ISO/IEC 27001

ISO/IEC 27001
Information security, cybersecurity and privacy protection — Information security management systems — Requirements
Status	Active
First published	October 2005
Latest version	2022 (amended 2024)
Organization	ISO and IEC
Committee	ISO/IEC JTC 1/SC 27
Series	ISO/IEC 27000 family
Predecessor	BS 7799-2
Domain	Information security
Website	iso.org/standard/27001

ISO/IEC 27001, titled Information security, cybersecurity and privacy protection — Information security management systems — Requirements, is an information security standard. It specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of the organization, and includes requirements for the assessment and treatment of information security risks. The requirements are generic and are intended to be applicable to all organizations, regardless of type, size or nature. The requirements are set out in clauses 4 to 10, covering the context of the organization, leadership, planning, support, operation, performance evaluation and improvement; an annex to the standard lists a reference set of information security controls, for which ISO/IEC 27002 supplies the purpose and implementation guidance.

An organization may implement the standard for its own purposes, or have its ISMS certified as conforming to it by an independent certification body following successful completion of an audit. Certification is optional unless it is required by law, by a contract or by another scheme, and it applies only within the scope stated on the certificate. Certification bodies are commonly accredited by a national accreditation body, although accreditation is not compulsory. A systematic review of the academic literature published in 2021 found that few studies had examined the outcomes of certification empirically.

It was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in October 2005, with revised editions in 2013 and 2022. The 2022 edition was supplemented in February 2024 by ISO/IEC 27001:2022/Amd 1:2024, Climate action changes, which added one requirement, in the clause on the organization's context, that the organization determine whether climate change is a relevant issue, and one note, in the clause on interested parties, observing that interested parties can have requirements related to climate change.

Rationale

ISO/IEC 27001 specifies requirements for a management system rather than a list of security controls to be adopted. The standard describes the adoption of an information security management system (ISMS) as a strategic decision, and states that an organization's ISMS is influenced by its needs and objectives, its security requirements, the processes it uses, and its size and structure. The management system is intended to preserve the confidentiality, integrity and availability of information by applying a risk management process, and to give interested parties confidence that information security risks are adequately managed. The standard also states that it is important for the ISMS to be integrated with the organization's processes and overall management structure, and that its implementation is expected to be scaled according to the needs of the organization. The standard is concerned with information rather than with information technology alone: ISO describes it as a means of securing information in all forms, including paper-based, cloud-based and digital data, of preparing people, processes and technology to face technology-based and other threats, and of keeping assets such as financial statements, intellectual property, employee data and information entrusted to the organization by third parties undamaged, confidential and available as needed.

The standard requires an organization to:

• assess its information security risks systematically, taking account of the potential consequences and likelihood of loss of confidentiality, integrity and availability of information;
• select risk treatment options and determine the controls necessary to implement them, controls being one form of treatment alongside others such as avoiding a risk or sharing it with another party; and
• operate, monitor, review and continually improve the management system, so that it continues to meet the organization's information security requirements.

Other standards in the ISO/IEC 27000 family provide additional guidance on certain aspects of designing, implementing and operating an ISMS, for example on information security risk management (ISO/IEC 27005).

History

BS 7799 was a standard originally published by BSI Group in 1995. It was written by the UK government's Department of Trade and Industry (DTI) and consisted of several parts.

The first part, containing the best practices for information security management, was revised and reissued in May 1999 as BS 7799-1:1999; after a lengthy discussion in the worldwide standards bodies, it was adopted by ISO in December 2000 as ISO/IEC 17799, Information technology — Code of practice for information security management. A second edition, ISO/IEC 17799:2005, followed in June 2005; a corrigendum published in July 2007 renumbered it as ISO/IEC 27002, bringing it into the ISO/IEC 27000 series without altering its technical content.

