ISO/IEC 27001

ISO/IEC 27001 Information security, cybersecurity and privacy protection. Information Security Management Systems – Requirements

ISO/IEC 27001

ISO/IEC 27001 is one of the most popular information security standards. It defines the requirements for information security management, cybersecurity and privacy protection.

The requirements set out in the standard are relevant for all organizations, regardless of the type, size or nature of activity. ISO/IEC 27001 is applicable to all types of organizations: commercial, non-commercial, governmental and non-governmental, and is most often applied by companies providing IT services, software developers, outsourcing companies, banks and financial institutions, government organizations, traders, consultants and others.

ISO/IEC 27001 can be conditionally divided into two parts. The first (main) part includes clauses that define the basic principles, framework and management processes to support the management of information security risk through the most effective implementation of information systems.

Clauses of ISO/IEC 27001:2022:

1Object and scope of application
2 Normative references
3 Terms and definitions
4 Organization context
4.1 Understanding the organization and its context
4.2 Understanding the needs and expectations of stakeholders
4.3 Defining the scope of the information security management system
4.4 Information Security Management System
5 Leadership
5.1 Leadership and engagement
5.2 Politics
5.3 Organizational roles, responsibilities and credentials
6 Planning
6.1 Actions to address risks and opportunities
6.2 Information security objectives and planning to achieve them
7 Maintenance
7.1 Resources
7.2 Competence
7.3 Awareness
7.4 Information exchange
7.5 Documented information
8 Operation
8.1 Work planning and control
8.2 Information security risk assessment
8.3 Impact on information security risk
9 Performance Evaluation
9.1 Monitoring, measurement, analysis and evaluation