Frameworks and standards

ISO/IEC 27001: the international standard for information security

ISO/IEC 27001 helps organisations protect the information they hold, and prove it through independent certification. Here is what it covers and why it matters to IT service management.

In brief

What is ISO/IEC 27001?

ISO/IEC 27001 is the international standard for an information security management system (ISMS): a structured way to identify risks to your information and manage them with appropriate controls.

It is not just about technology. It covers people, processes, physical security and suppliers, and it applies to information in any form, from databases and cloud services to paper records and conversations.

At its heart is risk management. You identify what information matters, what could go wrong, and how likely and serious that would be. You then decide how to treat each risk, using the reference set of controls in the standard’s Annex A as a checklist to make sure nothing important is missed.

The current edition is ISO/IEC 27001:2022, updated by Amendment 1 in 2024 to include consideration of climate change. The transition period from the 2013 edition ended on 31 October 2025, so all certificates now relate to the 2022 edition.

Key facts

Type: International standard (certifiable)
Published by: ISO and IEC, through joint committee ISO/IEC JTC 1/SC 27
Current edition: ISO/IEC 27001:2022, with Amendment 1:2024
Certification for organisations: Yes, by accredited certification bodies
Qualifications for people: Yes, from Foundation to Lead Implementer and Lead Auditor
Official site: iso.org

Core ideas

The key ideas in ISO/IEC 27001

Confidentiality, integrity, availabilityInformation should be seen only by the right people, kept accurate and complete, and be available when needed.

Risk-based approachControls are chosen in response to assessed risks, so effort goes where it matters most rather than everywhere at once.

Annex A controlsThe 2022 edition lists 93 reference controls in four themes: organisational, people, physical and technological.

Statement of ApplicabilityA key document that records which controls apply, why, and how they are implemented, or why any are excluded.

Leadership and cultureTop management must set direction, provide resources and promote security awareness throughout the organisation.

Continual improvementInternal audits, management reviews and corrective actions keep the ISMS effective as threats and the business change.

Ownership and history

Who publishes ISO/IEC 27001, and where did it come from?

ISO/IEC 27001 is published jointly by ISO and the IEC, and developed by subcommittee SC 27 of their joint technical committee ISO/IEC JTC 1, which covers information security, cybersecurity and privacy protection.

Like ISO/IEC 20000, it has British origins. It grew out of BS 7799, first published by the British Standards Institution in 1995. The management system part became ISO/IEC 27001 in 2005, followed by revised editions in 2013 and 2022.

ISO/IEC 27001 is supported by a wider family of standards, notably ISO/IEC 27002, which gives detailed guidance on implementing each control.

Certifications

Certification for organisations and qualifications for people

As with other ISO management system standards, organisations are certified by independent bodies, while individuals can take training and exams to build and prove their knowledge.

OrganisationsISO/IEC 27001 certificationAn accredited certification body audits your ISMS in two stages. Certificates are usually valid for three years, with annual surveillance audits and a recertification audit at the end of the cycle.

OrganisationsAccreditation mattersIn the UK, choose a certification body accredited by UKAS for ISO/IEC 27001, so your certificate carries weight with customers and regulators.

PeopleQualifications for individualsBodies such as PECB, BSI, APMG International and others offer Foundation, Lead Implementer and Lead Auditor qualifications. Broader security credentials, such as CISSP and CISM, are also common.

Benefits

Why organisations adopt ISO/IEC 27001

Trust from customersCertification is one of the most widely recognised ways to show that you take information security seriously.

Fewer, smaller incidentsSystematic risk management reduces the likelihood and impact of breaches, outages and data loss.

Commercial advantageMany tenders and enterprise customers require or strongly prefer certified suppliers, which can shorten due diligence.

Support for legal obligationsA well-run ISMS helps demonstrate the appropriate security measures expected under data protection laws such as UK GDPR.

A security cultureAwareness, clear responsibilities and regular review make security part of everyday work, not a one-off project.

Works with service managementIncident, change, asset and supplier processes can serve both security and service management at the same time.

Who it is for

Who should use ISO/IEC 27001?

Any organisation that holds information worth protecting, which today means almost every organisation. It is especially relevant for:

technology, SaaS, cloud and managed service providers;
organisations handling personal, financial or health data;
suppliers to government, financial services and other regulated sectors;
organisations whose customers ask security questionnaires or require certification.

Small organisations can achieve certification too. The key is to set a sensible scope and keep controls proportionate to the risks.

Roles that benefit most

Information security managers and CISOs
Heads of IT and IT operations
Data protection officers
Risk, compliance and audit teams
Service management and change teams

How it fits

How ISO/IEC 27001 works with service management

Security and service management are often run as two separate worlds, which leads to duplicated processes and conflicting priorities. They work far better together.

ISO/IEC 20000 shares the same high-level structure, so both standards can be run as one integrated management system.
ITIL practices such as incident, change, asset and supplier management produce much of the evidence an ISMS relies on.
COBIT places information security within overall IT governance and risk management.

How Northera helps

Security and service management, joined up

We help organisations design service management processes that also meet ISO/IEC 27001 needs, so they run one system rather than two. Specialist information security work, such as risk assessment and ISMS implementation, is delivered through certified associates whose work we scope and review. Talk to us via our contact page.

Want security and service management working as one?

Book a free scoping call to discuss how your service management can support your information security goals.

Book a free scoping call