The second part, BS 7799-2, was first published in February 1998 as Information security management — Specification for information security management systems and revised in May 1999. A further edition, published in 2002, was retitled Information security management — Specification with guidance for use. BS 7799-2 focused on how to implement an information security management system (ISMS), referring to the information security management structure and controls identified in BS 7799-1. It was adopted by ISO as ISO/IEC 27001, which was published in October 2005; BSI published it in the United Kingdom as BS ISO/IEC 27001:2005, which also carried the designation BS 7799-2:2005.

A third part, BS 7799-3, Information security management systems — Guidelines for information security risk management, was published in March 2006 to support BS ISO/IEC 27001:2005. A revised edition followed in 2017, and both editions of BS 7799-3 have since been withdrawn.

ISO/IEC 27001:2005 was replaced by a second edition in 2013. According to the convener of the working group responsible for the standard, the second edition was intended to give a more flexible and streamlined approach, updated the controls in Annex A to address risks such as identity theft and risks associated with mobile devices, and was modified to fit the high-level structure used across management system standards so that it could more easily be integrated with them. A third edition followed in October 2022. The third edition was technically revised, incorporated two technical corrigenda that had been issued against the 2013 text, and aligned the standard with the harmonized structure used for ISO management system standards and with ISO/IEC 27002:2022. Of the 93 controls in the realigned Annex A, 11 were new, 24 resulted from merging earlier controls and 58 were updated. Accredited certification bodies were required to complete the transition of their certified clients to the third edition by 31 October 2025.

Structure and requirements

ISO/IEC 27001 requires a risk-based approach to information security. The organization must define and apply an information security risk assessment process that identifies the risks to the confidentiality, integrity and availability of information within the scope of the ISMS, analyses their consequences and likelihood, and evaluates them against criteria the organization has established; the risks are then addressed through a risk treatment process. The standard sets out what the process must achieve but does not prescribe a particular methodology, guidance on which is given in ISO/IEC 27005.

Annex A of ISO/IEC 27001:2022 contains a reference set of 93 information security controls, grouped into four themes: organizational, people, physical and technological. They correspond to the controls of ISO/IEC 27002:2022. The 2013 edition of ISO/IEC 27001 had listed 114 controls in 14 clauses. They address matters such as access control, cryptography, physical security and incident management. Annex A provides the identifier, name and control statement for each control. ISO/IEC 27002 provides the corresponding control attributes, purpose, implementation guidance and other explanatory information, and is therefore commonly used alongside ISO/IEC 27001. The two standards have different functions: ISO/IEC 27001 states the requirements against which an ISMS is certified, whereas ISO/IEC 27002 is a guidance standard that cannot itself be certified against. Annex A is a reference set rather than a mandatory checklist: the organization determines the controls needed to treat the risks it has identified, may draw them from any source, and compares them with Annex A to verify that no necessary control has been overlooked. The organization must produce a Statement of Applicability, which records the controls it has determined to be necessary, the justification for including them, whether they have been implemented, and the justification for excluding any of the Annex A controls.

The requirements of the standard are contained in clauses 4 to 10, and excluding any of them is not acceptable when an organization claims conformity with the standard.

Requirement clauses of ISO/IEC 27001:2022

Clause	Title	Principal subjects
4	Context of the organization	The organization and its context; the needs and expectations of interested parties; the scope of the ISMS; the ISMS itself
5	Leadership	Leadership and commitment of top management; the information security policy; organizational roles, responsibilities and authorities
6	Planning	Actions to address risks and opportunities, comprising information security risk assessment and risk treatment; information security objectives and planning to achieve them
7	Support	Resources; competence; awareness; communication; documented information
8	Operation	Operational planning and control; performance of the information security risk assessment and risk treatment
9	Performance evaluation	Monitoring, measurement, analysis and evaluation; internal audit; management review
10	Improvement	Continual improvement; nonconformity and corrective action

Clause 4, on the context of the organization, requires the organization to understand its context and the needs and expectations of interested parties, to determine the scope of the ISMS and to establish the management system itself. The organization has to determine which of the requirements of those interested parties are relevant to the ISMS; such requirements can include legal and regulatory requirements and contractual obligations, which are therefore dealt with within the management system rather than being specified by the standard itself. Clause 5 concerns leadership, requiring commitment from top management, an information security policy, and the assignment of roles, responsibilities and authorities.

