ISO 27001

ISO 27001 is an Information Security Management System (ISMS) standard published in October 2005 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC). Its full name is ISO/IEC 27001:2005 – Information technology -- Security techniques -- Information security management systems -- Requirements but it is commonly known as “ISO 27001”. Compliance with ISO 27001 requires that management:

» Systematically examine the organization’s information security risks, taking account of the threats, vulnerabilities and impacts;


» Design and implement a coherent and comprehensive suite of information security controls and/or other forms of risk treatment (such as risk avoidance or risk transfer) to address those risks that are deemed unacceptable; and

» Adopt an overarching management process to ensure that the information security controls continue to meet the organization’s information security needs on an ongoing basis.

Source: http://en.wikipedia.org/wiki/ISO/IEC_27001

ISO/IEC 27001 provides a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an information security management system (ISMS). The design and implementation of an ISMS is influenced by the organization’s needs and objectives, security requirements, processes, size, and structure.

An ISMS may be certified compliant with ISO/IEC 27001 by a number of accredited registrars worldwide, also called an Accredited Certification Body (CB). Certification against any of the recognized national variants of ISO/IEC 27001 (e.g., JIS Q 27001, the Japanese version) by an accredited certification body is functionally equivalent to certification against ISO/IEC 27001 itself. In the United States, accreditation is managed bu ANSI-ASQ National Accreditation Board.


The ISO/IEC 27001 certification, like other ISO management system certifications, usually involves a three-stage audit process:

» Stage 1 is a preliminary, informal review of the ISMS, for example, checking the existence and completeness of key documentation such as the organization’s information security policy, Statement of Applicability (SoA), and Risk Treatment Plan(RTP). This stage serves to familiarize the auditors with the organization and vice versa.

» Stage 2 is a more detailed and formal compliance audit, independently testing the ISMS against the requirements specified in ISO/IEC 27001. The auditors will seek evidence to confirm that the management system has been properly designed and implemented, and is in fact in operation (for example by confirming that a security committee or similar management body meets regularly to oversee the ISMS). Certification audits are usually conducted by ISO/IEC 27001 Lead Auditors. Passing this stage results in the ISMS being certified compliant with ISO/IEC 27001.

» Stage 3 involves follow-up reviews or audits to confirm that the organization remains in compliance with the standard. Certification maintenance requires periodic re-assessment audits to confirm that the ISMS continues to operate as specified and intended. These should happen at least annually but (by agreement with management) are often conducted more frequently, particularly while the ISMS is still maturing.

Source: http://en.wikipedia.org/wiki/ISO/IEC_27001

Source of Information : Implementing and Developing Cloud Computing Applications 2011

ISO 27001