What is ISO/IEC 27001?
ISO/IEC 27001 is an international standard, published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), that sets the requirements for an information security management system, or ISMS. An ISMS is the management machinery around security: deciding the scope, assessing risk, choosing and running controls, measuring results and improving over time. The standard does not tell an organization which firewall to buy. It requires a documented, repeatable way of deciding what protection is needed and showing that those decisions are carried out.
What the standard requires
Its main clauses cover the organization's context and ISMS scope, leadership commitment, planning (including risk assessment and risk treatment), support (resources, competence, awareness and documented information), operation, performance evaluation (monitoring, internal audit and management review) and improvement (handling nonconformities and corrective action). The current edition, ISO/IEC 27001:2022, includes Annex A, a list of 93 reference controls grouped into four themes: organizational, people, physical and technological.
Organizations do not have to implement every Annex A control. They compare their risk treatment decisions against the list and record the outcome in a Statement of Applicability, which says which controls apply, which do not and why.
How certification works
Certification is voluntary and is carried out by an accredited certification body, not by ISO itself. The initial audit usually has two stages: a review of documentation and readiness, then an assessment of whether the ISMS really operates as described. A certificate typically lasts three years, with surveillance audits in the years between and a recertification audit at the end of the cycle. Many organizations run a gap analysis first to find the requirements they do not yet meet.
Example scenario
A software company that sells to European banks keeps receiving long security questionnaires. It scopes an ISMS around its hosted product, performs a risk assessment, writes a Statement of Applicability, runs internal audits and a management review, and then passes a certification audit. Afterward it answers many questionnaires by sharing the certificate and its scope statement. Careful customers check that the scope actually covers the service they buy.
ISO/IEC 27001 vs. 27002 and other frameworks
- ISO/IEC 27002 gives implementation guidance for the Annex A controls. It is a reference; organizations certify against 27001, not 27002.
- NIST Cybersecurity Framework is a voluntary framework that organizes a program into functions such as Govern, Identify, Protect, Detect, Respond and Recover, with no certification.
- PCI DSS is an industry standard with prescriptive requirements that applies only where payment card data is handled.
- SOC 2 is a CPA firm's attestation report on a service organization's controls, common in the United States, rather than a certification.
ISO/IEC 27001 on the CompTIA Security+ exam
SY0-801 objective 5.5 includes frameworks and standards among its audit and assessment topics, and ISO/IEC 27001 is the usual example of an international standard that supports certification. Scenario wording such as certified ISMS, accredited certification body, a globally recognized certificate, or a customer demanding certification against an international security standard points to ISO/IEC 27001. Distractors: ISO/IEC 27002 (guidance, not certifiable), the NIST CSF (voluntary framework), PCI DSS (card data only) and GDPR (a regulation, not a voluntary standard). Vendor due diligence under objective 5.3 may also ask for an ISO/IEC 27001 certificate or a SOC 2 report as evidence.