ISO 27001
The international standard for information security management systems, used to certify that an organization manages security risks in a structured, audited way.
In short
- It certifies the management system, not a product: how risks are identified, treated and reviewed.
- Certification is issued by an accredited body after an external audit, with surveillance audits each year.
- It is often compared with SOC 2, which is a report rather than a certificate.
ISO/IEC 27001 is an international standard that sets out the requirements for an information security management system, or ISMS. The current version was published in 2022. An organization that meets it can be certified by an accredited certification body.
What it requires
- Scope: define which parts of the organization, systems and locations the ISMS covers.
- Risk assessment: identify information security risks and decide how to treat each one.
- Controls: select appropriate controls, with Annex A listing 93 reference controls grouped into organizational, people, physical and technological themes.
- Statement of applicability: document which controls apply and why.
- Continual improvement: internal audits, management reviews and corrective actions.
The certification cycle
An initial certification audit is followed by surveillance audits in each of the next two years, and a recertification audit in the third year. The certificate states the scope. It is worth checking that the services you rely on are actually covered.
ISO 27001 and SOC 2
Both are used to show customers that a supplier takes security seriously. ISO 27001 results in a certificate recognized worldwide. SOC 2 results in a detailed audit report, more common in North America, that describes controls and how they performed. Many software companies hold both.
Worked example
Checking a supplier's certificate
A finance team evaluating a receipt processing provider asks for its ISO 27001 certificate. The certificate is current, issued by an accredited body, and its scope covers the production platform and support operations that will handle the team's data. The team files it with the supplier's risk assessment and notes the expiry date for renewal.