What is ISO/IEC 27001?
ISO/IEC 27001 sets out the requirements that an information security management system must meet — the policies, processes, responsibilities and controls through which an organization manages the risks to its data.
Conformity with the standard means that the organization has put in place a system for managing the risks to the security of the data it holds or processes, and that this system follows the principles and good practice set out in the standard. The current edition is ISO/IEC 27001:2022. For what has changed since the 2013 version, see the article ISO/IEC 27001:2013 has a new version — ISO/IEC 27001:2022.
The standard applies to organizations of any size and in any sector — from IT companies and cloud service providers to manufacturers, traders, financial institutions and public organizations.
What does an information security management system protect?
The system protects three core properties of information — confidentiality, integrity and availability.
- ConfidentialityInformation is accessible only to the persons and processes that are authorized to access it.
- IntegrityInformation is accurate and complete and is not altered without authorization.
- AvailabilityInformation and systems are accessible whenever authorized users need them.
- All informationProtection covers data in electronic form, on paper and in cloud services, as well as people’s knowledge.
How does risk assessment work?
Risk assessment is the core of ISO/IEC 27001: the organization identifies what could threaten its information, assesses the likelihood and consequences, and decides how to treat each risk.
- 1Scope and context
You define which activities, sites, systems and information fall within the system.
- 2Risk identification
You identify the threats to and vulnerabilities of the information within the scope.
- 3Analysis and evaluation
You assess the likelihood and impact and determine which risks require action.
- 4Risk treatment
You select controls with which to reduce, avoid, transfer or accept the risk.
- 5Statement of Applicability
You document which Annex A controls you apply and why you exclude the others.
The core of the standard follows the common structure of ISO management system standards — context, leadership, planning, support, operation, performance evaluation and improvement. This is why ISO/IEC 27001 integrates easily with ISO 9001 and ISO/IEC 20000-1.
What does Annex A of the 2022 version contain?
Annex A of ISO/IEC 27001:2022 contains 93 controls grouped into four themes.
| Topic | Number of controls | Examples |
|---|---|---|
| Organizational | 37 | policies, roles, asset management, suppliers, cloud services, incidents |
| People | 8 | pre-employment screening, awareness and training, remote working |
| Physical | 14 | physical security perimeter, control of access to premises, equipment protection |
| Technological | 34 | access control, cryptography, backups, monitoring, secure coding |
Not every control is mandatory. The organization applies the controls that match its risks and justifies any exclusions in the Statement of Applicability.
What does the price of certification depend on?
The price of ISO/IEC 27001 certification depends primarily on the number of the organization’s locations and the number of controls the system manages.
It is usually higher than for other ISO standards, because ISO/IEC 27001 is more demanding and covers many more aspects of information security. Security requirements are also rising with the NIS 2 Directive — see the article NIS 2 and its link to ISO/IEC 27001. For the general factors that determine the price, see How much does ISO certification cost?
- the number of locations within the scope;
- the number of controls the system manages;
- the number of employees whose work falls within the scope;
- the complexity of the information systems and activities.
The audit takes place in two stages — a review of the documentation and readiness, followed by an on-site check of the implementation. The certificate is valid for 3 years, with surveillance audits in the second and third years. Certificates are issued by CERTIND S.A., accredited by RENAR for ISO/IEC 27001.
Questions about ISO/IEC 27001
Who is ISO/IEC 27001 suitable for?
Any organization that handles valuable or sensitive information — regardless of its size and sector. The organizations most often certified are IT companies, service providers, and financial and public organizations.
Are all 93 Annex A controls mandatory?
No. The organization selects the controls on the basis of its risk assessment and justifies any exclusions in the Statement of Applicability.
Why does ISO/IEC 27001 certification cost more than other ISO standards?
The standard is more demanding and covers many more aspects of security. The price depends mainly on the number of locations and the number of controls the system manages.
How long is the certificate valid?
The certificate is valid for 3 years. Surveillance audits take place in the second and third years, followed by a recertification audit before it expires.