ISO/IEC 27001 explained | DSQA Consultants

What ISO/IEC 27001 is

ISO/IEC 27001 sets out what an information security management system (ISMS) needs so that an organisation can manage risks to the confidentiality, integrity and availability of its information in a structured, risk-based way. It applies to any organisation that holds information worth protecting.

Edition status

The 2022 edition replaced ISO/IEC 27001:2013. Its Annex A lists 93 controls grouped into four themes: organisational, people, physical and technological.
The 2024 amendment asks organisations to consider whether climate change is a relevant issue when they look at their context and interested parties.
ISO publishes this standard jointly with the IEC, which is why its full name is ISO/IEC 27001.

Clause-by-clause summary

Like other ISO management system standards, ISO/IEC 27001 follows the Harmonized Structure. Clauses 1 to 3 cover scope, references and terms. The requirements are in clauses 4 to 10, summarised below in our own words.

4 Context of the organization

Understand the issues that affect your information security, identify interested parties and their requirements, and set a clear scope for the ISMS, including its boundaries and interfaces.

5 Leadership

Top management leads the ISMS. It sets an information security policy, makes sure security fits the organisation's processes and assigns clear roles and responsibilities.

6 Planning

Define how you assess and treat information security risks, compare your chosen controls with Annex A in a Statement of Applicability, set security objectives and plan changes to the ISMS.

7 Support

Provide the resources the ISMS needs, make sure people are competent and aware of their part, plan communication and control your documented information.

8 Operation

Run the processes you planned, carry out risk assessments at planned intervals or when things change significantly, and put your risk treatment plan into action.

9 Performance evaluation

Monitor and measure how well information security is working, run internal audits to a programme and hold management reviews.

10 Improvement

Keep improving the ISMS, and when something goes wrong, fix it, find the cause and stop it happening again.

Documented information you'll usually need

The standard expects you to keep certain information documented (maintained) or as records (retained). This is our summary of what's commonly expected. Check it against your own copy of the standard, and add anything else your organisation needs to run the system well.

Scope of the ISMS
Information security policy
Information security risk assessment process
Information security risk treatment process
Statement of Applicability
Information security objectives
Evidence of competence
Documented information the organisation decides it needs for the ISMS
Information to show processes ran as planned
Results of information security risk assessments
Results of information security risk treatment
Results of monitoring and measurement
Internal audit programme and audit results
Results of management reviews
Nonconformities, corrective actions and their results

How certification works

Certification is optional. If you want it, an independent certification body audits your management system and decides whether to issue a certificate. In the UK, check that the certification body holds UKAS accreditation for ISO/IEC 27001.

DSQA Consultants isn't a certification body and doesn't issue certificates. Our toolkits and virtual support help you prepare for certification.

ISO/IEC 27001:2022 explained