products:ict:iso

ISO/IEC 27001 is widely known, providing requirements for an information security management system (ISMS), though there are more than a dozen standards in the ISO/IEC 27000 family. Using them enables organizations of any kind to manage the security of assets such as financial information, intellectual property, employee details or information entrusted by third parties.

ISO 27001: The International Information Security Standard

ISO 27001 definition: What is ISO 27001?

ISO/IEC 27001:2013 (also known as ISO 27001) is the international standard for information security. It sets out the specification for an information security management system (ISMS).

ISO 27001’s best-practice approach helps organisations manage their information security by addressing people, processes and technology.

Certification to the ISO 27001 Standard is recognised worldwide to indicate that your ISMS is aligned with information security best practices.

Part of the ISO 27000 series of information security standards, ISO 27001 is a framework that helps organisations “establish, implement, operate, monitor, review, maintain and continually improve an ISMS”.

ISO/IEC 27001:2013 controls

The Standard doesn’t mandate that all 114 Annex A controls be implemented. A risk assessment should determine which controls are required and explain why other controls are excluded from the ISMS.

Below is the list of control sets.

  A.5 Information security policies
  A.6 Organisation of information security
  A.7 Human resource security
  A.8 Asset management
  A.9 Access control
  A.10 Cryptography
  A.11 Physical and environmental security
  A.12 Operations security
  A.13 Communications security
  A.14 System acquisition, development and maintenance
  A.15 Supplier relationships
  A.16 Information security incident management
  A.17 Information security aspects of business continuity management
  A.18 Compliance

How to achieve ISO 27001 compliance

Implementing an ISMS involves:

Scoping the project.

Securing management commitment and budget.

Identifying interested parties and legal, regulatory and contractual requirements.

Conducting a risk assessment.

Reviewing and implementing the required controls.

Developing internal competence to manage the project.

Developing the appropriate documentation.

Conducting staff awareness training.

Reporting (e.g. the Statement of Applicability and risk treatment plan).

Continually measuring, monitoring, reviewing and auditing the ISMS.

Implementing the necessary corrective and preventive actions.