What is it?

ISO/IEC 27001 is an international standard for Information Security Management Systems. ISO/IEC 27001 certification is recognised worldwide.

The ISO/IEC 27001 standard provides guidance to help organisations establish, implement, maintain and continually improve an Information Security Management System. The purpose of the ISMS is to safeguard the confidentiality, integrity and availability of information. Its scope covers people, processes and technologies. The ISO/IEC 27001 Information Security Management System helps to identify risks associated with information security breaches. It helps to reduce the likelihood of such breaches occurring. The application of ISO/IEC 27001 enables a faster response and limits potential negative consequences should adverse events occur. An organisation that applies the requirements of ISO/IEC 27001 is able to operate more effectively and efficiently. Holding ISO/IEC 27001 certification increases business benefits. Organisations operating in accordance with the requirements of the Information Security Management System are more credible, which translates into increased competitiveness.

Structure

The structure of the ISO/IEC 27001 standard is aligned with the requirements of the Annex SL framework. The ISO/IEC 27001 system is compatible with other management systems, such as ISO 14001:2015, which makes the integration of management systems more efficient.

The ISO/IEC 27001 standard is divided into 10 main sections. The first three describe the standard, while sections 4 to 10 contain requirements related to information security management. The structure of the ISO/IEC 27001 standard is as follows:

1. Scope

2. Normative references

3. Terms and definitions

4. Context of the organization

• Understanding the organisation and its context        
• Understanding the needs and expectations of interested parties 
• Determining the scope of the information security management system
• Information security management system

5. Leadership

• Leadership and commitment      
• Policy
• Roles, responsibilities and authorities

6. Planning

• Activities relating to risks and opportunities
• Information security objectives and planning to achieve objectives

7. Support

• Resources                           
• Competence               
• Awareness                 
• Communication         
• Documented information  

8. Operational activities

• Planning and oversight of operational activities
• Information security risk assessment
• Information security risk management

9. Performance evaluation

• Monitoring, measurement, analysis and evaluation
• Internal audit          
• Management review

10. Improvement

• Non-conformities and corrective actions
• Continuous improvement

Who is it for?

The ISO/IEC 27001 standard is designed for any organisation, regardless of its size or sector, with a particular focus on organisations where data protection is of critical importance (e.g. IT companies, financial institutions, healthcare providers).

Benefits

• Protection of customer and employee data
• Acquiring new customers
• Enhancing the company’s reputation
• Effective management of risks associated with data breaches
• Compliance with GDPR requirements
• Reduced risk of financial penalties and losses resulting from data breaches