Cybersecurity glossary
What is ISO/IEC 27001?
Also known as: ISO 27001, ISMS
Definition
ISO/IEC 27001 is the international standard for an information security management system (ISMS), against which organizations can be independently certified.
Why it matters
It requires a risk-based approach: assess risks, select controls (the 2022 Annex A lists 93), document them in a Statement of Applicability, and improve continuously through internal audit and management review.
Common questions about ISO/IEC 27001
- How do I check a software vendor’s security before signing a contract?
- What is ISO/IEC 42001?
- What is ISO 27001 certification?
- When should a small business bring in a cybersecurity consultant?
- What is GRC in cybersecurity?
- What is the difference between ISO 27001 and SOC 2?
- Should I use ISO 27001 or the NIST Cybersecurity Framework?
- What does a GRC analyst do?
See also
Sources
Related Guides
GuideGRC
How to Build a Security Policy Framework: Policies, Standards and Procedures That People Follow
A practical guide to writing, approving and maintaining information security policies: the policy hierarchy, the core policy set, ownership, review cycles and how to prove people follow them.
Read more GuideGRC
How to Conduct a Cybersecurity Risk Assessment in 7 Steps
A step-by-step method for information security risk assessment aligned with ISO 27005 and NIST SP 800-30: assets, threats, likelihood and impact scoring, risk appetite, treatment and the risk register.
Read more