Most businesses hold or have access to valuable or sensitive information. Failure to provide appropriate protection for such information can have serious operational, financial, and legal consequences. In some instances, these can lead to total business failure. The challenge that most businesses struggle with is how to provide appropriate protection. In particular, how do they ensure that they have identified all the risks they are exposed to and how can they manage them in a way that is proportionate, sustainable, and cost-effective? ISO 27001 is the internationally-recognized standard for Information Security Management Systems (ISMS). It provides a robust framework to protect information that can be adapted to all types and sizes of organizations. Organizations that have significant exposure to information-security-related risks are increasingly choosing to implement an ISMS that complies with ISO 27001.

The 27000 Family

The 27000 series of standards started life in 1995 as BS 7799 and was written by the UK’s Department of Trade and Industry (DTI). The standards correctly go by the title “ISO/ IEC” because they are developed and maintained jointly by two international standards bodies: ISO (the International Organization for Standardization) and the IEC (the International Electrotechnical Commission). However, for simplicity, in everyday usage, the “IEC” part is often dropped. There are currently 45 published standards in the ISO 27000 series. Of these, ISO 27001 is the only standard intended for certification. The other standards all provide guidance on best practice implementation. Some provide guidance on how to develop ISMS for particular industries; others give guidance on how to implement key information security risk management processes and controls.

Regular reviews and updates

ISO standards are subject to review every five years to assess whether an update is required. The most recent update to the ISO 27001 standard in 2013 brought about a significant change through the adoption of the “Annex SL” structure. While there were some very minor changes made to the wording in 2017 to clarify the requirement to maintain an information asset inventory, ISO 27001:2013 remains the current standard that organizations can achieve certification.