What is ISO 27001, in short?
ISO 27001 sets out what a functioning information security management system (ISMS) must do. Understand what information matters, decide how it could be harmed, put proportionate controls in place, check they work, and improve them.
Certification means an independent, accredited auditor has examined your system and confirmed it meets the standard. Customers ask for the certificate because it answers a hundred security questions in a form their procurement teams already trust.
What is an ISMS?
An ISMS is a management system, in the same family as the quality system behind ISO 9001. In practice it consists of a defined scope, a policy approved by leadership, and a repeatable way of assessing risk.
It also needs a record of which controls you operate and why, with named owners for risks and controls. Add evidence that controls run day to day, an internal audit programme, a management review, and a way of fixing what those checks find.
The standard leaves product choices to you. It governs how security decisions are made, owned and evidenced.
Who needs ISO 27001, and why?
Most organisations pursue certification for a commercial reason. A major customer requires it, a tender scores it, an investor or insurer asks for it, or a board wants credible assurance as the business grows.
It is most common where you hold other people's data or provide services they depend on: software, IT services, professional services, financial services and suppliers into regulated industries.
The trigger matters more than the sector. If nobody is asking and your risks are modest, the UK government's Cyber Essentials scheme may be the proportionate first step instead.
What does ISO 27001 require?
The main body of the standard, clauses 4 to 10, is mandatory in full:
| Clause | What it asks for |
|---|---|
| 4 · Context | Your organisation's issues, interested parties and a defined ISMS scope |
| 5 · Leadership | Visible commitment from top management, a policy, assigned roles |
| 6 · Planning | Risk assessment and treatment, a Statement of Applicability, security objectives |
| 7 · Support | Resources, competence, awareness, communication and controlled documents |
| 8 · Operation | Running the risk process and controls you planned, day to day |
| 9 · Evaluation | Monitoring, internal audit and management review |
| 10 · Improvement | Handling nonconformities, corrective action and continual improvement |
Annex A then provides 93 reference controls in four themes: organisational (37), people (8), physical (14) and technological (34). You compare your arrangements against them during risk treatment and record the outcome in your Statement of Applicability.
My ISO 27001 checklist works through the requirements in order. The glossary defines the terms you will meet.
How does ISO 27001 certification work?
Once the system has been operating long enough to generate evidence, an independent certification body audits it in two stages. Stage 1 reviews your documentation and readiness, and Stage 2 tests whether the system operates in practice, interviewing the people who own controls.
The certificate lasts three years, with surveillance audits in between.
My guides to Stage 1 and Stage 2 audits and to surveillance audits explain each visit. Timescales and budgets sit in my guides to how long ISO 27001 takes and what ISO 27001 costs in the UK.
What do people get wrong about ISO 27001?
- A technical checklist or a set of products to buy will not meet it. The standard governs how you manage security.
- Incidents can still happen. The certificate evidences that you manage the risk systematically.
- Only an independent certification body can award it. Consultants, toolkits and training providers cannot.
- It runs continuously, year after year. A certificate you stop maintaining will not survive surveillance.