What is ISO 27001 certification?
Short answer
ISO/IEC 27001 is an international standard for an information security management system (ISMS). Certification means an accredited certification body has audited the organization’s ISMS, including risk assessment, policies and selected controls, and found it meets the standard.
The details
The 2022 edition’s Annex A lists 93 controls grouped into organizational, people, physical and technological themes. Organizations choose which apply based on their risk assessment and record the decision in a Statement of Applicability.
Useful next reads and tools
Terms explained
- ISO/IEC 27001
- ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which organizations can be independently certified.
- Risk assessment
- A cybersecurity risk assessment identifies assets, threats and weaknesses, estimates likelihood and impact, and prioritizes how to treat each risk.
Sources
Related questions
Related Guides
GuideGRC
How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Read more GuideGRC
How to Build a Security Policy Framework: Policies, Standards and Procedures That People Follow
A practical guide to writing, approving and maintaining information security policies: the policy hierarchy, the core policy set, ownership, review cycles and how to prove people follow them.
Read more