DataTerminology.comNEW
Also known as: ISO 27001
International standard specifying requirements for establishing, implementing, maintaining, and continually improving an information security management system.
DESCRIPTION
ISO/IEC 27001 provides a risk-based framework for managing information security. Organizations define an ISMS scope, assess risks, and implement controls guided by Annex A. Certification demonstrates conformity via accredited audits. The standard promotes continual improvement through PDCA cycles, metrics, and internal audits. It aligns with related standards like ISO/IEC 27002 for control guidance. Adoption enhances governance, trust, and regulatory readiness.
ALTERNATIVE DEFINITIONS
Wikipedia
ISO/IEC 27001 is an international standard on how to manage information security.
Concise description of scope as information security management.
International Organization for Standardization (ISO)
ISO/IEC 27001 provides requirements for an information security management system (ISMS).
Official standard description emphasizing ISMS requirements.
RELATED TERMS
Information Security Management System Annex A Controls ISO/IEC 27002 Risk Assessment Business Continuity Access Control Data Encryption Audit
COMPETING TERMS
KNOWLEDGE AREAS
Data Security Data Governance Data Management Infrastructure
TARGET AUDIENCE
Chief Information Officer Chief Technology Officer Data Governance Manager Cloud Architect DevOps Engineer Data Management Consultant Chief Data Officer
EXTERNAL SOURCES
- Wikipedia - ISO/IEC 27001
- ISO - Official ISO/IEC 27001 page
- ISO - ISO/IEC 27002 controls guidance
- NIST - Comparable control catalog (NIST)
TOP QUESTIONS
What is an ISMS under ISO/IEC 27001?
An information security management system defines policies, processes, and controls to manage risks to information assets within a defined scope.
Category: Definition
How do organizations get certified to ISO/IEC 27001?
They implement an ISMS, conduct internal audits, and undergo an external audit by an accredited certification body.
Category: Compliance
What role does Annex A play in ISO/IEC 27001?
Annex A lists control objectives and controls; organizations select and justify applicable controls via the Statement of Applicability.
Category: Requirements
How does ISO/IEC 27001 compare to SOC 2?
ISO 27001 certifies a management system via international standard; SOC 2 reports on controls against AICPA criteria for a period.
Category: Comparison
What’s a common pitfall in ISO/IEC 27001 implementations?
Treating it as a paperwork exercise rather than a risk-driven, living system with metrics and improvements.
Category: Mistakes
How often are surveillance audits conducted?
Typically annually, with a recertification audit every three years, depending on certification body requirements.
Category: Compliance
How does ISO/IEC 27001 support privacy compliance?
It strengthens security controls, risk management, and governance that underpin privacy obligations and reduce breach risk.
Category: Relevancy
What is the PDCA cycle in ISO/IEC 27001?
Plan-Do-Check-Act is the continual improvement cycle used to maintain and enhance the ISMS.
Category: Definition
How should scope be defined for ISO/IEC 27001?
Include assets, processes, locations, and technologies relevant to objectives, avoiding arbitrary exclusions that hide risk.
Category: BestPractices