Login What is ISO 27001?
Find out more about what ISO 27001 is and how it can benefit you
The ISO 27001 is the international standard for Information Security Management Systems (ISMS) and is part of the ISO 27000 family of information security management standards. It sets out the policies and procedures you need to protect data and manage sensitive information. ISO 27001:2022 is the most recent version of the 27001 standard.
ISO 27001 helps you identify, prevent and address risks – so you can demonstrate that your business has the systems and controls in place to combat any threats to your data integrity. Find out how much ISO 27001 certification costs.
Full video transcript
How does ISO 27001 protect your business?
You may already have a number of information security controls in place. However, making sure everybody is aware of your policies and that everyone follows them in the same way, can sometimes be difficult to manage.
With the ISO 27001 Standard, you’ll have a robust framework to help you define, document, monitor, and review, and update your security controls, ensuring they’ll be implemented consistently.
What does ISO 27001 cover?
It’s worth noting that ISO 27001 is designed to cover much more than just IT. An important part of the Standard concerns data security across all areas of your business, from the screening of new employees to determining the actions that need to be taken when they leave.
To implement ISO 27001, you’ll need to:
- Define and implement an ISO 27001-compliant Information Security Management System (known as the ISMS)
- Define the scope of the ISMS
- Define a security policy, along with associated ISMS Policies
- Conduct a risk assessment
- Manage identified risks
- Select control objectives and controls to implement
- Prepare a Statement of Applicability
Who needs ISO 27001?
ISO 27001 is perfect for any organisation that wants to demonstrate its commitment to information security, whatever its size or sector.
What are the benefits of ISO 27001?
The most widely seen benefits of the ISO 27001 certification include:
- Confidential information is kept secure
- Customers and stakeholders gain confidence in how you manage risk
- Better legal compliance
- You gain a competitive advantage
- Customer satisfaction increases, which improves client retention
ISO 27001:2022 controls
There have been some big changes since the previous version in 2013. In the last version, Annex A was divided into 14 categories, which has been reduced to four in the 2022 version. The 2013 categories featured 114 controls, but now there are 93 controls. The four themes are:
- People (8 controls)
- Organisational (37 controls)
- Technological (34 controls)
- Physical (14 controls)
The update has added 11 new controls which are:
- Threat Intelligence
- Information security for use of cloud services
- ICT readiness for business continuity
- Physical security monitoring
- Configuration management
- Information deletion
- Data masking
- Data leakage prevention
- Monitoring activities
- Web filtering
- Secure coding
You can learn more about the ISO 27001 controls here.
Start your ISO 27001 journey today!
So, if you want to demonstrate to customers and stakeholders that you take the security of their information seriously, gaining certification to ISO 27001 is definitely worth considering.
You could get ISO certified within as little as 45 days with our award-winning hassle-free process.
To find out how much it would cost your organisation fill in our free online calculator, and we’ll email you a personalised quote instantly.