ISO/IEC 27001 is an international standard for information security management systems. It does not demand specific technology but a systematic process: identify risks, select measures, implement, review and improve. Example measures are in Annex A of the standard.
Building blocks of an ISMS
Define the scope: which areas, sites and systems belong to it?
Information security policy and responsibilities.
Risk analysis and risk treatment.
Select measures from Annex A and justify them in a statement of applicability.
Training, documentation and internal audits.
Management review and continual improvement.
Certify or not?
Certification by an accredited body builds trust with customers and can ease tenders. It also demands effort: the certificate generally runs three years with annual surveillance audits. Even without a certificate the method and measures help improve information security systematically. BSI IT-Grundschutz is a German alternative.
ISO 27001ISMSinformation security certificationISO 27001 SMB
Frequently asked questions
What is an ISMS?
An information security management system, i.e. an ongoing process that records risks, steers measures and checks effectiveness.
Do you have to be certified for ISO 27001?
No, the standard can be applied without a certificate. Certification serves as evidence to third parties.
How long is an ISO 27001 certificate valid?
Generally three years, with annual surveillance audits.