ISO/IEC 27001
The international standard for an information security management system.
ISO/IEC 27001 sets out the requirements for an information security management system: the policies, risk assessments and controls an organisation uses to protect information. Organisations can be certified against it by an accredited body.
The current version is ISO/IEC 27001:2022, the third edition, published in October 2022, with one amendment since. It is widely used outside the US, often alongside SOC 2 for companies selling internationally.
Key characteristics
- Requirements for managing information security.
- Certification by an accredited body.
- Current version: ISO/IEC 27001:2022.
- Often paired with SOC 2 in B2B sales.
Example
A European software company certifies to ISO/IEC 27001 to sell to large customers and lists the certificate on its trust page.
Go deeper
Frequently asked questions
What is the difference between ISO 27001 and SOC 2?
ISO/IEC 27001 is an international certification of a security management system. SOC 2 is an auditor's report on specific controls, common in the US.
Related terms