ISO 27001

ISO/IEC 27001 is an international standard that specifies requirements for establishing, operating and improving an information security management system (ISMS). It asks an organisation to understand its context, assess risks, select and justify controls, assign responsibilities, measure performance and correct nonconformities. Certification is performed against a stated scope by an accredited certification body; it does not automatically cover every office, supplier, product or service. The standard does not prescribe one technology and certification does not prove that incidents cannot occur. When evaluating a certificate, check the legal entity, scope, sites, issue and expiry dates and certification body. More useful evidence also includes the statement of applicability, audit findings where shareable, risk treatment and proof that the management cycle operates between external audits.