Home / Knowledge hub / ISO 27001
Knowledge hub
ISO 27001
The international standard for running an information security management system.
What it means
ISO/IEC 27001 is an international standard for an information security management system, or ISMS. An ISMS is the set of policies, roles and routines an organisation uses to manage information security risk. The standard describes how to run it, not which products to buy.
It works as a cycle. You define the scope, assess risks, choose controls to treat them, run those controls, then measure and improve. An independent certification body audits against the standard, and a passing audit gives you a certificate for the scope you declared.
Why it matters
A certificate is widely recognised, especially outside North America. Many tenders and enterprise buyers list it as a requirement, and one certificate can replace long questionnaires. It is also a discipline: risks are written down, owners are named, and decisions leave a trail.
The limit is scope. A certificate covers only the systems and sites in the declared scope. A company can certify its head office and leave the product out, which is why buyers read the scope statement as well as the date on the certificate.
How it shows up
You will meet it as a set of recurring tasks: a risk register, a Statement of Applicability, internal audits, management reviews, supplier checks and corrective actions. The controls themselves are listed in Annex A, and you choose which to apply based on your risks.
Mistakes repeat. The scope is drawn so narrowly that the product is missing. The risk assessment is copied from a template and never reviewed. Findings from testing are logged but never fixed. A good test is whether a vulnerability found in your application has an owner, a deadline and a record of the fix, as part of your vulnerability management.
Questions people ask
ISO 27001, answered
Is ISO 27001 mandatory?
No, it is voluntary. Some customers, tenders or regulators ask for it, and then it becomes a commercial requirement. Where it is not asked for, it is a way to structure your security work.
Check what your buyers expect.
How long does certification last?
A certificate is typically valid for three years, with surveillance audits in between, usually annually. At the end of the cycle a recertification audit renews it.
The certification body sets the schedule.
What is the difference between ISO 27001 and ISO 27002?
ISO 27001 sets the requirements for the management system and is the one you certify against. ISO 27002 gives guidance on implementing the controls.
Annex A of 27001 lists the controls, and 27002 explains them.
How is ISO 27001 different from SOC 2?
ISO 27001 certifies a management system and is issued by a certification body. SOC 2 is an auditor’s report on controls against the Trust Services Criteria, common with North American buyers.
Many companies hold both.
Does it require penetration testing?
The standard does not name penetration testing as a requirement, but its controls expect technical vulnerabilities and security testing to be managed. Auditors commonly accept test reports as evidence.
The exact expectation depends on your risk assessment.
Sources
Where this comes from
Related
Terms that sit next to this one
ISO 27001 Annex A
The list of security controls an ISO 27001 certified organisation chooses from.
SOC 2
An audit report on how well a service provider protects customer data.
Risk register
A running list of risks, their owners, ratings and chosen responses.
Security questionnaire
The list of questions a buyer's security team sends before they sign.
Vulnerability management
The loop of finding, prioritising, fixing and checking the fix held.
Is the product inside your scope?
Auditors want evidence that technical weaknesses are found and fixed. We find vulnerabilities in web apps and APIs, report only what we exploited, and prove each fix by re-running the exploit. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.