Clause 6, on planning, contains the requirements for information security risk assessment and risk treatment and for information security objectives. Risks identified in the risk assessment must be assigned to risk owners, and the risk treatment process requires the organization to formulate a risk treatment plan and to obtain the approval of the risk owners both for that plan and for the acceptance of the residual information security risks, so that those decisions rest with the management that owns the risks rather than with the auditors or with the staff carrying out the assessment. The information security objectives must be consistent with the information security policy, be measurable if that is practicable, take account of applicable information security requirements and of the results of risk assessment and risk treatment, and be monitored, communicated and updated as appropriate; the organization must also determine what will be done to achieve them, what resources will be required, who will be responsible, when they are to be achieved and how the results will be evaluated.

Clause 7 covers support, including resources, competence, awareness, communication and documented information, and clause 8 covers the operation of the processes planned under clause 6.

The clauses follow the harmonized structure for management system standards set out in Annex SL of the ISO/IEC Directives, from which the standard takes its high-level structure, identical sub-clause titles, identical text, common terms and core definitions. The standard says that this maintains compatibility with other management system standards that have adopted Annex SL, and is useful for organizations that choose to operate a single management system meeting the requirements of two or more such standards. The terms and definitions used are those of ISO/IEC 27000, which is the standard's only normative reference.

The standard requires a range of documented information to be created and retained, including the scope of the ISMS, the information security policy, the information security risk assessment and risk treatment processes, the Statement of Applicability, the risk treatment plan and the information security objectives, together with records of competence, of the results of monitoring and measurement, of the internal audit programme and its results, of management reviews, and of nonconformities and the actions taken in response.

Clauses 9 and 10 require the organization to monitor, measure, analyse and evaluate the performance of the ISMS, to carry out internal audits and management reviews at planned intervals, to react to nonconformities and take corrective action, and to continually improve the suitability, adequacy and effectiveness of the management system.

Certification

ISO does not itself perform certification or issue certificates, and does not permit the use of its logo in connection with certification. An ISMS may instead be certified as conforming to ISO/IEC 27001 by an independent certification body. Certification is optional. ISO notes that, as with its other management system standards, organizations implementing ISO/IEC 27001 can decide whether to go through a certification process: some implement the standard in order to benefit from the practices it contains, while others also seek certification in order to reassure customers and clients. In some industries, however, certification is a legal or contractual requirement. ISO/IEC 27001 is also published as a national standard in many countries, for example in the United Kingdom as BS ISO/IEC 27001:2022 and, after its adoption as a European Standard, as BS EN ISO/IEC 27001:2023+A1:2024.

A certification audit covers the requirements of the standard together with the controls the organization has declared applicable in its Statement of Applicability. Within that scope the audit team decides which controls to sample, and in what depth, in order to obtain evidence that they have been implemented and are operating effectively.

Initial certification to ISO/IEC 27001, like certification to other ISO management system standards, involves an external audit carried out in two stages, after which the certification body takes a certification decision. Certification is then maintained by surveillance audits and by a recertification audit within a three-year certification cycle. The requirements applying to certification bodies are set out in ISO/IEC 17021-1 and, for ISMS certification specifically, in ISO/IEC 27006-1.

Stage 1

The Stage 1 audit is a review of the organization's readiness for the Stage 2 audit. It includes a review of the ISMS documented information, such as the organization's information security policy, Statement of Applicability (SoA) and Risk Treatment Plan (RTP), and considers the scope of the ISMS, the organization's context, its internal audits and management reviews, and site-specific conditions. The audit team decides whether the organization is ready for Stage 2, raises any areas of concern, and agrees the audit plan, including the subjects to be covered and the resources and personnel needed.

