What is ISO 27001 (ISO 27001)?
ISO 27001 (ISO 27001) is the international standard that specifies requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System. It gives organizations a structured framework for managing information security risks and can be used to obtain third-party certification.
What it is
ISO 27001 is a standard published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). The current version is ISO/IEC 27001:2022. It defines what an Information Security Management System (ISMS) must contain, not how to build one. The standard has two main parts:
- Clauses 4 to 10: Mandatory requirements covering context, leadership, planning, support, operation, performance evaluation, and improvement.
- Annex A: A reference set of 93 controls organized into four themes: organizational, people, physical, and technological.
Organizations select controls from Annex A based on a risk assessment and document their choices in a Statement of Applicability (SoA). An accredited certification body then audits the ISMS and issues a certificate valid for three years, with annual surveillance audits.
Why it matters
ISO 27001 certification signals to customers, partners, and regulators that an organization manages information security in a systematic, auditable way. Many enterprise procurement teams and regulated industries require it as a condition of doing business. It also creates internal discipline: risk assessments must be repeated, controls must be tested, and management must review the ISMS at defined intervals.
How tools address it
Compliance management platforms and GRC platforms help teams prepare for and maintain ISO 27001 certification. Common functions include:
- Mapping controls from Annex A to internal policies and evidence.
- Tracking control ownership and completion status.
- Storing risk assessment records and treatment plans.
- Generating the Statement of Applicability.
- Scheduling and recording internal audits and management reviews.