ISO/IEC 27001, part of the growing ISO/IEC 27000 family of standards, is an Information Security Management System (ISMS) standard published in October 2005 by the International Organization for Standardisation (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2017 - Information technology -- Security techniques -- Information security management systems -- Requirements but it is commonly known as "ISO 27001".
ISO/IEC 27001 requires that management:
Systematically examine the organisation's information security risks, taking account of the threats, vulnerabilities and impacts;
Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and
Adopt an overarching management process to ensure that the information security controls continue to meet the organization's information security needs on an ongoing basis.
ISO/IEC 27001:2017 is intended to be suitable for several different types of use, including the following:
Use within organisations to formulate security requirements and objectives;
Use within organisations as a way to ensure that security risks are cost effectively managed;
Use within organisations to ensure compliance with laws and regulations;
Use within an organisation as a process framework for the implementation and management of controls to ensure that the specific security objectives of an organisation are met;
Definition of new information security management processes;
Identification and clarification of existing information security management processes;
Use by the management of organizations to determine the status of information security management activities;
Use by the internal and external auditors of organizations to determine the degree of compliance with the policies, directives and standards adopted by an organisation;
Use by organizations to provide relevant information about information security policies, directives, standards and procedures to trading partners and other organizations with whom they interact for operational or commercial reasons;
Implementation of business-enabling information security;
Use by organisations to provide relevant information about information security to customers.
How to achieve ISO 27001 certification – ISO 27001 implementation steps
Documentation Design and finalisation
Internal Auditor Training and conduct of internal audit