What is ISO 27001?: ISO 27001 is the international standard for information security management. It sets out the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS). The standard helps organisations protect data, manage risk and demonstrate compliance to customers and regulators.
What is ISO 27001 certification?: ISO 27001 certification is the formal recognition that an independent auditor has verified your organisation’s ISMS meets the requirements of the standard. Certification shows clients, partners and regulators that you follow best practice for information security.
How do you get ISO 27001 certification?
To achieve ISO 27001 certification, an organisation must:
- Define the scope of its ISMS.
- Conduct a risk assessment and apply security controls.
- Document and implement policies, procedures and processes.
- Undergo an external audit from an accredited certification body.
Most businesses seek expert support, such as consultancy or toolkits, to streamline the process.
How many controls are in ISO 27001?: The 2022 version of ISO 27001 references 93 controls grouped into four themes: organisational, people, physical and technological. These controls are detailed in Annex A of the standard.
What is ISO 27001 compliance?: ISO 27001 compliance means your organisation has implemented the policies, procedures and controls required by the standard, but may not yet have external certification. Compliance shows alignment with best practice, while certification provides independent verification.
How long does ISO 27001 certification last?: An ISO 27001 certificate is valid for three years, subject to annual surveillance audits. After three years, a recertification audit is required to maintain certification.
Is ISO 27001 GDPR compliant?: ISO 27001 is not the same as GDPR compliance, but it supports it. The standard provides a structured framework for protecting personal data, helping organisations demonstrate that they have appropriate security measures in place to meet GDPR requirements.
What does ISO 27001 stand for?: ISO refers to the International Organization for Standardization, and 27001 is the number assigned to the standard covering information security management systems (ISMS).
