QULDEXResources · Glossary
ISO 27001 definition: what the standard is, in brief
What does ISO 27001 mean?
ISO 27001 does not prescribe a fixed list of security measures. It requires a management system: defined scope, leadership, risk assessment, risk treatment, measurement, internal audit, management review and corrective action.
This page is the short glossary definition. The full QULDEX guide covers the clauses, the controls, the audit and the costs of getting it wrong.
What are the main parts of ISO 27001?
Context, leadership, planning, support, operation, performance evaluation and improvement.
93 controls in four themes: organisational, people, physical and technological.
Which controls you apply and why, including any Annex A exclusions.
How does the standard work in practice?
The sequence an organisation follows.
| Step | What happens |
|---|---|
| Scope | Decide what the management system covers |
| Risk | Assess risks and choose how to treat them |
| Controls | Implement controls and record them in the Statement of Applicability |
| Check | Internal audit and management review |
| Certify | Two-stage audit by an accredited certification body |
This is an illustration written for this page, not a customer record.
ISO 27001: key facts
| Topic | Detail | Notes |
|---|---|---|
| Current edition | 2022 | ISO/IEC 27001:2022, with Amendment 1:2024 on climate action. |
| Controls | 93 | Organisational 37, people 8, physical 14, technological 34. |
| Certificate | 3 years | With surveillance audits during the cycle, then recertification. |
| Related | ISO/IEC 27002 | Guidance on implementing each Annex A control. |
References are to the current editions listed under Sources. Check the edition your auditor is using.
What do people get wrong about ISO 27001?
'It is a checklist of controls'
The requirement is a management system; the controls follow from your risks.
Instead: start with scope and risk assessment.
'All 93 controls are mandatory'
You must consider all of them, not implement all of them.
Instead: justify each choice in the Statement of Applicability.
'Certification is the end'
The certificate depends on surveillance audits and continual improvement.
Instead: keep the system running between audits.
How does QULDEX handle this?
Plan, test, record findings and report in eight phases, with every step recorded against the audit.
ISO 27001: common questions
What does ISO 27001 stand for?
It is standard number 27001 published jointly by ISO, the International Organization for Standardization, and IEC, the International Electrotechnical Commission.
What is an ISMS?
An information security management system: the policies, processes, roles and controls an organisation uses to manage information security risk.
Is ISO 27001 mandatory?
It is voluntary, but customers and regulators often ask for it, and some contracts require it.
Sources
- ISO/IEC 27001:2022, Information security management systems: Requirements
- ISO/IEC 27002:2022, Information security controls
- ISO/IEC 27006-1:2024, Requirements for bodies providing audit and certification of ISMS
- ISO/IEC 17021-1:2015, Requirements for bodies providing audit and certification of management systems
Run your ISO 27001 audits in one workspace
Controls, evidence, findings and corrective actions in one audit workspace.