ISO 27001 Knowledge Base

Purpose

This is the ISO/IEC 27001 section of the vault. It answers:

What is required for the ISMS?

ISO/IEC 27001 is the requirements standard. It defines the management-system requirements, the risk-based control selection requirement, and Annex A as the control reference set. It is the certifiable standard in this knowledge base.

Core relationship

ISO 27001 source notes

• Information Security Management System
• Field of Application, Usage, and Compliance
• ISO 27001 Clauses 4-10 vs Annex A
• Annex A and the Statement of Applicability
• Statement of Applicability
• Risk Assessment
• Internal Audit
• Management Review

Annex A controls

• A.5 Organizational Controls MOC
• Annex A Controls MOC

Implementation and audit views

• ISO 27001 Requirements to Implementation and Audit Map
• ISO 27001 Implementer Guide MOC
• ISO 27001 Auditor Guide MOC
• ISO 27001 Implementer Auditor ISO 27005 Mapping

Exam cues

• Clauses 4-10 are mandatory management-system requirements.
• Annex A controls are selected based on risk assessment, risk treatment, and the Statement of Applicability.
• ISO/IEC 27002 explains control guidance; it is not the certifiable requirements standard.
• ISO/IEC 27005 supports risk management; it does not replace ISO/IEC 27001 requirements.

Research basis

ISO describes ISO/IEC 27001 as the standard for information security management systems and notes that it helps organizations manage information security risks through people, policies, and technology.

External references

• ISO/IEC 27001:2022 overview