What is ISO 27001?
- Term
- ISO 27001
- Meaning
- ISO/IEC 27001 is the ISO standard that sets requirements for an information security management system. Certification bodies audit companies against it.
ISO/IEC 27001 is the international standard that sets requirements for an information security management system (ISMS). An ISMS is the set of policies, roles and processes a company uses to manage risks to the information it owns or handles. The current edition is ISO/IEC 27001:2022, the third, published in October 2022 with one amendment in 2024. A company can follow the standard on its own, or have an independent certification body audit it and issue a certificate.
What does the standard require?
ISO describes the standard as defining the requirements an ISMS must meet, for companies of any size and sector. You set up the system, run it and keep improving it, using a risk management process. ISO names three things the system protects: confidentiality, so only the right people see information; integrity, so it stays accurate; and availability, so it’s there when needed.
The requirements sit in clauses 4 to 10, and a note from the standard’s auditing practices group says none of them can be excluded. Annex A is a reference list of controls. You compare the controls your risk assessment produced with it to find any you missed. You then record the result in a Statement of Applicability, which lists the controls you need, whether each is in place, and why you left any Annex A control out.
ISO/IEC 27002:2022 gives guidance on the controls. ISO says you can’t be certified to ISO/IEC 27002, only to ISO/IEC 27001.
How does certification work in the US?
ISO writes the standard but doesn’t certify anyone. Certification bodies audit companies and issue certificates. Accreditation bodies check that certification bodies are competent. ISO notes that accreditation isn’t compulsory, but it adds an independent check on the certification body.
In the US, the ANSI National Accreditation Board (ANAB) accredits certification bodies for ISO/IEC 27001. Global ACI lists ANAB as a signatory to its mutual recognition arrangement for that standard. You can check whether a certificate came from an accredited body in IAF CertSearch, a database ISO points to. You can also ask the certification body or an accreditation body, such as ANAB in the US.
Where do accounts fit?
NIST’s crosswalk maps its own controls on accounts, passwords and admin rights to several Annex A controls. For the SaaS apps your team uses, those cover who may use each app, how accounts are created and removed, and who holds admin roles. What they ask for and the records an auditor looks for are in ISO 27001 access controls for SaaS accounts.
A certificate shows that a certification body found the company’s ISMS conforms to the standard. It doesn’t tell a customer who uses the accounts the customer handed over. When a vendor works in your accounts, the controls to check are in Which ISO 27001 controls apply when a vendor uses your accounts.
Frequently asked questions
Is ISO 27001 the same as ISO/IEC 27001?
Yes. ISO says the official name is ISO/IEC 27001 because ISO and the International Electrotechnical Commission (IEC) publish it together. "ISO 27001" is the common short form.
Does ISO certify companies?
No. ISO says it doesn't perform certification or issue certificates. Certification bodies do. In the US, ANAB accredits certification bodies for ISO/IEC 27001.
Our vendor is ISO 27001 certified. Is that enough for our accounts?
Not on its own. A certificate covers the vendor's management system. It doesn't show who uses the accounts you gave the vendor or how that use is recorded. Cover that in the contract and your own checks.
How Junify handles this
- Doing this by hand
- You map each requirement to how your team actually works. You keep a record an auditor can review: which accounts exist, who may use each one, and who used it. And you reread the rules each time they change.
- With Junify
- For shared logins, your admin adds each login to Junify and chooses who may use it. People verify on their own phone and click to sign in, and Junify fills in the password without showing it. Junify records who used which account and when, person by person, including shared logins. When someone's work ends, you remove their access in Junify.
Sources
- ISO/IEC 27001:2022, Information security, cybersecurity and privacy protection: Information security management systems: Requirements (ISO standard page and FAQ)
- ISO/IEC 27002:2022, Information security, cybersecurity and privacy protection: Information security controls (ISO standard page and FAQ)
- ISO: Certification (conformity assessment)
- ISO Help: How to verify an accredited certification
- Global Accreditation Cooperation Incorporated (Global ACI): member details, ANSI National Accreditation Board
- NIST, Crosswalk: SP 800-53 Rev. 5 to ISO/IEC 27001:2022 (OLIR informative reference, spreadsheet)
- ISO/IEC JTC 1/SC 27/WG 1 N 3298, ISO/IEC 27001 Auditing Practices Group: Auditing Practices Note, Statement of Applicability (September 2022)
-
What access logs need to show when you decide whether to report a breach
Logs show whether data was viewed, by whom, for how many people and since when. HIPAA presumes a breach unless you can show a low probability of compromise.
-
Password sharing and the federal anti-hacking law (CFAA)
The CFAA turns on whether the system's owner allowed the access. In Nosal, former employees using a current employee's login acted without authorization.
-
What CIS Controls 5 and 6 (v8.1) ask of your accounts
Control 5 asks for an account inventory, disabled dormant accounts and separate admin accounts. Control 6 covers granting and revoking access, and MFA.