Skip to main content
Governance Authority
Category: Privacy and Cybersecurity

ISO/IEC 27001

Also known as: ISO 27001, ISO/IEC 27001:2022, ISO/IEC 27001:2013
Simply put

ISO/IEC 27001 is an international standard that sets out requirements for an information security management system (ISMS), an organized approach to protecting information. It helps organizations establish, implement, and continually improve the way they manage information security. It is a voluntary standard, though organizations may adopt it to demonstrate their security practices, and it is not a law or regulation in itself.

Formal definition

ISO/IEC 27001 is a jointly published international standard (by ISO and IEC) that formally specifies requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS). It is described as the best-known standard for ISMS and defines the requirements such a system must meet. As a certifiable standard, conformance is voluntary and typically assessed against the requirements of the applicable version (for example, the 2013 or 2022 editions); adoption and certification do not constitute a legal mandate unless a requirement is imposed by contract, sector rules, or applicable law in a given jurisdiction. This entry is educational and not legal, audit, or compliance advice.

Why it matters

Information security has become a central concern for boards, compliance functions, and assurance providers, yet security practices vary widely across organizations. ISO/IEC 27001 matters because it provides a recognized, structured framework for managing information security through an information security management system (ISMS) rather than relying on ad hoc or purely technical controls. As the world's best-known standard for ISMS, it offers a common reference point that organizations, customers, and business partners can understand and, where certification is pursued, can assess against an external benchmark.

Because ISO/IEC 27001 is a voluntary standard rather than a law, its significance often depends on context. Organizations may adopt it to demonstrate the maturity of their security practices, and a requirement to hold certification can arise through contracts, sector rules, or applicable law in a given jurisdiction rather than from the standard itself. This distinction is important for compliance and legal functions: conformance to ISO/IEC 27001 is not, in itself, evidence of meeting any particular statutory obligation, and the standard's relevance should be assessed against the specific regulatory and contractual environment in which an entity operates.

For governance purposes, the framework's emphasis on establishing, implementing, maintaining, and continually improving an ISMS supports the idea that information security is an ongoing management responsibility rather than a one-time project. This entry is educational and not legal, audit, or compliance advice; whether and how to adopt the standard depends on an organization's facts, risk profile, and the requirements applicable to it.

Who it's relevant to

Chief Information Security Officers and IT Security Teams
Those responsible for operating an organization's information security typically use ISO/IEC 27001 as a reference for structuring an ISMS and demonstrating a systematic, continually improving approach. They own the design and operation of the security management activities the standard describes, subject to the organization's chosen scope.
Chief Compliance and Risk Officers
Compliance and risk functions may assess whether ISO/IEC 27001 certification is required by contract, sector rules, or applicable law, and how conformance interacts with other obligations. Because the standard is voluntary in itself, these functions are generally well placed to distinguish what the standard provides from what a legal or contractual requirement actually mandates in a given jurisdiction.
Internal and External Assurance Providers
Internal auditors and other assurance functions may evaluate whether an ISMS is established and maintained in line with the standard's requirements, while external assessors may conduct certification against the applicable version. Assurance work typically focuses on whether the management system meets the specified requirements rather than on giving legal advice.
Boards and Audit or Risk Committees
Board members and relevant committees generally exercise oversight of how management addresses information security risk. ISO/IEC 27001 can serve as one reference point for understanding whether management has adopted a recognized, structured approach, while the operational responsibility for implementing and maintaining the ISMS rests with management, not the board.
General Counsel and Procurement Functions
Legal and procurement teams may encounter ISO/IEC 27001 in contractual terms, where certification is sometimes required of suppliers or vendors. Understanding that the standard is voluntary unless imposed by such arrangements helps these functions negotiate and interpret obligations accurately, based on the facts and jurisdiction involved.

Inside ISO/IEC 27001

Information Security Management System (ISMS)
The central concept of ISO 27001 is the establishment, implementation, maintenance, and continual improvement of an ISMS: a documented, risk-based framework of policies, processes, and controls for managing information security. The standard specifies requirements for the ISMS itself rather than prescribing a fixed technical configuration.
Context, leadership, and scope
The standard generally requires the organization to define the scope of its ISMS, identify interested parties and their requirements, and secure top management leadership and commitment, including an information security policy. Accountability for the ISMS typically sits with senior management, distinct from the day-to-day operational activities performed by security or IT teams.
Risk assessment and risk treatment
ISO 27001 requires a defined process to assess information security risks and to select treatment options. This includes producing a Statement of Applicability that documents which controls apply and the justification for inclusion or exclusion, and a risk treatment plan. The approach is risk-based rather than a mandatory checklist.
Annex A control set
The standard references a catalogue of information security controls (Annex A) spanning organizational, people, physical, and technological measures. Under the standard's design, not every listed control is mandatory; applicability is determined by the organization's risk assessment and documented in the Statement of Applicability.
Performance evaluation and improvement
ISO 27001 generally requires monitoring, measurement, internal audit, and management review of the ISMS, together with handling of nonconformities and corrective action. This reflects a Plan-Do-Check-Act style of continual improvement.
Certification versus conformance
Organizations may pursue certification to ISO 27001 through an accredited third-party certification body, or may align with the standard without seeking certification. Certification is voluntary; ISO 27001 is a standard, not law, though contracts, sectors, or regulators may reference or expect it.

