What is ISO/IEC 27001 Standard in IT?

Definition of the ISO/IEC 27001 standard

ISO/IEC 27001 is an international standard that sets out the requirements for establishing, implementing, maintaining and continually improving an Information Security Management System (ISMS) within an organisation. It is the world’s best-known and most widely used standard for information security management in all its aspects – confidentiality, integrity and availability.

Goal and scope of the standard

The main goal of ISO/IEC 27001 is to help organisations protect their valuable information assets by implementing a systematic approach to managing information security risks. The standard applies to organisations of any size and in any industry that process information in digital or physical form. The scope of the ISMS may cover the entire organisation or selected parts of it (e.g. a specific department, IT system or location).

Structure and key elements of an ISMS

ISO/IEC 27001 is based on the Deming cycle (PDCA – Plan-Do-Check-Act) and requires the organisation to provide:

Understanding of the organisation’s context: Identifying the internal and external factors that affect information security and determining the needs and expectations of interested parties.

Leadership and management commitment: Demonstrating top management’s commitment to establishing and maintaining the ISMS.

Planning: Carrying out an information security risk assessment, identifying and evaluating threats and vulnerabilities, and then drawing up a risk treatment plan, including the selection of appropriate safeguards (controls).

Support: Providing the resources, competences, awareness, communication and documented information needed for the ISMS to function.

Operation: Implementing the planned actions and safeguards in order to manage risk.

Performance evaluation: Monitoring, measuring, analysing and evaluating the effectiveness of the ISMS, and conducting regular internal audits and management reviews.

Improvement: Continually improving the ISMS by taking corrective action in response to nonconformities and assessment results.

Annex A – Catalogue of controls

An integral part of the standard is Annex A, a catalogue of reference safeguards (controls). In the current 2022 edition it lists 93 controls grouped into four themes: organisational, people, physical and technological. They cover areas such as security policies, access control, cryptography, asset management, physical security, secure operations, incident management, business continuity and compliance with legal requirements (the previous 2013 edition had 114 controls in 14 domains). The organisation selects and implements the controls that are appropriate to the risks it has identified.

ISO/IEC 27001 certification

Organisations can have their Information Security Management System audited by an independent certification body. Obtaining ISO/IEC 27001 certification is formal confirmation that the organisation’s information security management system meets the requirements of the standard. The certificate is an important signal to clients, partners and regulators, demonstrating the organisation’s maturity in protecting information and building trust.

Benefits of implementing ISO/IEC 27001

Implementing an ISMS that complies with ISO/IEC 27001 brings many benefits, including better protection of confidential information, a lower risk of security incidents and the losses associated with them, compliance with legal and regulatory requirements (e.g. GDPR), greater trust among clients and business partners, an improved company reputation and more efficient security management processes. For IT companies such as Ardura, holding the certificate can be a significant competitive advantage.