Glossary · I
ISO/IEC 27001
ISO/IEC 27001 is the international standard for an information security management system, against which an accredited certification body audits an organization and issues a certificate.
Extended definition
In more detail.
The standard requires the organization to define scope and context, assess risk, select and implement controls from its annex, operate the system, audit it internally, review it at management level and improve it. Certification runs on a three-year cycle with annual surveillance audits. It is asked for by international, European and public-sector customers and is often pursued alongside or after SOC 2.
In our work
Where it appears.
See ISO/IEC 27001 readiness and the comparison ISO/IEC 27001 versus SOC 2.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days