ISO 27001
International standard for an Information Security Management System (ISMS).
ISO/IEC 27001 requires organizations to build and continually improve an ISMS grounded in risk assessment. Annex A lists 93 controls (in the 2022 revision) across Organizational, People, Physical, and Technological themes.
Certification is issued by accredited third-party certification bodies, lasts three years, and includes annual surveillance audits.
An ISMS is more than a control checklist
An information security management system connects business context, risk assessment, treatment decisions, ownership, and continual improvement. Controls are selected and justified in relation to identified risks. The Statement of Applicability records the relevant control decisions rather than assuming every Annex A control is implemented in the same way.
Check the certification scope
When reviewing a supplier’s certificate, check the named organization, locations, activities, standard edition, and validity. A certificate may cover one business unit rather than the service you buy. Ask how the certified scope relates to your data and contractual requirements before using it as vendor evidence.
What certification does not mean
Certification does not guarantee that incidents cannot happen or establish compliance with every privacy law. Internal audits, management review, corrective actions, and evidence of ongoing operation remain important. For a small business, a sensible starting point is a clear scope and risk register rather than collecting documents without an accountable owner.
Related terms
See how Scarlet Risk covers ISO 27001.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo