Focus on ISO/CEI 27001

The official title of this standard is "Information technology - Security techniques - Information security management systems - Requirements".

This standard specifies the requirements for the organization, implementation, maintenance and continuous improvement of an information security management system (ISMS). The aim of an ISMS is to help organizations secure their data and information (such as financial information, intellectual property, employee data or information entrusted to them by third parties).

Organizations that meet these requirements can choose to be assessed through an audit in order to be certified by an accredited certification body, such as LSTI.

ISO/IEC 27001:2013 comprises ten short clauses and one long annex, covering the following:

1. Scope of the standard
2. How the document is referenced
3. Reuse of terms and definitions in ISO/IEC 27000
4. Organizational context and stakeholders
5. Information security leadership and high-level policy support
6. Planning an information security management system, risk assessment, risk treatment
7. Supporting an information security management system
8. Making an information security management system operational
9. System performance review
10. Corrective action
11. Appendix A: List of controls and their objectives

Like any other management system standard, ISO/IEC 27001 certification is possible, but not compulsory. Some companies choose to implement this standard to benefit from the good practices it contains, while others decide to become certified to reassure their customers.

This standard is the benchmark for our corporate services, as well as for the auditor/lead auditor 27001 and implementer 27001 exams.