Executive Summary: What is it?
ISO 27001 specifies the requirements for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). The 2022 revision is the current edition: certifications to the 2013 edition expired or were withdrawn by 31 October 2025. Certification is voluntary.
CFO / Business Impact: What does it cost/risk?
- Risk Management: The standard describes the ISMS as preserving the confidentiality, integrity and availability of information by applying a risk management process, and as giving interested parties confidence that risks are adequately managed.
- Part of the Business: Adopting an ISMS is a strategic decision. The standard expects it to be part of, and integrated with, the organization's processes and overall management structure, and its implementation to scale with the organization's needs.
- Who Pays: The organization bears the cost of building and running its ISMS, which grows with the scale its needs set and recurs, since the ISMS must be maintained and continually improved; if it chooses certification, it pays an external certification body for the audits.
Technical Reality: How does it work?
- Related Standards: ISO 27001 specifies the requirements for the ISMS itself. Cloud security controls (ISO/IEC 27017) and privacy information management (ISO/IEC 27701) are separate standards.
- Continual Improvement: Requires the organization to establish, implement, maintain and continually improve the ISMS, and gives continual improvement its own clause (10.1). The order in which the standard presents its requirements is not the order in which they must be implemented.
What the Label Means in a Solution Profile
ISO 27001 certifies an organization's information security management system, not a product.
- Self-Hosted line: No self-hosted line carries ISO 27001. Running the software yourself puts the management system, and any certification, on you.
- Managed service line: "ISO 27001 (Audited)" means an independent certification body has certified the vendor's management system for the service named, with a valid certificate to the 2022 edition. With Inherited, the label names a host after the dot, and the certificate belongs to that host, not to the vendor itself.