ISO/IEC 27001 (ISMS)
ISO 27001 · ISO/IEC 27001:2022 · ISMS · information security management system · SMSI · ISO 27002 · Annex A
The international standard that sets out the requirements for an information security management system (ISMS) and allows an organisation to have its approach certified by an independent body.
In practice
The current version is ISO/IEC 27001:2022, supplemented by a 2024 amendment on climate change; certificates against the 2013 version have no longer been valid since 31 October 2025. The standard requires a continual improvement cycle: define the scope, assess the risks, select and apply controls, measure, correct. Its Annex A lists 93 controls in four themes (organisational, people, physical, technological), detailed in ISO/IEC 27002; a statement of applicability justifies which ones are included or excluded. The certificate, valid for three years with annual surveillance audits, is often required in B2B tenders.
Fictional case: a 60-person SaaS vendor loses two tenders for lack of certification. It sets a realistic scope (its platform and support), carries out its risk assessment and is certified within eleven months by an accredited body.
