ISO 27001: an ISMS that works
ISO/IEC 27001 is the international standard for information security. What it requires, how a certification project runs and how it ties in with NIS2.
What is ISO 27001?
ISO/IEC 27001 is the international standard for an information security management system, an ISMS. It is a structured way to control the risks to your information and to keep improving.
The current version dates from 2022. Its annex A contains 93 controls in four themes: organisational, people, physical and technological. You choose the controls that fit your risks, and justify that choice.
A certificate from an accredited certification body shows clients, partners and regulators that you manage information security in a way you can prove.
What does the standard require?
- Context and scope: which organisation, processes and systems the ISMS covers, and what interested parties expect.
- Leadership: a policy, clear roles and management that owns the ISMS.
- Risks: a risk assessment, a treatment plan and a Statement of Applicability.
- Support: resources, competence, awareness and controlled documentation.
- Operation and follow-up: the controls in practice, measurement, internal audits and a management review.
- Improvement: dealing with nonconformities and continuing to improve the system.
How does a project run?
- Scope and baseline: we define the scope and map where you stand in a gap analysis.
- Risk assessment: we assess the risks and draw up the Statement of Applicability.
- Controls: we put the necessary controls and documents in place, aiming at what works in your organisation rather than paperwork.
- Showing it works: follow-up, awareness, an internal audit and a management review show that the system is running.
- Certification: an independent body carries out the certification audit in two stages. Annual surveillance audits follow, with recertification after three years.
How long it takes depends on size and starting point. For a medium-sized organisation it usually takes a few months to a year.
ISO 27001 and NIS2
ISO 27001 can help you show that you comply with NIS2. The CCB publishes the conditions: The NIS2 Law on Safeonweb@Work. To see how we support you, read our NIS2 page.
How SecurityAdvice helps
- A gap analysis against ISO 27001, with a concrete action plan.
- Support in setting up the ISMS, from risk assessment to management review.
- Internal audits against ISO 27001.
- Preparation for the certification audit.
SecurityAdvice is not a certification body. We prepare you, and an independent, accredited body carries out the certification audit.
Questions about ISO 27001 or NIS2?
A first conversation quickly shows where you stand and what the next step is.