Icologiq Knowledge · Standard
ISO/IEC 27001
The international standard specifying requirements for establishing, implementing, maintaining and continually improving an information security management system.
ISO 27001
Also known as:
ISO/IEC 27001:2022, ISMS standard, information security management system standard
At a glance
Type
Standard
Topic
Enterprise IT
Applies to
Cross-industry
Current version
ISO/IEC 27001:2022 + Amd 1:2024
Status
Current edition with published Amendment 1:2024
Last reviewed
October 9, 2026
Definition
ISO/IEC 27001 defines requirements for an information security management system, or ISMS. It provides a systematic approach to managing information-security risks through governance, risk assessment, controls, monitoring and continual improvement. Certification applies to an organization’s defined ISMS scope, not automatically to every product claim.
Why it matters
ISO/IEC 27001 matters because organizations need a systematic way to identify information-security risks, select and manage controls, assign responsibilities and demonstrate that their information security management system is monitored and continually improved.
Requires the organization to understand its context and interested parties, define the ISMS scope and establish the management system.
Context of the organization
Clause 4
Addresses leadership commitment, information-security policy and assignment of organizational roles, responsibilities and authorities.
Leadership
Clause 5
Covers information-security risk assessment and treatment, objectives and planning of management-system changes.
Planning
Clause 6
Addresses resources, competence, awareness, communication and control of documented information.
Support
Clause 7
Requires operational planning and control and execution of information-security risk assessment and treatment activities.
Operation
Clause 8
Covers monitoring, measurement, analysis, evaluation, Internal Audit and management review.
Performance evaluation
Clause 9
Addresses continual improvement and management of nonconformity and Corrective Action.
Improvement
Clause 10
Standard explained
Requirement structure of ISO/IEC 27001:2022
ISO/IEC 27001:2022 remains the current ISMS requirements standard and has Amendment 1:2024 on climate-action changes. Clauses 4–10 follow the management-system structure, with Annex A providing the reference control set used in risk treatment.
A management system for establishing, operating and continually improving controls that protect the confidentiality, integrity and availability of information.
Information Security Management System
Concept
· Enterprise IT
The coordinated process of identifying, assessing, treating, monitoring and communicating risks that could affect objectives, safety, quality or compliance.
Risk Management
Process
· Risk
Explore further
Related knowledge
Explore related standards, processes and quality-management concepts.
Relevant Icologiq capabilities
Explore the quality processes and platform capabilities connected to this topic.
In practice
Where this matters
See which industries and Icologiq capabilities are most closely connected to this topic.