stated on it.
Problem solved
Addresses the problem of fragmented, ad-hoc information security: instead of isolated technical measures it provides a coherent, repeatable and auditable management framework that systematically identifies and treats risk, and gives interested parties (customers, regulators, partners) credible assurance that information security is adequately managed.
Evolution
The British BS 7799 standard, written by the UK Department of Trade and Industry (DTI), became the basis for the later ISO/IEC 27001.
Published jointly by ISO and IEC in October 2005, formalising a certifiable ISMS at the international level.
A more flexible and streamlined approach aligned with the high-level structure shared across management system standards. Annex A listed 114 controls in 14 clauses.
The realigned Annex A contains 93 controls grouped into four themes (organizational, people, physical, technological); 11 controls are new, 24 result from merging earlier controls and 58 were updated. Aligned with ISO/IEC 27002:2022.
In February 2024 the 2022 edition was supplemented by an amendment adding a requirement to determine whether climate change is a relevant issue in the organization context, and a note on interested parties and their climate-related requirements.
Accredited certification bodies were required to complete the transition of their certified clients to the third edition by 31 October 2025.