What is ISO 27001?
In short
ISO/IEC 27001 is the international standard for an information security management system (ISMS). An organisation maps its risks, chooses measures to protect information and keeps checking and improving them.
What does ISO 27001 require?
ISO 27001 does not prescribe a fixed set of measures, but a way of working. The organisation defines the scope, identifies what information it has and which risks apply to it, chooses controls and records why. Then come internal audits, a management review and improvements: a cycle that recurs every year.
The organisation chooses the controls from an annex to the standard. In the current version, ISO/IEC 27001:2022, there are 93 controls in four themes: organisational, people, physical and technological. Examples are access management, encryption, backups, supplier management and staff awareness. Certificates to the old 2013 version expired after the transition period.
What does a certificate say?
An accredited certification body checks whether the organisation meets the standard; in the Netherlands the Dutch Accreditation Council accredits these bodies. A certificate is valid for three years, with annual audits. It says that the organisation controls its information security within the scope stated on the certificate, not that nothing will ever go wrong.
Why does it matter when choosing software?
With SaaS, your data sits with the supplier. An ISO 27001 certificate is a quick way to judge whether they take that seriously, and organisations covered by NIS2 must assess their suppliers on security. Ask for the certificate, check the scope and validity, and see whether the service you buy is covered.
Which software helps with this?
An ISO 27001 certificate from a software supplier says something about how it handles your data. Ask for the certificate and check what falls within its scope: sometimes only part of the organisation is certified.
Compare in the category
Including 365 Total Protection, Aikido Security and Attic MDR.