What Is ISO 27001?
Last updated: July 30, 2026
Definition
ISO/IEC 27001 is an international standard that specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Published jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), it provides a risk-based framework any organization can use to protect the confidentiality, integrity, and availability of its information assets.
Key Facts
- Full name: ISO/IEC 27001 (Information security, cybersecurity and privacy protection: Information security management systems: Requirements)
- Published by: ISO and IEC
- Current version: ISO/IEC 27001:2022 (released October 2022)
- Annex A controls: 93, organized into 4 themes: Organizational (37), People (8), Physical (14), Technological (34)
- Certification validity: 3 years, with annual surveillance audits
- Mandatory or voluntary: Voluntary in most countries. May be contractually required by clients or regulators.
How ISO 27001 Works
ISO 27001 requires organizations to build and operate an ISMS (a documented system of policies, processes, and controls designed to identify and manage information security risks). The standard does not prescribe a fixed set of controls for every organization. It requires each organization to conduct a risk assessment, identify which risks are unacceptable, and select controls from Annex A to address those risks. Selected and excluded controls are documented in a Statement of Applicability (SoA).
The standard is structured around 10 main clauses. Clauses 4 through 10 define the mandatory requirements: understanding organizational context, establishing leadership commitment, planning for risks and opportunities, providing necessary resources, executing operational controls, evaluating performance, and driving continual improvement. These clauses follow the Plan-Do-Check-Act (PDCA) cycle, which keeps the ISMS responsive to changing threats.
The current 2022 version of Annex A reduced the control catalog from 114 to 93, consolidating overlapping controls and adding 11 new ones. New controls address threat intelligence, cloud service security, data masking, secure coding, and ICT readiness for business continuity.
Certification requires a two-stage external audit by an accredited certification body. Stage 1 reviews documentation. Stage 2 tests whether the ISMS is operating in practice. Organizations that pass hold a certificate valid for three years, with surveillance audits in years one and two and a recertification audit in year three.
Why ISO 27001 Matters
Organizations handling sensitive data in healthcare, finance, legal, IT services, and professional services face growing pressure from clients, regulators, and insurers to demonstrate that their security posture is independently verified, not self-reported. ISO 27001 certification provides that verification. It is recognized in more than 150 countries, making it the primary international benchmark for information security management.
For organizations pursuing IT compliance services, a documented ISMS with a completed Risk Treatment Plan simplifies responses to client audits, insurance questionnaires, and regulatory inquiries. Certification can reduce data breach costs by up to 30%, according to research cited by ISMS.online (2026). ISO 27001 also addresses roughly 83% of NIST Cybersecurity Framework requirements, according to OneTrust, and its risk management structure directly supports GDPR compliance obligations.
ISO 27001 vs. SOC 2
| Dimension | ISO 27001 | SOC 2 |
| Output | Certificate (pass/fail) | Attestation report (auditor opinion) |
| Scope | Full ISMS across the organization | Selected Trust Services Criteria |
| Geographic reach | 150+ countries | Primarily North America |
| Framework basis | International standard (ISO/IEC) | AICPA Trust Services Criteria |
| Renewal | 3-year cycle, annual audits | Annual attestation |
| Cost driver | Mandatory external certification audits | CPA firm attestation fees |
Both standards require independent third-party verification. Neither is a self-reported compliance claim. For organizations that work with enterprise clients globally, ISO 27001 is typically the required standard. For those primarily serving North American technology buyers, SOC 2 may be the first requirement. The two are often pursued together to cover both markets. Organizations providing cybersecurity services to regulated industries commonly hold both.
Common Misconceptions
ISO 27001 is not a checklist of mandatory controls. Organizations must implement all clauses (4-10), but they select Annex A controls based on their own risk assessment. A manufacturing company and a SaaS provider face different threats and will implement different control subsets. The SoA documents both what was selected and why other controls were excluded.
ISO 27001 certification does not equal GDPR compliance. The standard supports GDPR implementation by providing a structured framework for protecting personal data. It covers the security dimension of GDPR obligations. It does not address the full scope of GDPR requirements, including data subject rights, lawful basis for processing, or breach notification timelines.
Frequently Asked Questions
Implementation timelines vary by organization size and starting point. Organizations with existing security controls in place typically complete the process in 6 to 12 months. First-time implementations starting from a limited baseline can take 12 to 18 months. A gap assessment before starting reduces timeline risk by identifying where remediation work is concentrated.
No. Organizations select Annex A controls based on their risk assessment outcomes and must justify any exclusions in the Statement of Applicability. The number of controls implemented varies by organization. What the standard requires is that the selection process is documented and defensible, not that all 93 controls are active.
The two frameworks share a common risk management structure: identify risks, implement controls, monitor performance. An ISO 27001-certified organization has addressed roughly 83% of NIST CSF requirements. Organizations building an information security program for the first time often start with NIST CSF because it is voluntary and flexible, then pursue ISO 27001 certification as they reach operational maturity. For organizations managing IT infrastructure monitoring across multiple sites, both frameworks reinforce the continuous monitoring practices that underpin a mature security posture.
