Draft
What is ISO 27001?
By The Citesheet team · Published
Short answer
ISO/IEC 27001 is an international standard, published jointly by ISO and IEC, that sets requirements for an information security management system (ISMS): the policies, risk assessments and controls a company uses to manage security. The current edition is ISO/IEC 27001:2022. Companies are certified by independent certification bodies, not by ISO itself. Buyers often accept it in place of, or alongside, SOC 2.
ISO/IEC 27001 is an international standard for an information security management system (ISMS). An ISMS is the set of policies, processes and controls a company uses to find its security risks and manage them, and to keep improving how it does that.
Key facts
- Who publishes it: ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission), jointly.
- Current edition: ISO/IEC 27001:2022. Its Annex A lists reference controls that a company selects from, based on its risk assessment.
- Certification: done by independent, accredited certification bodies. ISO writes the standard but does not certify companies.
ISO 27001 vs SOC 2
Both are common answers to "how do we know you're secure?":
- ISO 27001 is a certification that your management system meets a standard.
- SOC 2 is an attestation report by a CPA firm describing your controls and, for Type 2, testing them over a period.
ISO 27001 and questionnaires
A certificate answers the "do you have a certified ISMS?" row and supports many policy questions, since the standard requires documented policies and regular review. Buyers still send questionnaires, because a certificate doesn't say how a specific control works. If you aren't certified, say so plainly; don't write "ISO 27001 aligned" unless you can show what that means.
Sources
- ISO: ISO/IEC 27001:2022 Information security management systems — Requirements (accessed )
- ISO: Certification (accessed )