What is ISO 27001?

ISO 27001: definition and scope

The ISO/IEC 27001 standard describes the requirements for an ISMS. It is not a product but a management system of rules, responsibilities, processes and evidence that protects the confidentiality, integrity and availability of information. The current version is ISO/IEC 27001:2022; the transition period for certificates under the older version has ended.

The standard applies to organizations of any size and industry. The company decides for itself which area (scope) the ISMS covers, such as one site or just one service. ISO/IEC 27002 additionally describes possible controls. Certification is voluntary but is often required by customers and in supply chains.

How an ISMS works

At its core is a cycle of plan, do, check and act. The company records its information assets, assesses risks and selects suitable controls from Annex A of the standard, which contains 93 controls in four themes. In the statement of applicability, it justifies which ones it uses. Internal audits and management reviews provide oversight.

Certification is carried out by an accredited certification body in two stages: a document review and an on-site audit. The certificate is valid for three years, and annual surveillance audits ensure ongoing effectiveness. Anyone who slackens in between risks having the certificate restricted or withdrawn. The system must be lived continuously, not just on the day of the audit.

• Organizational: policies, roles, supplier management, contingency planning
• People: training, commitments, onboarding and offboarding processes
• Physical: access, rooms, devices, disposal
• Technological: access rights, encryption, patches, backups, logging

Real-world example: a supplier under customer pressure

A supplier with 120 employees receives a requirement from a large customer to demonstrate information security. So far there are only individual measures: antivirus, a backup, a password rule. Who is responsible for what, how incidents are reported and which suppliers have access is not documented anywhere.

The company defines a scope, carries out a risk analysis, closes gaps in access rights, updates and contingency planning and documents everything. After certification, the ISMS becomes part of daily operations. In the automotive industry, TISAX is often required in addition, an industry-specific assurance based on its own catalog of requirements.

Benefits, effort and imple­menta­tion

The benefit lies in clear responsibilities, fewer outages and a recognized proof for customers. The effort is real: it depends on scope, maturity and size and mainly ties up the time of management and IT. Typical mistakes are an overly large scope, paperwork without living practice and delegating everything to IT alone. An ISMS also helps with NIS2 requirements but does not replace checking the legal obligations.

Nano Concepts supports the technical implementation of the controls, such as hardening, patch management, backup, access rights and logging. Advice on the management system and the certification itself are handled by specialized consultants and an accredited certification body. That keeps it clear what is implemented technically and what is independently audited.