27001

ISO/IEC 27001, commonly shortened to 27001, is an international standard for information security management systems (ISMS). It specifies the requirements for establishing, implementing, maintaining, and continually improving an ISMS to protect information assets from unauthorized access, disclosure, alteration, and destruction.

The standard is risk-based; organizations must determine the scope and context, identify stakeholders, perform risk assessment, select risk treatment options, and maintain a statement of applicability. It uses the Plan-Do-Check-Act cycle and requires top management to demonstrate leadership and continual improvement of the ISMS.

As part of the ISO/IEC 27000 family, 27001 interacts with other standards, notably ISO/IEC 27002 (code of practice for information security controls) and ISO/IEC 27005 (risk management). The 2022 revision, ISO/IEC 27001:2022, consolidates controls into Annex A with 93 controls.

Certification: It is voluntary; many organizations pursue certification to demonstrate security posture to customers, regulators, and partners. Certification is issued by independent, accredited certification bodies after an audit of the organization's ISMS, and surveillance audits are conducted to maintain certification.