27001 is the leading international standard focused on information security. It was published by the International Organization for Standardization (ISO), in partnership with the International Electrotechnical Commission (IEC). Both are leading international organizations that develop international standards.

ISO 27001 is part of a set of standards developed to handle information security: the ISO/IEC 27000 series. Its full name is “ISO/IEC 27001 – Information security, cybersecurity and privacy protection — Information security management systems — Requirements.”

ISO framework and the purpose of ISO 27001

The ISO framework is a combination of various standards for organizations to use. ISO 27001 provides a framework to help organizations, of any size or any industry, to protect their information in a systematic and cost-effective way, through the adoption of an Information Security Management System (ISMS).

Why is ISO 27001 important?

Not only does the standard provide companies with the necessary know-how for protecting their most valuable information, but a company can also get certified against ISO 27001 and, in this way, prove to its customers and partners that it safeguards their data.

Individuals can also get ISO 27001 certified by attending a course and passing the exam and, in this way, prove their skills at implementing or auditing an Information Security Management System to potential employers.

Because it is an international standard, ISO 27001 is easily recognized all around the world, increasing business opportunities for organizations and professionals.

What are the three principles of ISO 27001?

The basic goal of ISO 27001 and an Information Security Management System is to protect three aspects of information:

• Confidentiality: Only authorized persons have the right to access information.
• Integrity: Only authorized persons can change the information.
• Availability: The information must be accessible to authorized persons whenever it is needed.
•  

Why do we need an ISMS?

There are four essential business benefits that a company can achieve with the implementation of ISO 27001:

Comply with legal requirements – There is an ever-increasing number of laws, regulations, and contractual requirements related to information security. The good news is that most of them can be resolved by implementing ISO 27001. This standard gives you the perfect methodology to comply with them all.

Achieve competitive advantage – If your company gets certified, and your competitors do not, you may have an advantage over them in the eyes of those customers who are sensitive about keeping their information safe.

Lower costs – The main philosophy of ISO 27001 is to prevent security incidents from happening – and every incident, large or small, costs money. Therefore, by preventing them, your company will save quite a lot of money. And the best thing of all – investment in ISO 27001 is far smaller than the cost savings you’ll achieve.

Better organization – Typically, fast-growing companies don’t have the time to stop and define their processes and procedures – as a consequence, employees often do not know what needs to be done, when, and by whom. Implementation of ISO 27001 helps resolve such situations, because it encourages companies to write down their main processes (even those that are not security related), enabling them to reduce lost time by their employees and maintain critical organizational knowledge that could otherwise be lost when people leave the organization.

How does ISO 27001 work?

The focus of ISO 27001 is to protect the confidentiality, integrity, and availability of the information in a company. This is done by finding out what potential incidents could happen to the information (i.e., risk assessment), and then defining what needs to be done to prevent such incidents from happening (i.e., risk mitigation or risk treatment).

Therefore, the main philosophy of ISO 27001 is based on a process for managing risks: Find out where the risks are, and then systematically treat them, through the implementation of security controls (or safeguards).

IMPLEMENTATION & CERTICIFATION

ISO 27001 mandatory documents

ISO 27001 specifies a minimum set of policies, plans, records, and other documented information that are needed to become compliant. Therefore, the standard requires you to write specific documents and records that are mandatory for ISO 27001 implementation and certification.

To see a more detailed explanation of each of these documents, download the free white paper Checklist of Mandatory Documentation Required by ISO 27001.

What is “ISO 27001 certified”?

A company can go for ISO 27001 certification by inviting an accredited certification body to perform the certification audit and, if the audit is successful, to issue the ISO 27001 certificate to the company. This certificate will mean that the company is fully compliant with the ISO 27001 standard.

An individual can go for ISO 27001 certification by going through ISO 27001 training and passing the exam. This certificate will mean that this person has acquired the appropriate skills during the course.

Is ISO 27001 mandatory?

In most countries, implementation of ISO 27001 is not mandatory. However, some countries have published regulations that require certain industries to implement ISO 27001. To determine whether ISO 27001 is mandatory or not for your company, you should look for expert legal advice in the country where you operate.

Public and private organizations can specify compliance with ISO 27001 as a legal requirement in their contracts and service agreements with their suppliers.

ISO 27001 AND OTHER STANDARDS

What are the ISO 27000 standards?

Because it defines the requirements for an ISMS, ISO 27001 is the main standard in the ISO 27000 family of standards. But, because it mainly defines what is needed, but does not specify how to do it, several other information security standards have been developed to provide additional guidance. Currently, there are more than 40 standards in the ISO 27k series.

ISO 27001 supporting standards

Here are some of the most commonly used other standards in the 27K series that support ISO 27001, providing guidance on specific topics.

ISO/IEC 27000 provides terms and definitions used in the ISO 27k series of standards.

ISO/IEC 27002 provides guidelines for the implementation of controls listed in ISO 27001 Annex A. It can be quite useful, because it provides details on how to implement these controls.

ISO/IEC 27004 provides guidelines for the measurement of information security – it fits well with ISO 27001, because it explains how to determine whether the ISMS has achieved its objectives.

ISO/IEC 27005 provides guidelines for information security risk management. It is a very good supplement to ISO 27001, because it gives details on how to perform risk assessment and risk treatment, probably the most difficult stage in the implementation.

ISO/IEC 27017 provides guidelines for information security in cloud environments.

ISO/IEC 27018 provides guidelines for the protection of privacy in cloud environments.

ISO/IEC 27031 provides guidelines on what to consider when developing business continuity for information and communication technologies (ICT). This standard is a great link between information security and business continuity practices.