ISO/IEC 27001, titled Information security, cybersecurity and privacy protection — Information security management systems — Requirements, is an information security standard. It specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS) within the context of the organization, and includes requirements for the assessment and treatment of information security risks. The requirements are generic and are intended to be applicable to all organizations, regardless of type, size or nature. The requirements are set out in clauses 4 to 10, covering the context of the organization, leadership, planning, support, operation, performance evaluation and improvement; an annex to the standard lists a reference set of information security controls, for which ISO/IEC 27002 supplies the purpose and implementation guidance.
An organization may implement the standard for its own purposes, or have its ISMS certified as conforming to it by an independent certification body following successful completion of an audit. Certification is optional unless it is required by law, by a contract or by another scheme, and it applies only within the scope stated on the certificate. Certification bodies are commonly accredited by a national accreditation body, although accreditation is not compulsory. A systematic review of the academic literature published in 2021 found that few studies had examined the outcomes of certification empirically.
It was originally published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC) in October 2005, with revised editions in 2013 and 2022. The 2022 edition was supplemented in February 2024 by ISO/IEC 27001:2022/Amd 1:2024, Climate action changes, which added one requirement, in the clause on the organization's context, that the organization determine whether climate change is a relevant issue, and one note, in the clause on interested parties, observing that interested parties can have requirements related to climate change.
Rationale ISO/IEC 27001 specifies requirements for a management system rather than a list of security controls to be adopted. The standard describes the adoption of an information security management system (ISMS) as a strategic decision, and states that an organization's ISMS is influenced by its needs and objectives, its security requirements, the processes it uses, and its size and structure. The management system is intended to preserve the confidentiality, integrity and availability of information by applying a risk management process, and to give interested parties confidence that information security risks are adequately managed. The standard also states that it is important for the ISMS to be integrated with the organization's processes and overall management structure, and that its implementation is expected to be scaled according to the needs of the organization. The standard is concerned with information rather than with information technology alone: ISO describes it as a means of securing information in all forms, including paper-based, cloud-based and digital data, of preparing people, processes and technology to face technology-based and other threats, and of keeping assets such as financial statements, intellectual property, employee data and information entrusted to the organization by third parties undamaged, confidential and available as needed.
The standard requires an organization to: assess its information security risks systematically, taking account of the potential consequences and likelihood of loss of confidentiality, integrity and availability of information; select risk treatment options and determine the controls necessary to implement them, controls being one form of treatment alongside others such as avoiding a risk or sharing it with another party; and operate, monitor, review and continually improve the management system, so that it continues to meet the organization's information security requirements.
Other standards in the ISO/IEC 27000 family provide additional guidance on certain aspects of designing, implementing and operating an ISMS, for example on information security risk management (ISO/IEC 27005).
History BS 7799 was a standard originally published by BSI Group in 1995. It was written by the UK government's Department of Trade and Industry (DTI) and consisted of several parts.
The first part, containing the best practices for information security management, was revised and reissued in May 1999 as BS 7799-1:1999; after a lengthy discussion in the worldwide standards bodies, it was adopted by ISO in December 2000 as ISO/IEC 17799, Information technology — Code of practice for information security management. A second edition, ISO/IEC 17799:2005, followed in June 2005; a corrigendum published in July 2007 renumbered it as ISO/IEC 27002, bringing it into the ISO/IEC 27000 series without altering its technical content.
The second part, BS 7799-2, was first published in February 1998 as Information security management — Specification for information security management systems and revised in May 1999. A further edition, published in 2002, was retitled Information security management — Specification with guidance for use. BS 7799-2 focused on how to implement an information security management system (ISMS), referring to the information security management structure and controls identified in BS 7799-1. It was adopted by ISO as ISO/IEC 27001, which was published in October 2005; BSI published it in the United Kingdom as BS ISO/IEC 27001:2005, which also carried the designation BS 7799-2:2005.
A third part, BS 7799-3, Information security management systems — Guidelines for information security risk management, was published in March 2006 to support BS ISO/IEC 27001:2005. A revised edition followed in 2017, and both editions of BS 7799-3 have since been withdrawn.
ISO/IEC 27001:2005 was replaced by a second edition in 2013. According to the convener of the working group responsible for the standard, the second edition was intended to give a more flexible and streamlined approach, updated the controls in Annex A to address risks such as identity theft and risks associated with mobile devices, and was modified to fit the high-level structure used across management system standards so that it could more easily be integrated with them. A third edition followed in October 2022. The third edition was technically revised, incorporated two technical corrigenda that had been issued against the 2013 text, and aligned the standard with the harmonized structure used for ISO management system standards and with ISO/IEC 27002:2022. Of the 93 controls in the realigned Annex A, 11 were new, 24 resulted from merging earlier controls and 58 were updated. Accredited certification bodies were required to complete the transition of their certified clients to the third edition by 31 October 2025.
Structure and requirements ISO/IEC 27001 requires a risk-based approach to information security. The organization must define and apply an information security risk assessment process that identifies the risks to the confidentiality, integrity and availability of information within the scope of the ISMS, analyses their consequences and likelihood, and evaluates them against criteria the organization has established; the risks are then addressed through a risk treatment process. The standard sets out what the process must achieve but does not prescribe a particular methodology, guidance on which is given in ISO/IEC 27005.
Annex A of ISO/IEC 27001:2022 contains a reference set of 93 information security controls, grouped into four themes: organizational, people, physical and technological. They correspond to the controls of ISO/IEC 27002:2022. The 2013 edition of ISO/IEC 27001 had listed 114 controls in 14 clauses. They address matters such as access control, cryptography, physical security and incident management. Annex A provides the identifier, name and control statement for each control. ISO/IEC 27002 provides the corresponding control attributes, purpose, implementation guidance and other explanatory information, and is therefore commonly used alongside ISO/IEC 27001. The two standards have different functions: ISO/IEC 27001 states the requirements against which an ISMS is certified, whereas ISO/IEC 27002 is a guidance standard that cannot itself be certified against. Annex A is a reference set rather than a mandatory checklist: the organization determines the controls needed to treat the risks it has identified, may draw them from any source, and compares them with Annex A to verify that no necessary control has been overlooked. The organization must produce a Statement of Applicability, which records the controls it has determined to be necessary, the justification for including them, whether they have been implemented, and the justification for excluding any of the Annex A controls.
The requirements of the standard are contained in clauses 4 to 10, and excluding any of them is not acceptable when an organization claims conformity with the standard.
+ Requirement clauses of ISO/IEC 27001:2022 Clause Title Principal subjects 4 Context of the organization The organization and its context; the needs and expectations of interested parties; the scope of the ISMS; the ISMS itself 5 Leadership Leadership and commitment of top management; the information security policy; organizational roles, responsibilities and authorities 6 Planning Actions to address risks and opportunities, comprising information security risk assessment and risk treatment; information security objectives and planning to achieve them 7 Support Resources; competence; awareness; communication; documented information 8 Operation Operational planning and control; performance of the information security risk assessment and risk treatment 9 Performance evaluation Monitoring, measurement, analysis and evaluation; internal audit; management review 10 Improvement Continual improvement; nonconformity and corrective action
Clause 4, on the context of the organization, requires the organization to understand its context and the needs and expectations of interested parties, to determine the scope of the ISMS and to establish the management system itself. The organization has to determine which of the requirements of those interested parties are relevant to the ISMS; such requirements can include legal and regulatory requirements and contractual obligations, which are therefore dealt with within the management system rather than being specified by the standard itself. Clause 5 concerns leadership, requiring commitment from top management, an information security policy, and the assignment of roles, responsibilities and authorities.