ISO/IEC 27001

What it is

ISO/IEC 27001 is the international standard that specifies the requirements for an Information Security Management System (ISMS) — the management framework an organisation uses to identify, treat and monitor information-security risk. It is the most widely certifiable security-management standard, used as evidence of a serious security posture by regulators, auditors and customers.

What an ISMS does

• Establishes context — what the organisation does, what it has to protect, who it serves.
• Assesses risk — what could go wrong, how likely, how badly.
• Treats risk — picks controls from a structured catalogue (Annex A, aligned with ISO/IEC 27002), and accepts, transfers or mitigates the rest.
• Operates and improves continually — measurement, audit, management review, corrective action.

Annex A controls (2022 revision)

The current edition (2022) reorganises Annex A into four control themes — organisational, people, physical and technological — with 93 controls in total, replacing the previous 14 categories / 114 controls structure.