ISO/IEC 27001 specifies requirements for an information security management system. It connects organisational context, leadership, risk assessment and treatment, performance evaluation and continual improvement. Consult the ISO publication page for the applicable edition and amendments.
Use in a programme
Define the ISMS boundary and the information-security risks it must address. Determine the necessary controls through the risk-treatment process and document applicability and exclusions in the required context.
The management-system requirements and Annex A control reference have different roles. A list of technical controls alone is not the whole ISMS, and conformity does not mean that all information-security risk has been eliminated.
Use in CSFaaS
The reviewed library offers ISO 27001:2022 in English and French. Inspect the imported hierarchy, source edition and workspace adaptations before assessment.
Link policies, assign owners, record implementation evidence and track review work. Use the wider risk-management modules for the assessments and treatment decisions that support the programme. Internal applicability and maturity scores help organise work; formal certification depends on the applicable independent assessment process.