ISO/IEC 27001 is an international standard that specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS).

The standard provides a framework for systematically managing information security risks. The management system aims to preserve the confidentiality, integrity and availability of information by applying a risk management process and to give confidence to interested parties that risks are adequately managed.

ISO/IEC 27001 is not limited to information technology and technical security measures. The management system integrates information security into the organization’s processes and overall management structure and ensures that information security is considered in the design of processes, information systems and controls.
 

Current edition of ISO/IEC 27001

ISO/IEC 27001:2022 is the third edition of the International Standard. It replaces ISO/IEC 27001:2013 and incorporates the Technical Corrigenda issued in 2014 and 2015. The main change compared with the previous edition is the alignment of the standard with the harmonized structure for management system standards and with ISO/IEC 27002:2022.
 

Who is ISO/IEC 27001 applicable to?

ISO/IEC 27001 is applicable to organizations of all types and sizes, regardless of the nature of their activities.

The standard can be applied by IT companies and software developers, as well as financial institutions, public-sector organizations, manufacturing companies, service providers, consulting organizations and other organizations that create, process, store or exchange information.

The management system is established taking into account the organization’s specific context, needs, objectives, risks, processes, size and structure.

 

What ISO/IEC 27001 provides

An information security management system based on ISO/IEC 27001 provides a structured framework through which an organization can:

• identify and assess information security risks;
• determine and implement appropriate risk treatment options and the necessary controls;
• manage access to information and other associated assets;
• define roles and responsibilities for information security;
• manage risks associated with suppliers, ICT supply chains and cloud services;
• plan for and manage information security incidents;
• maintain information security at an appropriate level during disruption;
• address applicable legal, statutory, regulatory and contractual requirements;
• monitor, measure, analyse and evaluate the performance of the system;
• continually improve the management of information security.

 

Risk management under ISO/IEC 27001

Risk management is a fundamental element of ISO/IEC 27001. The organization is required to define and apply an information security risk assessment process that enables risks to be identified, analysed and evaluated in a consistent manner.

The risk assessment considers the potential loss of confidentiality, integrity and availability of information within the scope of the management system.

Based on the results of the assessment, the organization determines appropriate risk treatment options and the necessary controls. An information security risk treatment plan is developed, and risk owners are required to approve the plan and accept the residual information security risks.
 

Key requirements of ISO/IEC 27001

The requirements for the information security management system are structured in Clauses 4–10:

4. Context of the organization

Determining the relevant external and internal issues, the needs and expectations of interested parties, and the scope of the information security management system.

5. Leadership

Top management commitment, information security policy, and the assignment of organizational roles, responsibilities and authorities.

6. Planning

Actions to address risks and opportunities, information security risk assessment and treatment, information security objectives and planning to achieve them, and planning of changes.

7. Support

Providing the necessary resources, competence, awareness and communication, and managing documented information.

8. Operation

Planning and controlling processes, performing information security risk assessments, and implementing the information security risk treatment plan.

9. Performance evaluation

Monitoring, measurement, analysis and evaluation, internal audits, and management review.

10. Improvement

Continual improvement, management of nonconformities, and corrective actions.

Annex A – Information security controls

Annex A of ISO/IEC 27001 contains a list of information security controls aligned with the controls in ISO/IEC 27002:2022. They are used in the context of the information security risk treatment process.

The controls are organized into four groups:

• organizational controls;
• people controls;
• physical controls;
• technological controls.

They cover areas such as information security policies, asset and access management, supplier relationships, use of cloud services, incident management, business continuity, privacy and protection of personally identifiable information (PII), physical security, management of technical vulnerabilities, protection against malware, information backup, logging and monitoring, network security, cryptography and secure development.

The controls in Annex A are not intended to be applied automatically by every organization. The organization determines the necessary controls based on the results of the risk assessment and risk treatment process and compares them with Annex A to verify that no necessary controls have been omitted. Additional controls may also be included where necessary.

Statement of Applicability

An important element of the management system is the Statement of Applicability (SoA).

It specifies:

• the necessary controls;
• justification for their inclusion;
• whether the necessary controls are implemented;
• justification for excluding any of the Annex A controls.

The Statement of Applicability shows which controls are necessary for the organization, whether they have been implemented, and the justification for their inclusion or exclusion.
 

ISO/IEC 27001 implementation

CONSEJO provides consulting services for the development and implementation of information security management systems in accordance with ISO/IEC 27001 — from the initial gap analysis and identification of the necessary actions through to preparation for the certification audit.

 

ISO/IEC 27001:2022 Information Security, Cybersecurity and Privacy Protection – Information Security Management Systems – Requirements