ISO/IEC 27001 - Information security management

The ISO 27000 family of standards helps organizations keep information assets secure.

Using this family of standards will help your organization manage the security of assets such as financial information, intellectual property, employee details or information entrusted to you by third parties.

ISO/IEC 27001 is the best-known standard in the family providing requirements for an information security management system (ISMS).

What is an ISMS?

An ISMS is a systematic approach to managing sensitive company information so that it remains secure. It includes people, processes and IT systems by applying a risk management process.

It can help small, medium and large businesses in any sector keep information assets secure.

Preview ISO/IEC 27001:2013

You can preview the freely available sections of ISO 27001:2013 on our Online Browsing Platform. To purchase the standard please visit the ISO Store.

Certification to ISO/IEC 27001

Like other ISO management system standards, certification to ISO/IEC 27001 is possible but not obligatory. Some organizations choose to implement the standard in order to benefit from the best practice it contains while others decide they also want to get certified to reassure customers and clients that its recommendations have been followed. ISO does not perform certification.

Read more about certification to ISO’s management system standards.

Many organizations around the world are certified to ISO/IEC 27001. To find out more, visit the ISO Survey.

ISO Store

  • ISO/IEC 27001:2013
    Information technology -- Security techniques -- Information security management systems -- Requirements
  • ISO/IEC 27002:2013
    Information technology -- Security techniques -- Code of practice for information security controls
  • ISO/IEC 27003:2010
    Information technology -- Security techniques -- Information security management system implementation guidance
  • ISO/IEC 27004:2009
    Information technology -- Security techniques -- Information security management -- Measurement

Visit the ISO Store to buy more standards

Useful articles

Common terminology for information security management just revised

by Sandrine Tranchard

All information held and processed by an organization is subject to the risks of attack, error and natural disaster, and other vulnerabilities inherent to its use. Information security is therefore at the heart of an organization’s activities and focuses on information considered a valuable “asset” requiring appropriate protection, for example against the loss of availability, confidentiality and integrity.

Read the full entry

Security toolbox protects organizations from cyber-attacks

by Maria Lazarte

Cyber-attacks are among the greatest risks an organization can face. Having standards and systems in place to keep information safe has therefore never been more important than in today’s digital world. This is why the ISO/IEC 27000 series on security techniques for information technology has been updated to provide organizations with that added value and confidence.

Read the full entry

IT security experts win technical excellence award

by Katie Bird

The group of experts that develops International Standards for IT security techniques has been awarded the Lawrence D. Eicher Award for excellence in technical work.

Read the full entry


Safeguard your information with new IT security collection

Information security breaches are on the rise with organizations big and small suffering from cyber-attacks. In this increasingly challenging environment, companies have no choice but to protect themselves. The new ISO online collection for information security management systems (ISMS) is your first line of defence.

The new cyber warfare

Cyber threats continue to plague governments and businesses around the world. These threats are on the rise as cyber criminals increase their focus and know-how. The problem demands an international solution. ISO/IEC 27001 provides a management framework for assessing and treating risks, whether cyber-oriented or otherwise, that can damage business, governments, and even the fabric of a country's national infrastructure.

The people behind ISO/IEC 27001

ISO/IEC 27001 was developed by the ISO/IEC joint technical committee JTC.

Find out more about ISO/IEC JTC 1 including contact details.