What is ISO 27001?
The latest version of ISO 27001 was published in September 2013, replacing the 2005 iteration.
For an introduction to the principles of information security management and ISO 27001:2013, read our bestselling An Introduction to Information Security and ISO 27001 (2013) A Pocket Guide, Second Edition.
Speak to an ISO 27001 expert
Having led the world’s first ISO 27001 certification project, we understand what it takes to implement the Standard. We can support you throughout your project, from implementation to certification. Speak to one of our experts for more information on how we can help you.
Contact us
What is an ISMS?
An ISMS is a holistic approach to securing the confidentiality, integrity and availability (CIA) of corporate information assets.
It consists of policies, procedures and other controls involving people, processes and technology.
Informed by regular information security risk assessments, an ISMS is an efficient, risk-based and technology-neutral approach to keeping your information assets secure.
To find out more about what an ISO 27001 ISMS is, download our free infographic.
ISO 27001 and risk management
Risk management forms the cornerstone of an ISO/IEC ISMS. All ISO 27001 projects rely on regular information security risk assessments to determine which security controls to implement and maintain.
The Standard defines its requirements for the risk management process, including risk assessment and risk treatment, in section 6.1.2.
ISO/IEC 27001: 2013 controls
The Standard doesn’t mandate that all 114 controls be implemented. Instead, the risk assessment should define which controls are required, and a justification provided as to why other controls are excluded from the ISMS.
Below are the list of control sets.
- A.5 Information security policies
- A.6 Organisation of information security
- A.7 Human resource security
- A.8 Asset management
- A.9 Access control
- A.10 Cryptography
- A.11 Physical and environmental security
- A.12 Operations security
- A.13 Communications security
- A.14 System acquisition, development and maintenance
- A.15 Supplier relationships
- A.16 Information security incident management
- A.17 Information security aspects of business continuity management
- A.18 Compliance
ISO 27001 benefits
ISO 27001 is one of the most popular information security standards in existence. Independently accredited certification to the Standard is recognised around the world and the number of certifications has grown by more than 450% in the past ten years.
Implementing ISO 27001 helps you meet the information security requirements of laws such as the EU GDPR (General Data Protection Regulation) and the NIS (Network and Information Systems) Regulations. This helps reduce the costs associated with data breaches.
Protect your data, wherever it lives
Protect all forms of information, whether digital, hard copy or in the Cloud.
Increase your attack resilience
Increase your organisation’s resilience to cyber attacks.
Reduce information security costs
Implement only the security controls you really need, helping you get the most from your budget.
Respond to evolving security threats
Constantly adapt to changes both in the environment and inside the organisation.
Improve company culture
An ISMS encompasses people, processes and technology, ensuring staff understand risks and embrace security as part of their everyday working practices.
Meet contractual obligations
Certification demonstrates your organisation’s commitment to information security and provides a valuable credential when tendering for new business.
Learn more about the benefits of ISO 27001 certification
Demonstrating GDPR compliance with ISO 27001 and ISO 27701
ISO/IEC 27701:2019 (ISO 27701) is an extension to ISO 27001, which expands its requirements to cover privacy management – including the processing of personal data/PII (personally identifiable information).
Implementing an integrated ISMS and PIMS ( privacy information management system) that incorporates both ISO 27701 and ISO 27001 will enable you to meet the GDPR’s requirements for managing, processing and protecting personal data in line with best practice.
Learn more about ISO 27701
How to achieve ISO 27001 compliance
Implementing an ISO 27001-compliant ISMS involves:
- Scoping the project;
- Securing management commitment and budget;
- Identifying interested parties, and legal, regulatory and contractual requirements;
- Conducting a risk assessment;
- Reviewing and implementing the required controls;
- Developing internal competence to manage the project;
- Developing the appropriate documentation;
- Conducting staff awareness training;
- Reporting (e.g. the Statement of Applicability and risk treatment plan);
- Continually measuring, monitoring, reviewing and auditing the ISMS; and
- Implementing the necessary corrective and preventive actions.
Discover our ISO 27001 implementation checklist and our nine-step approach to implementing an ISMS
Ready to simplify your security? Let’s get started
Having led the world’s first ISO 27001 certification project, we are the global pioneer of the Standard. Let us share our expertise and support you on your journey to ISO 27001 compliance.