Common questions

Answers to the questions practitioners most commonly ask about ISO/IEC 27001.

Does ISO 27001 certification mean an organization's data is secure and breach-proof?
No. ISO 27001 certification indicates that an organization has established, documented, and operates an information security management system (ISMS) that a third-party auditor has assessed as conforming to the standard's requirements at a point in time. Certification speaks to the presence and conformance of a management system, not to a guarantee that no security incident will occur. The standard emphasizes a risk-based, continual-improvement approach rather than a fixed security outcome, and effectiveness depends on how the controls are designed and whether they operate as intended over time. Organizations should treat certification as evidence of a governed process, not as an assurance of an unbreachable environment.
Is ISO 27001 a legal requirement that all organizations must comply with?
Generally, no. ISO 27001 is a voluntary international standard rather than binding law. An organization may pursue certification for commercial, contractual, or assurance reasons, or a customer, sector body, or regulator may make it a condition of doing business in certain contexts. That contractual or sectoral expectation is distinct from a statutory obligation. Whether any legal requirement applies to information security depends on the applicable jurisdiction, sector, and the nature of the data and activities involved, and those requirements are separate from the standard itself. This entry is educational and not legal or compliance advice; organizations should assess their own obligations with qualified advisers.
Who within the organization should own and be accountable for the ISMS?
Accountability for the ISMS typically rests with senior management, and the standard generally emphasizes demonstrable leadership commitment, including the setting of an information security policy and objectives and the provision of resources. Day-to-day operation is usually delegated to a designated function or role, such as an information security manager or team, while assurance activities such as internal audit are typically kept independent of the functions that operate the controls. The board or its relevant committee often retains an oversight role rather than an operational one. The precise allocation depends on the entity's size, structure, and governance arrangements, and should be defined clearly to avoid conflating operational ownership with independent assurance.
How does the risk assessment process fit into implementing ISO 27001?
Risk assessment is generally central to the standard's approach. Organizations typically identify information security risks, analyze them, and evaluate them against defined criteria before selecting how to treat them. Control selection is usually driven by the results of that assessment rather than by adopting every possible control. When distinguishing risk concepts, it is useful to separate the risk before controls are applied from the risk that remains after treatment, and to keep likelihood distinct from impact when analyzing each risk. Management typically determines the criteria used to evaluate and accept risk within parameters it has established. The specific methodology is left to the organization, so approaches vary in practice.
What is the role of the Statement of Applicability in an ISO 27001 implementation?
The Statement of Applicability is generally a key document in which an organization records which controls it has determined are applicable, the justification for their inclusion, whether they are implemented, and the justification for excluding any controls it considers not applicable. It typically connects the outcomes of the risk assessment and risk treatment decisions to the set of controls the organization maintains. Because it makes the rationale for control choices explicit, it is often a focal point during certification audits. The exact content and how exclusions are justified depend on the organization's own risk decisions and documented approach.
How is the difference between control design and operating effectiveness relevant when preparing for certification?
It is a meaningful distinction. A control may be well designed on paper yet fail to operate as intended in practice, so preparation generally involves confirming both that controls are appropriately designed to address identified risks and that there is evidence they operate consistently over a relevant period. Internal audits and management reviews are commonly used to test operating effectiveness and to surface gaps before an external assessment. Distinguishing these two dimensions helps organizations avoid treating documented procedures as equivalent to demonstrated performance. The evidence needed and the period assessed can vary by control and by the auditor's approach; this entry is educational and not audit advice.

Common misconceptions

ISO 27001 certification is legally required and proves an organization cannot be breached.
ISO 27001 is a voluntary international standard, not binding law, although contracts, customers, or specific regulatory regimes may expect or reference it. Certification indicates that a management system met the standard's requirements at the time of assessment; it does not guarantee security or prevent breaches, and it does not by itself satisfy jurisdiction-specific legal obligations.
ISO 27001 requires implementing every control in Annex A.
The standard is risk-based. The organization determines applicable controls through its risk assessment and documents inclusions and exclusions in the Statement of Applicability. Annex A functions as a reference catalogue, not a mandatory checklist to be implemented in full.
ISO 27001 is purely an IT or technical exercise owned by the security team.
ISO 27001 defines a management system requiring top management leadership, defined governance, and accountability. It covers organizational, people, and physical measures in addition to technology. Operational implementation may sit with IT or security functions, but oversight and accountability for the ISMS typically rest with senior management.

Best practices

Define the ISMS scope explicitly and align it to the organization's context, interested parties, and information assets before selecting controls.
Drive control selection from a documented risk assessment and maintain a Statement of Applicability that justifies each included or excluded control.
Secure and evidence top management commitment, clarifying where accountability for the ISMS sits versus who performs day-to-day operational security activities.
Distinguish control design from operating effectiveness, and use internal audit, monitoring, and management review to confirm controls work in practice over time.
Treat certification as a point-in-time assessment: sustain the ISMS through continual improvement, nonconformity handling, and corrective action rather than a one-off project.
Confirm any legal, contractual, or sector-specific obligations separately, since ISO 27001 alignment does not by itself satisfy jurisdiction-specific requirements; consult qualified advisors where facts and jurisdiction are decisive.