ISO 27001
ISO/IEC 27001 Information Security Management
Protecting the confidentiality, integrity and availability of information.
ISO/IEC 27001 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system. It helps organisations manage the security of assets such as financial information, intellectual property, employee details and information entrusted by third parties.
It is a risk-based standard: the organisation assesses its information security risks, chooses controls to treat them, and records its decisions in a statement of applicability. Annex A provides a reference set of controls.
Key requirements
What ISO 27001 asks for
Context of the organisation
Understand internal and external issues, interested parties and the scope of the system.
Leadership
Top management shows commitment, sets the policy and assigns roles and responsibilities.
Planning
Address risks and opportunities and set measurable objectives.
Support
Provide the resources, competence, awareness, communication and documented information needed.
Information security risk assessment
Identify risks to confidentiality, integrity and availability, and decide how to treat them.
Statement of applicability
Record which Annex A controls apply and why, and whether they are implemented.
Annex A controls
Organisational, people, physical and technological controls that reduce information security risk.
Performance evaluation
Monitor, measure, audit internally and review the system at management level.
Improvement
Correct nonconformities and keep improving the system.
Benefits
Why organisations use it
- Protection against data breaches and downtime
- Support for legal and contractual obligations
- Trust from customers who share sensitive data
- A risk-based approach to security investment
- A recognised basis for supplier due diligence
Who it is for
Typical organisations
ANAP accreditation
How ANAP accredits ISO 27001 certification bodies
Certification bodies auditing ISO/IEC 27001 are assessed against ISO/IEC 17021-1, together with the information security requirements of ISO/IEC 27006.
FAQ
Frequently asked questions
Does ISO 27001 make a company hack-proof?+
No. It shows that the organisation manages information security risk with a tested system, but no standard removes all risk.
What is the statement of applicability?+
It is a document listing the security controls that apply to the organisation, with the reasons for including or excluding each one.