ISO 27001
ISO/IEC 27001 — Information Security Management System
ISO/IEC 27001 — Informationssicherheits-Managementsystem
ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security. Certification by an accredited body is the common, auditable proof that an ISMS is effectively operated.
History. Its roots go back to the British standard BS 7799 (1995), internationalised as ISO/IEC 27001 in 2005. The version in force today is ISO/IEC 27001:2022, published in October 2022; the transition period for existing certificates under the 2013 predecessor ended in 2025. The accompanying control set in Annex A was restructured in the process.
Facts. The normative core (clauses 4-10) requires, among other things, context and stakeholder analysis, leadership commitment, risk assessment and treatment, measurable objectives and continual improvement following the Plan-Do-Check-Act cycle. Annex A:2022 groups 93 controls into four themes — organisational, people, physical and technological. The distinction matters: 27001 is certifiable, while ISO/IEC 27002 merely elaborates on the controls.
Outlook & recommendation. Under Network and Information Security Directive 2 (NIS2) the 27001 gains importance as a defensible basis without automatically guaranteeing compliance — regulatory evidence duties partly exceed the standard. What counts is a lived, not merely documented, ISMS. NEOSEC managing director J. Benjamin Espagné is a certified ISO 27001 Lead Auditor; in practice the question „does the ISMS work in a real incident“ separates the optics of a certificate from genuine effectiveness.