ISO 27001
Also known as: ISO/IEC 27001, ISO 27001:2022, Information Security Management System, ISMS
ISO 27001 is an international standard published by the International Organization for Standardization that specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS).
Certification is voluntary and awarded by accredited third-party certification bodies after a formal audit. It covers all types of information (not just digital) and applies to any organization regardless of size, industry, or geography.
ISO 27001, explained at three levels
At home
ISO 27001 is a stamp of approval from an independent expert saying that a company manages its information security in a structured, proven way. It is not just about technology: it covers the policies staff follow, how access to systems is controlled, what happens when something goes wrong, and how the company keeps improving. Many large organizations and governments require their suppliers to hold ISO 27001 certification before sharing sensitive data with them.
At work
ISO 27001 certification demonstrates to customers and partners that your organization has implemented a documented Information Security Management System that an accredited auditor has independently verified. Certification requires a Stage 1 audit (document review) followed by a Stage 2 audit (evidence testing), then annual surveillance audits and a full re-certification every three years. The standard's Annex A lists 93 controls across four themes (Organizational, People, Physical, Technological) that organizations select from based on a Statement of Applicability.
At home
The core of ISO 27001 is a risk-based approach: the organization identifies its information assets, assesses threats and vulnerabilities, determines acceptable risk levels, and implements controls to treat unacceptable risks. The Statement of Applicability (SoA) documents which Annex A controls are applicable, which are implemented, and why any are excluded. Two certified organizations can have quite different control sets: both are valid as long as each has justified their choices based on their own risk assessment.
At work
ISO 27001:2022 reorganized Annex A into four themes: Organizational controls (37 controls (policies, roles, supplier relationships), People controls (8 controls) screening, training, remote working), Physical controls (14 controls (physical security, equipment maintenance), and Technological controls (34 controls) access management, cryptography, network security). Eleven new controls introduced in 2022 include threat intelligence, information security for cloud services, ICT readiness for business continuity, and data masking.
At home
ISO 27001 integrates tightly with related standards in the ISO 27000 family: ISO 27002 (implementation guidance for Annex A controls), ISO 27005 (risk management), ISO 27017 (cloud security), ISO 27018 (cloud privacy), and ISO 27701 (privacy information management). The ISO High-Level Structure shared by all ISO management system standards enables integrated audits: an organization can simultaneously audit ISO 27001, ISO 9001, and ISO 14001 with a single audit team, reducing cost and disruption.
At work
From a practitioner standpoint, the risk assessment methodology is where implementation quality varies most widely. Weak risk assessments that list generic IT threats without tying them to specific information assets produce a Statement of Applicability that passes the audit but does not improve actual security posture. A credible ISMS defines information assets at the right level of granularity, links each risk to a specific threat and vulnerability, and tracks residual risk after control implementation. Continuous improvement (Clause 10) requires documented management review meetings with evidence of corrective actions from audit findings and incidents.
Real-world examples
At home
Sophie was evaluating two competing cloud accounting tools for her freelance business. One held ISO 27001 certification; the other did not. The certification told Sophie that an independent auditor had verified the vendor's security processes, not a guarantee of perfection, but meaningful reassurance when sharing financial records.
At work
Hartwell Consulting pursued ISO 27001 certification to win a government contract that required it. The ISMS project took nine months: they appointed an Information Security Manager, completed a gap analysis against Annex A, wrote missing policies, ran a formal risk assessment, and addressed high-priority gaps before inviting the certification body for the Stage 1 audit.
How it compares
| Feature | ISO 27001 | SOC 2 | NIST Cybersecurity Framework |
|---|---|---|---|
| Output | Certificate from accredited body | Attestation report from CPA firm | No certificate: self-assessed or third-party assessed |
| Mandatory? | No: voluntary | No: customer-driven | No, voluntary (though US federal agencies are expected to use it) |
| Scope | Full ISMS: all information security | Selected Trust Service Criteria | Cybersecurity risk management |
| Geography | Global recognition | Strongest in North America | Strong in US; growing globally |
| Update cycle | Certification renewed every 3 years | Report covers 6-12 month window | Framework updated periodically; no expiry |
ISO 27001 offers globally recognized certification and the broadest scope. SOC 2 is the preferred customer assurance document in North American SaaS markets. NIST CSF is a planning and improvement tool rather than a certifiable standard.
For analysts
In BA artefacts, ISO 27001 requirements surface as vendor qualification criteria, system design constraints, and security NFRs. When documenting requirements for a new system, check whether it falls within the ISMS scope: if so, a risk assessment for the system must be completed before go-live. Treat ISO 27001 certification as a continuous obligation, not a one-time event; annual surveillance audits and continuous control monitoring are required to maintain it. Useful requirement: 'The system must be assessed under the existing ISMS risk assessment process and any new risks documented in the risk register before production deployment.'
History & origin
ISO 27001 traces its lineage to the British Standard BS 7799, published by the British Standards Institution in 1995. BS 7799 Part 2 added ISMS certification requirements and was adopted internationally as ISO/IEC 27001 in 2005. Significant revisions followed in 2013 (reorganized around Annex SL for alignment with other ISO management system standards) and 2022 (updated Annex A controls from 114 to 93, introducing 11 new controls covering threat intelligence, cloud security, and data masking). Organizations certified to the 2013 version had until October 31, 2025 to transition, so all valid certificates now follow the 2022 version.