What is ISO 27001?

Definition

ISO/IEC 27001 is the leading international standard for information security management. It specifies the requirements for establishing, operating, and continually improving an information security management system (ISMS): a risk-based way of managing the security of information.

Background

ISO 27001 is published jointly by ISO and the IEC. The current edition is ISO/IEC 27001:2022. Its management-system requirements live in clauses 4 to 10 (context, leadership, planning, support, operation, performance evaluation, and improvement). Annex A lists 75+ controls, organized into the Organizational, People, Physical and Technological themes. Unlike SOC 2, ISO 27001 is a certifiable standard: an accredited certification body audits your ISMS, and certificates run on a three-year cycle with annual surveillance audits. Clauses 1 to 3 come before the requirements: its scope, a normative reference to ISO/IEC 27000 (the vocabulary standard), and terms and definitions. The auditable requirements start at clause 4. Certificates issued against the 2013 edition had to move to the 2022 edition by 31 October 2025.

Why it matters

ISO 27001 is widely recognized internationally, so it carries weight with customers outside North America. The ISMS links your risk assessment and risk treatment to the controls you choose, the people responsible for them, and the evidence that they operate. How you handle access control or business continuity, for example, follows from your scope and your risks. That makes it a more durable way to manage information security than a checklist you satisfy once. The point of the ISMS is to protect the confidentiality, integrity and availability of information, and the risk assessment is where you decide what threatens each of them. The certificate states the scope it covers, so a buyer can check whether the service they use falls inside it.

Step by step

1. Define the ISMS scope and secure leadership commitment.
2. Run a risk assessment and choose risk treatments.
3. Produce a Statement of Applicability (SoA) that justifies which Annex A controls apply.
4. Implement the selected controls and the mandatory management-system processes.
5. Keep the documented information the clauses require, including the ISMS scope (4.3), the information security policy (5.2), the risk assessment and risk treatment processes (6.1.2 and 6.1.3), and the results of internal audits (9.2) and management reviews (9.3).
6. Run internal audits and a management review.
7. Engage an accredited certification body for the Stage 1 and Stage 2 audits.
8. After certification, plan for surveillance audits in the second and third years and a recertification audit before the certificate expires.

Examples

• A European SaaS company pursues ISO 27001 because its enterprise prospects expect the certificate rather than a SOC 2 report.
• A company that already has SOC 2 crosswalks its existing controls to Annex A, so much of the evidence is reused. It still has to document its ISMS scope, risk treatment decisions, and Statement of Applicability before ISO 27001 certification.
• A SaaS company scopes its ISMS to the product platform and the teams that run it, and leaves a separate consulting business out. The certificate states that scope, so platform customers know it applies to the service they buy.

Common mistakes

• Writing a Statement of Applicability that excludes controls without a documented, risk-based justification.
• Treating the risk assessment as a formality instead of the engine that drives control selection.
• Neglecting the mandatory internal audit and management review, which auditors always check.
• Drawing the ISMS scope so narrowly that the service customers actually buy sits outside the certificate.

FAQ