ISO 27001
ISO/IEC 27001 is the world's most widely recognized international standard for an information security management system (ISMS) — a structured, certifiable way to manage how your organization protects its information. If customers, regulators, or enterprise buyers are asking you to "prove your security," ISO 27001 is the framework that answers them with an independent certificate. Here's the plain-language version: what it is, who needs it, how it's organized, how certification works, and how to get ready.
ISO 27001 checklist
A clause-by-clause implementation checklist.
Free readiness assessment
See your ISO 27001 gaps in minutes.
Map to other frameworks
How ISO 27001 overlaps with SOC 2, NIST 800-53 & NIST CSF 2.0.
Illustrative statuses. Your real assessment is generated from your answers in the app. Standpoint is a self-assessment aid, not legal advice.
What is ISO 27001?
ISO/IEC 27001 is a management-system standard — it doesn't certify a single product or server, it certifies the system you use to manage information security across your organization. It sets out requirements for establishing, implementing, maintaining, and continually improving an information security management system (ISMS), so that security is governed, risk-based, documented, and improved over time rather than handled ad hoc. The current edition is ISO/IEC 27001:2022, and it's maintained jointly by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC).
Who needs ISO 27001?
It fits any organization, of any size or sector, that holds information worth protecting — which is nearly all of them. Teams typically pursue ISO 27001 when: - customers or enterprise buyers require proof of security before they'll sign; - they sell internationally and want a globally recognized certificate rather than a region-specific one; - a contract, tender, or regulator asks for an independently audited security program; - the board or investors want assurance that information risk is being managed, not just assumed.
How ISO 27001 is structured
Like other modern ISO management-system standards, ISO 27001 follows a common high-level structure. The certifiable requirements live in the main clauses (4–10), and a set of information-security controls live in Annex A. In our own words, the main clauses cover: Annex A in the 2022 version lists 93 controls, reorganized into four themes — Organizational, People, Physical, and Technological. You don't have to implement all 93; instead you use your risk assessment to decide which controls apply, then record those decisions in the Statement of Applicability (SoA) — the document that lists each c…
How does ISO 27001 certification work?
Certification follows the standard ISO management-system path. After you implement your ISMS, an accredited certification body audits it in two stages: a Stage 1 review of your documentation and readiness (do the ISMS, policies, risk assessment, and SoA exist and hang together?), followed by a Stage 2 audit of how the system actually operates in practice. If you pass, you receive a certificate that's typically valid for about three years, with periodic surveillance audits in between and a full recertification at the end of the cycle. The software you use (including Standpoint) helps you get ready and organize evidence; the certificate itself is issued only by an accredited body.
ISO 27001 vs. SOC 2 vs. ISO 27701
These are complementary. ISO 27001 is a certifiable standard — you're audited against fixed requirements and receive a pass/fail certificate. SOC 2 (System and Organization Controls 2, the AICPA's Trust Services Criteria) is an attestation report — a licensed CPA firm examines your controls and writes a detailed report on how they operated, rather than issuing a certificate. Many teams pursue both because the underlying controls overlap heavily. ISO/IEC 27701 is a privacy extension to ISO 27001 — it adds a privacy information management system (PIMS) on top of your ISMS, so you can extend an e…
A practical path to readiness
- Define your scope and context. Which parts of the business, which systems and information, and who the interested parties are. - Run a risk assessment. Identify information security risks and decide how you'll treat each one. - Build the SoA and stand up the ISMS. Security policy, roles, risk treatment plan, and the applicable Annex A controls with justifications. - Apply and evidence the controls. Implement the selected controls across the four themes and keep dated evidence. - Internal audit & management review, then engage an accredited body for the Stage 1 and Stage 2 certification audits. The fastest start is a gap assessment. Our free ISO 27001 readiness assessment shows where you stand, and the implementation checklist turns it into a working plan.
ISO 27001 work counts elsewhere too
The crosswalk maps your ISO 27001 evidence onto the frameworks it overlaps — so you move forward on several at once.