ISO/IEC 27001 information security management system certification
An audited management system for information security covering risk assessment, a chosen set of security controls (including physical and environmental protection of data centres), monitoring and improvement.
- 8requirementsin our own words
- 1edition 2022 edition
- 0places where it is a duty of 30 assessed
- 18 Oct 2026last checkedat the sources below
Where it applies
It is voluntary in the 30 places assessed. The outcome holds under the conditions shown and says nothing about any one site.
| Where | Outcome | Basis | Conditions | Authority and route |
|---|---|---|---|---|
| All 30 places | Applies | Voluntary In force | None stated No law in this country requires it; customers, lenders or tenders decide. | Not stated |
What it asks for
8 requirements, each in our own words with the evidence an assessor would expect and who on a site usually owns it. Read the clause itself on the scheme owner's page.
| Requirement | Evidence expected | Owner | When |
|---|---|---|---|
| Define the scope of the information security management system and the sites inside it. | Scope statement Policy, checked by document review | Security lead | Every year Management system, the organisation |
| Assess information security risks and choose treatments with a statement of which controls apply and why. | Risk register and statement of applicability Record, checked by document review | Security lead | Every year Management system, the organisation |
| Protect data halls and equipment: perimeter, entry control, equipment siting and supporting utilities. | Physical security records and utility maintenance logs Record, checked by document review | Security lead | Continuous Management system, one site |
| Train people for their security roles and keep awareness records. | Training records Record, checked by document review | HR | Every year Management system, the organisation |
| Handle information security incidents and learn from them. | Incident register Record, checked by document review | Security lead | Continuous Management system, the organisation |
| Manage suppliers' security. | Supplier assessments Contract, checked by document review | Procurement | Every year Management system, the organisation |
| Audit the system internally and review it at management level at planned intervals. | Internal audit and management review records Record, checked by document review | Quality | Every year Management system, the organisation |
| Keep the certificate valid through surveillance audits and recertification. | Audit schedule and reports Certificate, checked by document review | Compliance manager | Each certification cycle Management system, the organisation |
Editions
Which text is in force, from when, and which one it replaced.
| Edition | Status | Published | In effect | Replaces |
|---|---|---|---|---|
| 2022 edition | Current Edition named by BSI; publication and withdrawal dates of 2013 edition not confirmed from a non-ISO official source, so the 2013 row is not kept. | Not stated | Not stated | None named |
About the programme
- Scheme owner
- ISO and IEC (standard); certificates issued by certification bodies
- Assessed by
- An accredited certification body
- Scope
- organisation or defined scope (site, service)
- Levels
- single certificate; Statement of Applicability defines controls in scope
- Validity
- Certificate cycle for this standard is not stated on an official page read in this pass (HDS and IAF MD 5 pages state three-year cycles for their own schemes only); left blank rather than assumed.
- Time to a first certificate
- BSI (Germany) says the certification process takes three months to a year depending on the volume of systems audited and staff involved (IT-Grundschutz-based route)
- Accreditation route
- National accreditation body under EA and Regulation (EC) 765/2008; one per Member State
- Recognised by
- EA MLA signatories
- Who asks for it
- Wholesale and hyperscale customers, Enterprise and colocation customers, Financial-sector clients, Public tenders, Health-data customers
- Where it is used
- global
Related programmes
- National route: ACN qualification of cloud infrastructures and services (Italy)
- National route: Baseline Informatiebeveiliging Overheid (BIO2), Netherlands
- National route: ISO 27001 certification on the basis of IT-Grundschutz (BSI, Germany)
- National route: Esquema Nacional de Seguridad (ENS), Spain
- National route: HDS (hébergeur de données de santé) certification
Sources
Official bodies behind this page, each with the date we last read it.
No official body publishes a page for this scheme. The scheme owner's own page, linked under About the programme, is where the clauses are published.
Not legal advice. Confirm each duty against the text itself.