Stage 2

The Stage 2 audit is a more detailed and formal conformity audit that independently tests the ISMS against the requirements specified in ISO/IEC 27001. The auditors seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation, for example by examining the records of internal audits and management reviews and the results of the organization's monitoring, measurement and reporting of information security performance. Certification audits are led by an audit team leader. The audit team does not itself grant certification: it reports its findings and makes a recommendation, and the certification body then takes the certification decision, which must be made by personnel who did not carry out the audit.

Surveillance and recertification

Once a certificate has been issued, follow-up audits confirm that the ISMS continues to operate as specified and intended and that the organization remains in conformity with the standard. The first surveillance audit takes place within twelve months of the certification decision, and surveillance audits are then conducted at least once each calendar year except in recertification years. A recertification audit is required before the certificate expires, normally on a three-year cycle. Audits may be conducted more frequently where the certification scheme, the risks involved or significant changes to the ISMS make it necessary.

Meaning and limitations of a certificate

The organization determines the scope of the ISMS, which may be limited to, for example, a single business unit or location. The scope cannot be chosen arbitrarily: in determining the boundaries and applicability of the ISMS the organization has to consider the external and internal issues it has identified, the requirements of the interested parties that are relevant to the ISMS, and the interfaces and dependencies between the activities it performs itself and those performed by other organizations. The scope so determined must be available as documented information. Certification applies only within the scope stated on the certificate, which ISO/IEC 17021-1 requires the certification body to identify; it says nothing about information security management in the parts of the organization that fall outside that scope.

What a certificate attests is the conformity of a management system. ISO defines certification as the provision by an independent body of written assurance that the product, service or system in question meets specified requirements, and describes conformity with ISO/IEC 27001 as meaning that an organization has put in place a system to manage risks related to the security of the data it owns or handles. The subject of an ISO/IEC 27001 certificate is accordingly the ISMS within its stated scope, and not a particular product, service or technology of the organization. A certificate is not an assurance that no security incident will occur or that every risk has been eliminated: the standard requires risk owners to accept the residual information security risks that remain after treatment, and the certification audit examines a sample of the applicable controls rather than every one of them. ISO notes that a claim of certification should refer to the standard by its full reference, for example certification to ISO/IEC 27001:2022 rather than to ISO 27001.

Accreditation

Certification bodies may themselves be accredited. ISO describes accreditation as the formal recognition by an independent body, generally an accreditation body, that a certification body operates according to international standards, and notes that accreditation is not compulsory and that a body which is not accredited is not necessarily less reputable. Accredited certificates, including those issued against ISO/IEC 27001, can be checked through IAF CertSearch, a global database of accredited management system certifications. The International Accreditation Forum, which operated the multilateral recognition arrangement between accreditation bodies, ceased operations on 1 January 2026; its role, together with that of the International Laboratory Accreditation Cooperation, has been taken over by the Global Accreditation Cooperation Incorporated.

Number of certificates

Since 1993 ISO has published an annual survey of the number of valid certificates to its principal management system standards, broken down by country, standard and sector. From 2025 the survey has been compiled from anonymized aggregated data held in IAF CertSearch rather than collected from certification bodies directly. ISO reported that the 2022 survey recorded more than 70,000 ISO/IEC 27001 certificates in 150 countries, in sectors ranging from agriculture through manufacturing to social services.

Recognition in law

Certification is in some cases given effect in law. The technical and methodological requirements for cybersecurity risk-management measures that the European Commission laid down in 2024 for certain digital service providers under the NIS2 Directive are, according to the recitals of the implementing regulation, based on European and international standards, among them ISO/IEC 27001 and ISO/IEC 27002. Under European Union rules on the traceability of tobacco products, providers of data storage services must declare that the repository is managed in accordance with internationally recognized information security management standards, and providers certified to ISO/IEC 27001:2013 are presumed to meet those standards.

Professional certifications

Lead Implementer and Lead Auditor are among the personal credentials associated with ISO/IEC 27001; as the names indicate, the first concerns establishing and operating an ISMS and the second concerns auditing one. An auditor assesses conformity and reports findings; the decision to certify is taken by the certification body and not by the auditor.

