ISO 27001 standards can look intimidating, but the idea is simple: manage information security as a system, not as a set of tools. This plain-English guide explains what the standard covers, how it is laid out and what changed in the 2022 update.
What ISO 27001 Standards Cover
ISO/IEC 27001 is the international standard for an information security management system (ISMS). It tells you what a good management system must include. It does not tell you which products to buy. For a first overview, read what ISO 27001:2022 is.
How the Standard Is Structured
The main body has clauses covering the context of the organisation, leadership, planning, support, operation, performance evaluation and improvement. All of these are mandatory for certification.
Annex A is a reference list of security controls to consider. You choose the ones that fit your risks and record the decision.
What Changed in the 2022 Update
ISO 27001:2022 reorganised and reduced the Annex A controls into four themes and added new controls for areas such as threat intelligence, cloud services and data leakage prevention. Organisations certified to the 2013 version had to transition.
Related Standards
ISO 27001 pairs with other management system standards. Organisations often combine it with ISO 9001 for quality and ISO 22301 for business continuity so one management system covers all three.
Using the Standard in Practice
The standard is the framework, not the project. For a real plan, start with a ISO 27001:2022 gap assessment and talk to us about our ISO 27001 service.
In short, the ISO 27001 standards describe a management system you can prove. Reading the ISO 27001 standards alongside your own risks is what turns the text into a plan.
Frequently Asked Questions
What is the ISO 27001 standard?
It is the international standard that sets requirements for an information security management system.
What is Annex A?
It is a list of security controls to consider when treating risks. You select the controls that apply and record why.
What is the current version?
ISO/IEC 27001:2022.
Is ISO 27001 mandatory?
Not by law in most cases, but customers, tenders and frameworks such as RFFR often require or build on it.