Definition
What is the ISO/IEC 27001 standard?
The ISO/IEC 27001 standard defines the requirements of an information security management system (ISMS). First published in 2005 and revised in 2022, it is the global benchmark for protecting data and information assets.
The standard is built on information security risk analysis, the definition of security objectives, and the implementation of 93 security controls (Annex A) covering organisational, people, physical, and technological aspects. It adopts the High Level Structure, making it compatible with ISO 9001 and ISO 14001.
The 2022 version deeply restructured Annex A: down from 114 to 93 controls, reorganised into 4 themes, and added explicit coverage of cloud security, threat intelligence, application security, and privacy. A transition period applies to organisations still certified under the 2013 version.
Who is ISO/IEC 27001 for?
The standard targets any organisation that handles sensitive information: software companies, hosting providers, SaaS vendors, banks, insurance, healthcare, telecoms, government agencies. It is increasingly required by enterprise customers and regulators (SOC 2 alignment, NIS 2 in Europe, US federal contracts).
Why get certified?
ISO 27001 certification helps to meet contractual requirements (RFPs, federal contracts), structure cybersecurity governance, reduce breach and ransomware risk, align with SOC 2, HIPAA, and NIS 2, and build trust with customers and partners.
Version
ISO/IEC 27001:2022
Avg. timeline
6 to 12 months