ISO does not perform certification or issue certificates of any kind, and there is no single ISO/IEC 27001 Lead Implementer or Lead Auditor qualification. Such credentials are issued by independent training providers and by bodies that operate personnel certification schemes, whose syllabuses, examinations, experience requirements and credential levels differ from one another. A certificate confirming attendance at a course, or success in the examination that accompanies it, is not the same thing as certification of a person by a body operating a certification scheme; bodies of the latter kind may be accredited against ISO/IEC 17024, which sets requirements for bodies that certify persons and therefore applies to the scheme rather than to a training course.

Holding such a credential is distinct from the requirements that apply to certification audits themselves. ISO/IEC 17021-1 requires the certification body to appoint an audit team whose members collectively have the competence needed for the audit, and requirements specific to bodies certifying information security management systems are given in ISO/IEC 27006-1. General guidelines for auditing management systems are given in ISO 19011.

Effectiveness

A systematic review of the academic literature on ISO/IEC 27001, published in The TQM Journal in December 2021, examined 96 books, book chapters and peer-reviewed articles identified in a database search of titles, abstracts and keywords covering publications up to November 2020. The authors reported that only about a quarter of the studies they reviewed discussed the outcomes of certification, that only about half of those offered empirical evidence in support, and that just three papers addressed the impact of the standard directly. They also found that the standard leaves much of the risk analysis and asset assessment to the judgement of the individuals carrying it out, and that implementation often involves issues "related to the high flexibility of the guidelines, the lack of leadership support and the involvement of external consultants"; they noted agreement in the literature that obtaining certification "absorbs significant company resources in terms of working hours and financial resources".

The review covers publications up to November 2020 and so predates the 2022 edition, taking ISO/IEC 27001:2013 as the current version of the standard. The literature it surveys therefore relates to the 2005 and 2013 editions, including their control sets, rather than to the 93 Annex A controls of the 2022 edition.

Related standards

ISO/IEC 27001 is the standard of the ISO/IEC 27000 family against which an ISMS is certified, and it is supported by other standards in that family. ISO/IEC 27000 gives the overview and vocabulary of information security management systems and is the only standard to which ISO/IEC 27001 makes a normative reference, the terms and definitions of ISO/IEC 27001 being those of ISO/IEC 27000. ISO/IEC 27002 gives the attributes, purpose and implementation guidance for the controls listed in Annex A of ISO/IEC 27001. ISO/IEC 27003 gives guidance on implementing an ISMS and ISO/IEC 27004 on monitoring, measurement, analysis and evaluation, while ISO/IEC 27005 gives guidance on managing information security risks; ISO/IEC 27001 also refers to ISO 31000 for general risk management guidelines.

Other standards in the family give sector-specific guidance on information security controls, among them ISO/IEC 27011 for telecommunications organizations and ISO/IEC 27019 for the energy utility industry. Comparable guidance for health care is given in ISO 27799, which is prepared by ISO's health informatics committee rather than by the joint ISO/IEC committee responsible for the ISO/IEC 27000 family. These are sets of information security controls based on ISO/IEC 27002 rather than alternative sets of ISMS requirements, and they do not replace ISO/IEC 27001 as the standard against which an ISMS is certified.

Requirements for the bodies that audit and certify an ISMS are given in ISO/IEC 17021-1 and, specifically for information security management systems, in ISO/IEC 27006-1, and general guidelines for auditing management systems in ISO 19011.

Privacy information management is addressed by ISO/IEC 27701. Its first edition, ISO/IEC 27701:2019, was an extension to ISO/IEC 27001 and ISO/IEC 27002 for privacy information management; the second edition, published in 2025, made privacy information management a standalone management system standard.

Because ISO/IEC 27001 uses the harmonized structure of Annex SL, it shares its high-level clause structure with other management system standards such as ISO 9001 and ISO 22301. Frameworks that address information security outside the ISO management system model include the NIST Cybersecurity Framework and the IEC 62443 series on the security of industrial automation and control systems.

See also

• List of ISO standards
• List of IEC standards

External links

• Official website