ISO 27001

ISO 27001 is the gold standard for information security. Certification demonstrates to customers, regulators, and partners that your organization takes security seriously. It's increasingly required in procurement processes, regulatory frameworks (NIS2 references it), and contractual obligations. Advisera reports that over 70,000 organizations worldwide are certified.

ISO 27001 follows a Plan-Do-Check-Act (PDCA) cycle:

1. Plan — establish the ISMS, assess risks, define controls
2. Do — implement the controls and processes
3. Check — monitor, measure, and audit performance
4. Act — improve based on findings, correct non-conformities

• Context of the organization — understand internal/external issues and interested parties
• Leadership — top management commitment, information security policy
• Planning — risk assessment and risk treatment methodology
• Support — resources, competence, awareness, documentation
• Operation — implement risk treatment plan and security controls
• Performance evaluation — monitoring, internal audit, management review
• Improvement — non-conformity management, continual improvement

ISO 27001:2022 includes 93 controls organized into four themes:

Theme	Controls	Examples
Organizational	37	Policies, roles, asset management, supplier security
People	8	Screening, training, disciplinary process, remote work
Physical	14	Perimeters, entry controls, equipment security, clean desk
Technological	34	Access rights, encryption, logging, malware protection, backups

Organizations select applicable controls based on their risk assessment — not all 93 are mandatory, but exclusions must be justified.

1. Gap analysis — assess current state against ISO 27001 requirements
2. Implementation — build the ISMS, implement controls, train staff
3. Internal audit — verify the system works before certification
4. Stage 1 audit — certification body reviews documentation
5. Stage 2 audit — on-site assessment of implementation effectiveness
6. Certification — 3-year certificate with annual surveillance audits
7. Recertification — full audit every 3 years

• NIS2 — references ISO 27001 as a way to demonstrate compliance with security requirements
• GDPR Article 32 — ISO 27001 helps demonstrate "appropriate technical and organizational measures"
• SOC 2 — significant overlap; many organizations pursue both
• NIST CSF — complementary; NIST for strategy, ISO 27001 for certifiable management system

• ISO/IEC 27001:2022 — current version (replaced 2013 edition)
• ISO/IEC 27002:2022 — detailed guidance on implementing Annex A controls
• ISO/IEC 27005 — information security risk management