Preparation is keyĪn audit of your entire information security management system, including its technologies, processes and procedures, and people, will almost certainly be a challenge to pass. ISO 27001 lists the controls ISO 27002 guides the implementation of those controls.

Information security aspects of business continuity management.

Information security incident management.

Systems acquisition, development and maintenance.

Those security requirements fall into 14 categories: To achieve certification, your organization must pass a rigorous audit of the 114 security controls contained in the latest ISO 27001 update, ISO 27001:2013. To become certified as ISO compliant, you must pass an audit and obtain yearly “surveillance audit” reports attesting that you still comply. Mere ISO 27001 compliance isn’t always enough. And in fact, ISO 27001 certification is a must for many enterprises that do business with you. In this day and age, that’s no small claim. Stakeholders include your current and future clients, business partners, suppliers, and customers. Being able to say you’re “ISO 27001 certified” tells stakeholders that your organization is serious about protecting the security and privacy of their information.

That’s because ISO 27001 is the international standard for Information Security Management System (ISMS). But for many organizations, it’s worth the effort. Getting your certification for ISO 27001 is a complex and time-consuming endeavor.

Iso 27002 checklist xls