Glossary

What is ISO 27001?

ISO/IEC 27001 is the leading international standard for information security management. It sets the requirements for an information security management system (ISMS) that protects the confidentiality, integrity and availability of information.

In plain English.

ISO 27001 is published jointly by the International Organization for Standardization and the International Electrotechnical Commission. The current edition is ISO/IEC 27001:2022. It doesn't tell you which software to buy. It asks you to run information security as a managed system: understand your risks, choose controls to deal with them, check they work, and keep improving.

An example. A manufacturer is choosing a partner to build its trade portal, joined to its ERP and holding customer pricing and order history. Its procurement team sends a long security questionnaire. A supplier certified to ISO 27001 can show that much of it is already independently audited, so due diligence is quicker and the manufacturer can trust what it's told.

How it works

  • An ISMS. Policies, responsibilities and processes for managing information security, owned by top management.
  • Risk assessment. Identify the risks to your information, then decide how to treat each one.
  • Annex A controls. The 2022 edition lists 93 controls in four themes: organisational, people, physical and technological. They cover areas such as access control, secure development, supplier security, backups and monitoring. You apply those your risks call for, and record why.
  • Measure and improve. Internal audits, management reviews and continual improvement.

Certification

Certification is carried out by an independent certification body, ideally one accredited by a national body such as UKAS in the UK. After the initial certification audit, there are yearly surveillance audits to keep it, and a full recertification every three years. You can check a UKAS-accredited certificate at certcheck.ukas.com.

Why it matters

For buyers, it's independent evidence that a supplier takes security seriously and keeps doing so. Many tenders and supplier questionnaires ask for it, and it sits alongside standards such as PCI DSS for card payments.

How we do it

We're certified to ISO/IEC 27001:2022, certificate 239491, alongside ISO 9001:2015 for quality. Customer records, orders, pricing and system access, including the data our AI work touches, are handled under audited security controls. See our certificates, scope and policies.

Related

Related terms and services.